| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Probleme mit verschiedenen FundenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
20.10.2011, 20:35
| #16 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Probleme mit verschiedenen Funden Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
20.10.2011, 20:49
| #17 |
 | Probleme mit verschiedenen Funden hier der combofix log:
__________________Combofix Logfile: Code:
ATTFilter ComboFix 11-10-20.05 - xxx 20.10.2011 21:41:51.2.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3067.2093 [GMT 2:00]
ausgeführt von:: c:\users\standard\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-09-20 bis 2011-10-20 ))))))))))))))))))))))))))))))
.
.
2011-10-20 19:45 . 2011-10-20 19:45 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-10-20 19:45 . 2011-10-20 19:45 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-20 19:45 . 2011-10-20 19:45 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-10-20 18:08 . 2011-10-20 18:08 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{51BCE1A2-A755-4FAD-9141-025295B533B3}\offreg.dll
2011-10-20 18:02 . 2011-10-20 19:01 -------- d-----w- C:\_OTL
2011-10-19 14:35 . 2011-10-03 00:53 611224 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-10-18 17:18 . 2011-09-12 23:14 7269712 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{51BCE1A2-A755-4FAD-9141-025295B533B3}\mpengine.dll
2011-10-14 15:23 . 2011-10-14 15:23 -------- d-----w- c:\users\standard\AppData\Roaming\Avira
2011-10-14 15:23 . 2011-10-11 13:00 74640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-10-14 15:23 . 2011-10-11 13:00 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2011-10-14 15:23 . 2011-10-11 13:00 134344 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-10-14 15:23 . 2011-10-14 15:23 -------- d-----w- c:\programdata\Avira
2011-10-14 15:23 . 2011-10-14 15:23 -------- d-----w- c:\program files\Avira
2011-10-13 14:52 . 2011-08-27 04:26 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-10-13 14:52 . 2011-08-27 04:26 233472 ----a-w- c:\windows\system32\oleacc.dll
2011-10-13 14:52 . 2011-08-17 04:24 465408 ----a-w- c:\windows\system32\psisdecd.dll
2011-10-13 14:52 . 2011-08-17 04:19 75776 ----a-w- c:\windows\system32\psisrndr.ax
2011-10-13 14:52 . 2011-09-06 02:28 2334720 ----a-w- c:\windows\system32\win32k.sys
2011-09-30 15:55 . 2011-09-30 15:55 -------- d-----w- c:\users\xxx\AppData\Roaming\Skype
2011-09-23 11:21 . 2011-09-23 11:21 -------- d-----w- c:\programdata\vrep
2011-09-23 11:20 . 2011-09-23 11:21 -------- d-----w- c:\program files\V-REP
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-03 00:50 . 2011-06-01 19:30 544656 ----a-w- c:\windows\system32\deployJava1.dll
2011-09-30 16:10 . 2011-06-01 19:49 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-31 15:00 . 2011-06-01 18:37 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-18 10:05 . 2011-08-18 10:05 446464 ----a-w- c:\windows\system32\HHActivex.dll
2011-08-05 07:29 . 2011-08-05 07:29 200704 ----a-w- c:\windows\PLFSetI.exe
2011-09-29 07:09 . 2011-09-30 16:04 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 10:06 163328 --sha-r- c:\windows\System32\flvDX.dll
2007-02-21 11:47 31232 --sha-r- c:\windows\System32\msfDX.dll
2008-03-16 13:30 216064 --sha-r- c:\windows\System32\nbDX.dll
2010-01-06 22:00 107520 --sha-r- c:\windows\System32\TAKDSDecoder.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-08-05 2424192]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-07-29 17361032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-28 13797920]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"PLFSetI"="c:\windows\PLFSetI.exe" [2011-08-05 200704]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-05-04 252136]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
.
c:\users\standard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-4-19 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-09-23 50424]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-11 36000]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-09-23 144632]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2011-04-19 993848]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2011-04-19 399416]
S3 k57nd60x;Broadcom NetLink (TM)-Gigabit-Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2009-09-15 6114816]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 51715544
*Deregistered* - 51715544
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Zusätzlicher Suchlauf -------
.
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ds8wnvyu.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-FoxTab PDF Converter - c:\program files\FoxTabPDFConverter\Uninstall\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-10-20 21:47:42
ComboFix-quarantined-files.txt 2011-10-20 19:47
.
