Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Polizei-Trojaner (Schweiz) - ist er schon weg?

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 28.11.2012, 17:58   #1
drud
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



Guten Abend zusammen

Wir haben am Montag, also vor zwei Tagen (26.11.12), den Polizei-Trojaner aufgelesen, der hat sogar ein Foto mit der Webcam gemacht!

Da der Laptop sozusagen gesperrt war, haben wir folgendes gemacht:

Akku rausgenommen
Akku wieder eingefügt
gestartet und sofort vom Interrnet getrennt
Mein Mann hat Avira Antivir laufen lassen
Ich habs abgebrochen und eine Systemwiederherstellung auf letzten Samstag gemacht (über Windows, nicht Dos/Bios).
Ich habe im Internet (anderer Laptop, von dem aus ich jetzt auch schreibe) von Malewarebytes gelesen. Dazu erhielten wir von einem Bekannten den Tipp von Spybot.
Spybot und Malewarebytes runtergeladen auf 2.Laptop und auf CD gebrannt.
Auf infisziertem Laptop Malewarebytes laufen lassen. Die Funde waren in Quarantäne. Ich weiss nicht mehr, ob ich die dann selbst gelöscht habe oder ob das dann eines der Programme gemacht hat. Jedenfalls ist in der Quarantäne nichts mehr. Es waren 4 Einträge, wenn ich mich recht erinnere. Die Logfiles sollten vorhanden sein.
Dann frisch gestartet und nochmal Malewarebytes rübergelassen.
Spybot laufen lassen. Weiss nicht mehr, ob der auch noch was gefunden hat oder nicht. Da haben wir dann zumindest alles Immunisiert.
Avira laufen lassen. Keine Funde mehr.

Also Avira und Malewarebytes finden nichts mehr. Spybot hat noch einiges in Quarantäne, wo ich nciht weiss, was das ist, das letzte Log-Protokoll zeigt auch noch Funde. Rootskitboot abgebrochen, da ich unsicher wurde. Mit Spybot alles immunisiert.

Mit CCCleaner gereinigt.

SuperAntiSpyware runtergeladen. Der findet viel, wobei ich dort vermute, dass das Sache sind, die Windows verwendet. Habs zur Sicherheit abgebrochen, weil ich nicht wusste, was am Ende des Scans damit passiert.

Alles jeweils mit rechter Maustaste als Administrator ausgeführt. Programme vor jedem Nutzen aktualisiert.

Ich versuche nun mal die LogFiles von Malewarebytes und Spybot hier zu posten. Muss ich hier irgendwo noch meinen Namen entfernen oder spielt das keine Rolle?

Den Defogger habe ich runtergeladen, mit der rechten Maustaste Administrator gestartet, alles nach Anweisung befolgt, aber nach Finished kommt wieder der "Startbildschirm".

Die OTL-Logfiles sind im Anhang.

Es geht mir darum zu erfahren,
- ob mein Laptop wieder clean ist,
- wieder für Ebanking verwendet werden kann,
- ich meine Daten (C und D Laufwerk) noch sichern kann, ohne den Trojaner mitzuschleppen (Externe HD, letzte Sicherung:8.7.2012).

Bis jetzt habe ich jeweilen die Internetverbindung nach dem Aktualisieren der jeweiligen Programme wieder getrennt. Diesen Beitrag hier habe ich über Internet fertiggestellt, da ich die Logfiles raufladen musste. Ansonsten habe ich einzig ein Word-Dokument geöffnet seit dem Trojaner. Alles andere (ausser all die Virensoftwares und TuneUp Utilities) habe ich unberührt gelassen. Keine Fotos, rein gar nichts geöffnet.

Vielen Dank für Eure Hilfe!!

Gruss
drud

PS: Logfiles folgen - jetzt vom betroffenen Laptop aus

die ältesten sind jeweils zuoberst die neusten zuunterst.
zuerst die von spybot, weiter unten die von malewarebytes.


27.11.2012 07:38:30
Scan took 00:17:10.
231 items found.


Code:
ATTFilter
Search results from Spybot - Search & Destroy

27.11.2012 07:38:30
Scan took 00:17:10.
231 items found.

Widgi.Toolbar: [SBI $9A5B542E] Search hook (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\{B922D405-6D13-4A2B-AE89-08A030DA4402}

Widgi.Toolbar: [SBI $66BF948F] IE toolbar (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{B922D405-6D13-