Vor Suchlauf: 18 Verzeichnis(se), 444.146.552.832 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 444.074.909.696 Bytes frei
.
- - End Of File - - 6AACC9957148990B460D1C83A52101A5
|
|
20.10.2011, 21:00
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit verschiedenen Funden Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
__________________GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).
__________________ |
|
20.10.2011, 22:17
| #19 |
| | Probleme mit verschiedenen Funden alles erledigt, hier die logs: aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software Run date: 2011-10-20 22:42:20 ----------------------------- 22:42:20.215 OS Version: Windows 6.1.7601 Service Pack 1 22:42:20.215 Number of processors: 2 586 0x170A 22:42:20.215 ComputerName: XXX-PC UserName: xxx 22:42:22.211 Initialize success 22:43:49.806 AVAST engine defs: 11102002 22:43:58.168 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 22:43:58.168 Disk 0 Vendor: Hitachi_HTS545050B9A300 PB4OC60F Size: 476940MB BusType: 11 22:44:00.274 Disk 0 MBR read successfully 22:44:00.274 Disk 0 MBR scan 22:44:00.305 Disk 0 Windows 7 default MBR code 22:44:00.367 Disk 0 scanning sectors +976771072 22:44:00.664 Disk 0 scanning C:\Windows\system32\drivers 22:45:08.009 Service scanning 22:45:09.273 Modules scanning 22:46:39.940 Disk 0 trace - called modules: 22:46:39.955 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll PCIIDEX.SYS msahci.sys 22:46:39.971 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861bc3b8] 22:46:39.971 3 CLASSPNP.SYS[8b1be59e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x86095030] 22:46:41.469 AVAST engine scan C:\Windows 22:46:55.384 AVAST engine scan C:\Windows\system32 22:57:45.281 AVAST engine scan C:\Windows\system32\drivers 22:58:06.981 AVAST engine scan C:\Users\xxx 22:58:52.408 AVAST engine scan C:\ProgramData 22:59:40.175 Scan finished successfully 23:08:34.273 Disk 0 MBR has been saved successfully to "C:\Users\standard\Desktop\MBR.dat" 23:08:34.273 The log file has been saved successfully to "C:\Users\standard\Desktop\aswMBR.txt" OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 22:41:26 on 20.10.2011 OS: Windows 7 Service Pack 1 (Build 7601), 32-bit Default Browser: Mozilla Corporation Firefox 7.0.1 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Control Panel Objects] -----( %SystemRoot%\system32 )----- "FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl "nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\MLCFG32.CPL [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys "avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys "catchme" (catchme) - ? - C:\Users\xxx\AppData\Local\Temp\catchme.sys (File not found) "kxtdipow" (kxtdipow) - ? - C:\Users\xxx\AppData\Local\Temp\kxtdipow.sys (Hidden registry entry, rootkit activity | File not found) "MBAMSwissArmy" (MBAMSwissArmy) - ? - C:\Windows\system32\drivers\mbamswissarmy.sys (File not found) "mbr" (mbr) - ? - C:\ComboFix\mbr.sys (Hidden registry entry, rootkit activity | File not found) "PSI" (PSI) - "Secunia" - C:\Windows\System32\DRIVERS\psi_mf.sys "SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS "SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys "UBHelper" (UBHelper) - "NewTech Infosystems Corporation" - C:\Windows\system32\drivers\UBHelper.sys "Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll (File found, but it contains no detailed information) {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll {88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll {D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll {7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A} "Enterprise-Projekte" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL {99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll (File found, but it contains no detailed information) {5574006C-28F5-4a65-A28C-74DE6BFBE0BB} "Haali Matroska Shell Property Page" - ? - C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll (File found, but it contains no detailed information) {327669A0-59A7-4be9-B99E-1C9F3A57611A} "Haali Matroska Thumbnail Extractor" - ? - C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll (File found, but it contains no detailed information) {506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\ONFILTER.DLL {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\MLSHEXT.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll {FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\OLKFSTUB.DLL {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll [Internet Explorer] -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )----- {555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.7.0_01" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\npjpi170_01.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} "Java Plug-in 1.7.0_01" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\npjpi170_01.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.7.0_01" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\npjpi170_01.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "@C:\Windows\WindowsMobile\INetRepl.dll,-222" - "Microsoft Corporation" - C:\Windows\WindowsMobile\INetRepl.dll {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\Windows\WindowsMobile\INetRepl.dll {53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll {DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Smart Web Printing ein- oder ausblenden" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {0347C33E-8762-4905-BF09-768834316C61} "HP Print Enhancer" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2ssv.dll {B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL {53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll {2EECD738-5844-4a99-B4B6-146BF802613B} "{2EECD738-5844-4a99-B4B6-146BF802613B}" - ? - (File not found | COM-object registry key not found) [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Shortcut exists | File exists) "Secunia PSI Tray.lnk" - "Secunia" - C:\Program Files\Secunia\PSI\psi_tray.exe (Shortcut exists | File exists) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized "SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe "SUPERAntiSpyware" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min "GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" "HP Software Update" - "Hewlett-Packard" - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "hpqSRMon" - "Hewlett-Packard" - C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe "Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript "NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup "PLFSetI" - ? - C:\Windows\PLFSetI.exe "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Redmon" - ? - C:\Windows\system32\redmonnt.dll (File found, but it contains no detailed information) "Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe "Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe "Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe "HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll "HP Network Devices Support" (HPSLPSVC) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL "hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE "Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe "Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll "NTI Backup Now 5 Backup Service" (NTIBackupSvc) - "NewTech InfoSystems, Inc." - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe "NTI Backup Now 5 Scheduler Service" (NTISchedulerSvc) - "NewTech Infosystems, Inc." - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe "NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE "Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll "SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe "Secunia PSI Agent" (Secunia PSI Agent) - "Secunia" - C:\Program Files\Secunia\PSI\PSIA.exe "Secunia Update Agent" (Secunia Update Agent) - "Secunia" - C:\Program Files\Secunia\PSI\sua.exe ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
|
21.10.2011, 13:10
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit verschiedenen Funden GMER ging nicht?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
21.10.2011, 16:30
| #21 |
| | Probleme mit verschiedenen Funden doch ging schon aber der log wurde nicht gespeichert habs nochmal durchlaufen lassen: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-10-21 17:28:27
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS545050B9A300 rev.PB4OC60F
Running: wdyi2xk9.exe; Driver: C:\Users\xxx\AppData\Local\Temp\kxtdipow.sys
---- System - GMER 1.0.15 ----
SSDT 90C481DE ZwCreateSection
SSDT 90C481E8 ZwRequestWaitReplyPort
SSDT 90C481E3 ZwSetContextThread
SSDT 90C481ED ZwSetSecurityObject
SSDT 90C481F2 ZwSystemDebugControl
SSDT 90C4817F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKey + 13D1 82C79349 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82CB2D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 82CB9EAC 4 Bytes [DE, 81, C4, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 82CBA208 4 Bytes [E8, 81, C4, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 82CBA24C 4 Bytes [E3, 81, C4, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 82CBA2C8 4 Bytes [ED, 81, C4, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1667 82CBA31C 4 Bytes [F2, 81, C4, 90]
.text ...
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73C42437] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73C25600] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73C256BE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73C424B2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73C38514] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73C34CC8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73C3506F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73C35144] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [73C36671] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73C3826B] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73C387BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73C3901B] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73C3E1BE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73C34BFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\ACPI_HAL \Device\0000004d halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
|
|
22.10.2011, 16:00
| #22 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit verschiedenen Funden Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
22.10.2011, 19:24
| #23 |
| | Probleme mit verschiedenen Funden also hier ersmal malewarebyte und superantispyware, eset folgt. superanti. hatte einige funde, die 2 letzten sind von einer simulationssoftware, wahrscheinlich fehlalarm? die cookies hab ich entfernen lassen. Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 7999 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 22.10.2011 20:04:48 mbam-log-2011-10-22 (20-04-48).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|G:\|P:\|) Durchsuchte Objekte: 315818 Laufzeit: 1 Stunde(n), 49 Minute(n), 2 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 10/22/2011 at 07:27 PM Application Version : 5.0.1134 Core Rules Database Version : 7837 Trace Rules Database Version: 5649 Scan type : Complete Scan Total Scan Time : 01:09:45 Operating System Information Windows 7 Professional 32-bit, Service Pack 1 (Build 6.01.7601) UAC On - Administrator Memory items scanned : 764 Memory threats detected : 0 Registry items scanned : 40318 Registry threats detected : 0 File items scanned : 45733 File threats detected : 295 Adware.Tracking Cookie C:\USERS\STANDARD\AppData\Roaming\Microsoft\Windows\Cookies\CF3960Y5.txt [ Cookie:standard@clkads.com/adServe/ ] C:\USERS\STANDARD\AppData\Roaming\Microsoft\Windows\Cookies\IU9S0IG5.txt [ Cookie:standard@clkads.com/adServe/static/ ] C:\USERS\STANDARD\AppData\Roaming\Microsoft\Windows\Cookies\WM29VMK0.txt [ Cookie:standard@clkads.com/adServe/banners ] C:\USERS\STANDARD\Cookies\CF3960Y5.txt [ Cookie:standard@clkads.com/adServe/ ] C:\USERS\STANDARD\Cookies\IU9S0IG5.txt [ Cookie:standard@clkads.com/adServe/static/ ] C:\USERS\STANDARD\Cookies\WM29VMK0.txt [ Cookie:standard@clkads.com/adServe/banners ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\M8BQDVMN.txt [ Cookie:xxx@events.webflowmetrics.com/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\62LBW23V.txt [ Cookie:xxx@babylon.com/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@www.vodafone[1].txt [ Cookie:xxx@www.vodafone.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@windows.microsoft[1].txt [ Cookie:xxx@windows.microsoft.com/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@lead-alliance[2].txt [ Cookie:xxx@lead-alliance.net/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@adsfac[2].txt [ Cookie:xxx@adsfac.eu/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@o2online[1].txt [ Cookie:xxx@o2online.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@active-srv02[1].txt [ Cookie:xxx@active-srv02.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@advolution[2].txt [ Cookie:xxx@advolution.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@gmads[2].txt [ Cookie:xxx@gmads.net/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@msn[1].txt [ Cookie:xxx@msn.com/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@mlsat02[1].txt [ Cookie:xxx@mlsat02.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@openxm02.ipxmuc-a.cxo[2].txt [ Cookie:xxx@openxm02.ipxmuc-a.cxo.name/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@adscale[1].txt [ Cookie:xxx@adscale.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@www1.mpnrs[2].txt [ Cookie:xxx@www1.mpnrs.com/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@dslshop.vodafone[1].txt [ Cookie:xxx@dslshop.vodafone.de/eshop ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@adyard[1].txt [ Cookie:xxx@adyard.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@flashtalking[2].txt [ Cookie:xxx@flashtalking.com/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@alice-dsl[1].txt [ Cookie:xxx@alice-dsl.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@bmw[1].txt [ Cookie:xxx@bmw.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@herrenausstatter[2].txt [ Cookie:xxx@herrenausstatter.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@chip[2].txt [ Cookie:xxx@chip.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@www.microsoft[1].txt [ Cookie:xxx@www.microsoft.com/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@admax.quisma[1].txt [ Cookie:xxx@admax.quisma.com/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@refinedads[2].txt [ Cookie:xxx@refinedads.com/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@ih.adscale[3].txt [ Cookie:xxx@ih.adscale.de/adscale-ih/impr ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@ih.adscale[2].txt [ Cookie:xxx@ih.adscale.de/adscale-ih/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@www.kdukvh[1].txt [ Cookie:xxx@www.kdukvh.com/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@ivwbox[2].txt [ Cookie:xxx@ivwbox.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@nuggad[1].txt [ Cookie:xxx@nuggad.net/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@dsl.1und1[1].txt [ Cookie:xxx@dsl.1und1.de/ ] C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@bing[2].txt [ Cookie:xxx@bing.com/ ] C:\USERS\XXX\Cookies\M8BQDVMN.txt [ Cookie:xxx@events.webflowmetrics.com/ ] C:\USERS\XXX\Cookies\62LBW23V.txt [ Cookie:xxx@babylon.com/ ] .apmebf.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .mediaplex.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .mediaplex.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .doubleclick.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] eas.apm.emediate.eu [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .im.banner.t-online.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] eas.apm.emediate.eu [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .atdmt.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .atdmt.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .ads.quartermedia.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .ru4.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .specificclick.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] adserver2.web-gear.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.etracker.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] statse.webtrendslive.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .imrworldwide.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .imrworldwide.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] track.effiliation.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adinterax.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .apmebf.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .content.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] accounts.google.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.moviepilot.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .im.banner.t-online.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .moviepilot.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .moviepilot.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .moviepilot.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .clickaider.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] de.sitestat.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] track.adform.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .unitymedia.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .unitymedia.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .unitymedia.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .mediaplex.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tradedoubler.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .e-2dj6wnkisjczecq.stats.esomniture.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .bs.serving-sys.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .statcounter.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .stats4free.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .stats4free.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .stats4free.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] m1.webstats.motigo.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .ad.adnet.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .ad.adnet.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .traffictrack.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adinterax.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .advertising.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .advertising.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.adition.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.adition.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tradedoubler.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tradedoubler.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tradedoubler.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .content.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .mediaplex.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] eas.apm.emediate.eu [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] eas.apm.emediate.eu [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.etracker.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.beyond-media.at [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adviva.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .fastclick.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .stepstone.112.2o7.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .paypal.112.2o7.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .stats.paypal.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .doubleclick.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .lucidmedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.zanox-affiliate.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.dyntracker.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .pornolize.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .pornolize.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .pornolize.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .ru4.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .2o7.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .oracle.112.2o7.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .ads.quartermedia.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] www.etracker.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tribalfusion.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .collective-media.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .kontera.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .media6degrees.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .media6degrees.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .media6degrees.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.zanox.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] track.effiliation.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] track.effiliation.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] track.effiliation.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] track.effiliation.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .zanox.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .zanox-affiliate.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] track.adform.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adform.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad3.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] eas.apm.emediate.eu [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ads.adxvalue.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ads.adxvalue.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ads.adxvalue.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ads.adxvalue.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ads.adxvalue.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .questionmarket.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.zanox.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad.adserver01.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad1.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad4.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] ad2.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ] Trojan.Agent/Gen-Krpytik C:\PROGRAM FILES\MHJ-SOFTWARE\SPS-VISU-V4_8X\S5DBW32.DLL Adware.Vundo/Variant-X32[Header] C:\PROGRAM FILES\MHJ-SOFTWARE\SPS-VISU-V4_8X\S7P_RW32.DLL |
|
22.10.2011, 20:45
| #24 |
| | Probleme mit verschiedenen Funden und hier der eset log, wider ein fund, wieder in einer simulationssoftware. die sind aber beide direkt vom hersteller heruntergeladen also nichts illegales oder so. wäre aber schon ein seltsamer zufall wenn es 2x ein fehlalarm ist oder? mfg ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-07-30 06:11:52 # local_time=2011-07-30 08:11:52 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 28156 48579616 20948 0 # compatibility_mode=5893 16776573 100 94 28044 63673986 0 0 # compatibility_mode=8192 67108863 100 0 5085925 5085925 0 0 # scanned=295181 # found=13 # cleaned=0 # scan_time=6737 C:\Windows.old\ProgramData\Microsoft\Windows\Start Menu\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I C:\Windows.old\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I C:\Windows.old\ProgramData\Startmenü\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I C:\Windows.old\ProgramData\Startmenü\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I C:\Windows.old\Users\All Users\Anwendungsdaten\Microsoft\Windows\Start Menu\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I C:\Windows.old\Users\All Users\Anwendungsdaten\Microsoft\Windows\Start Menu\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I C:\Windows.old\Users\All Users\Anwendungsdaten\Startmenü\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I C:\Windows.old\Users\All Users\Anwendungsdaten\Startmenü\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I C:\Windows.old\Users\All Users\Microsoft\Windows\Start Menu\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I C:\Windows.old\Users\All Users\Microsoft\Windows\Start Menu\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I C:\Windows.old\Users\All Users\Startmenü\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I C:\Windows.old\Users\All Users\Startmenü\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I F:\Toolz\Video converter\installer_youtube_flv_to_avi_converter_pro_5_9_80_Deutsch.exe Win32/Hoax.ArchSMS.KC application (unable to clean) 00000000000000000000000000000000 I ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-08-06 11:52:36 # local_time=2011-08-06 01:52:36 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 524007 49165194 93118 0 # compatibility_mode=5893 16776573 100 94 100166 64259564 0 0 # compatibility_mode=8192 67108863 100 0 5671503 5671503 0 0 # scanned=134031 # found=0 # cleaned=0 # scan_time=3204 ESETSmartInstaller@High as downloader log: all ok esets_scanner_update returned -1 esets_gle=53251 # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-08-06 12:58:48 # local_time=2011-08-06 02:58:48 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 528477 49169664 97588 0 # compatibility_mode=5893 16776573 100 94 104636 64264034 0 0 # compatibility_mode=8192 67108863 100 0 5675973 5675973 0 0 # scanned=133969 # found=0 # cleaned=0 # scan_time=2706 ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=stopped # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-08-17 06:48:16 # local_time=2011-08-17 08:48:16 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 451777 50143717 96676 0 # compatibility_mode=5893 16776574 100 94 40662 65238087 0 0 # compatibility_mode=8192 67108863 100 0 6650026 6650026 0 0 # scanned=78 # found=0 # cleaned=0 # scan_time=4 ESETSmartInstaller@High as downloader log: all ok esets_scanner_update returned -1 esets_gle=53251 # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=stopped # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-08-17 07:39:03 # local_time=2011-08-17 09:39:03 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 451859 50143799 96758 0 # compatibility_mode=5893 16776573 100 94 40744 65238169 0 0 # compatibility_mode=8192 67108863 100 0 6650108 6650108 0 0 # scanned=150728 # found=2 # cleaned=0 # scan_time=2985 C:\Users\standard\AppData\Local\Mozilla\Firefox\Profiles\8aczhzn9.default\Cache\2\89\6B676d01 JS/Kryptik.BT trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\standard\AppData\Local\Mozilla\Firefox\Profiles\8aczhzn9.default\Cache\6\33\9E305d01 JS/Kryptik.BY trojan (unable to clean) 00000000000000000000000000000000 I ESETSmartInstaller@High as downloader log: all ok esets_scanner_update returned -1 esets_gle=12 ESETSmartInstaller@High as downloader log: all ok esets_scanner_update returned -1 esets_gle=12 ESETSmartInstaller@High as downloader log: all ok esets_scanner_update returned -1 esets_gle=12 esets_scanner_update returned -1 esets_gle=12 # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-08-18 09:06:47 # local_time=2011-08-18 11:06:47 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 8626 50192679 38647 0 # compatibility_mode=5893 16776573 100 94 89624 65287049 0 0 # compatibility_mode=8192 67108863 100 0 6698988 6698988 0 0 # scanned=106550 # found=0 # cleaned=0 # scan_time=2569 ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-08-31 10:57:46 # local_time=2011-08-31 12:57:46 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 5669 51322609 5091 0 # compatibility_mode=5893 16776573 100 94 12227 66416979 0 0 # compatibility_mode=8192 67108863 100 0 7828918 7828918 0 0 # scanned=111663 # found=1 # cleaned=0 # scan_time=2499 C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe a variant of Win32/InstallCore.B application (unable to clean) 00000000000000000000000000000000 I ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=stopped # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-01 11:52:54 # local_time=2011-09-01 01:52:54 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 95835 51412775 0 0 # compatibility_mode=5893 16776573 100 94 102393 66507145 0 0 # compatibility_mode=8192 67108863 100 0 7919084 7919084 0 0 # scanned=100092 # found=1 # cleaned=1 # scan_time=2020 C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe a variant of Win32/InstallCore.C application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-02 12:12:52 # local_time=2011-09-02 02:12:52 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 10749 51499452 3543 0 # compatibility_mode=5893 16776573 100 94 10639 66593822 0 0 # compatibility_mode=8192 67108863 100 0 8005761 8005761 0 0 # scanned=143485 # found=0 # cleaned=0 # scan_time=2962 ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=stopped # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-18 04:00:27 # local_time=2011-09-18 06:00:27 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 22318 52898442 68768 0 # compatibility_mode=5893 16776573 100 94 75768 67992812 0 0 # compatibility_mode=8192 67108863 100 0 9404751 9404751 0 0 # scanned=275 # found=0 # cleaned=0 # scan_time=6 ESETSmartInstaller@High as downloader log: all ok esets_scanner_update returned -1 esets_gle=53251 # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-18 04:56:35 # local_time=2011-09-18 06:56:35 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1797 16775165 100 94 22393 52898517 68843 0 # compatibility_mode=5893 16776573 100 94 75843 67992887 0 0 # compatibility_mode=8192 67108863 100 0 9404826 9404826 0 0 # scanned=142259 # found=0 # cleaned=0 # scan_time=3299 ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-10-19 03:24:12 # local_time=2011-10-19 05:24:12 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1792 16777215 100 0 429339 429339 0 0 # compatibility_mode=5893 16776573 100 94 2811 70666322 0 0 # compatibility_mode=8192 67108863 100 0 12078261 12078261 0 0 # scanned=119709 # found=2 # cleaned=0 # scan_time=2742 C:\Users\standard\AppData\Local\temp\ICReinstall\cnet_V-REP EVALUATION V2_5_9 Setup_exe.exe a variant of Win32/InstallCore.D application (unable to clean) 00000000000000000000000000000000 I C:\Users\standard\Desktop\cnet_V-REP EVALUATION V2_5_9 Setup_exe.exe a variant of Win32/InstallCore.D application (unable to clean) 00000000000000000000000000000000 I ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-10-22 07:31:58 # local_time=2011-10-22 09:31:58 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1792 16777215 100 0 702877 702877 0 0 # compatibility_mode=5893 16776573 100 94 534 70939860 0 0 # compatibility_mode=8192 67108863 100 0 12351799 12351799 0 0 # scanned=135072 # found=1 # cleaned=0 # scan_time=3249 C:\Users\standard\Desktop\cnet_V-REP EVALUATION V2_5_9 Setup_exe.exe a variant of Win32/InstallCore.D application (unable to clean) 00000000000000000000000000000000 I |
|
23.10.2011, 18:16
| #25 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit verschiedenen FundenZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.10.2011, 18:20
| #26 |
| | Probleme mit verschiedenen Funden hi, sorry dass ich jezt erst schreibe. ja das ist eine simulationssoftware für roboter. der andere fund von super, war eine simulationssoftware für sps. grüße |
|
24.10.2011, 18:36
| #27 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit verschiedenen Funden Dann ist es ok. Sonst nur Cookies. Rechner wieder im Lot?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.10.2011, 18:48
| #28 |
| | Probleme mit verschiedenen Funden Eigentlich hatte ich gehofft dass du mir das sagst  Ja also Probleme habe ich keine, und malewarebyte etc. Hat auch nicht gemeckert. Denke es passt alles. Vielen vielen dank schonmal . . |
|
24.10.2011, 18:54
| #29 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit verschiedenen Funden Das ist nur die abschließende Frage wenn ich fertig bin, ich will ja wissen ob das System aus deiner Sicht wieder rund und problemlos läuft Dann wären wir durch!  Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken. Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden. Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern. Microsoftupdate Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Anleitung Windows-Update PDF-Reader aktualisieren Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast) Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink: Mozilla und andere Browser => http://filepony.de/?q=Flash+Player Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind. Java-Update Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
25.10.2011, 19:12
| #30 |
| | Probleme mit verschiedenen Funden Vielen Vielen dank hast mir wirklich sehr geholfen... ihr habt wirklich eine top seite mit kompetenten "Helfern" auf die beine gestellt, wirklich top!!! wünsche noch einen schönen abend. eine frage hätte ich noch: Konnte man euch nicht auch per paypal eine spende zukommen lassen oder erinnere ich mich falsch? mfg |
|
| Themen zu Probleme mit verschiedenen Funden |
| .dll, avg, avira, converter, desktop, downloader, escan, fehler, firefox, google, icreinstall, microsoft, modul, mozilla, nicht gefunden, nt.dll, object, preferences, problem, programm, prozesse, pup.fctplugin, registry, sched.exe, services.exe, software, svchost.exe, taskhost.exe, trojan, verweise, video converter, virus gefunden, win32/installcore.b, win32/installcore.c, win32/installcore.d, windows, windows.old, winlogon.exe, wmp |
Linear-Darstellung
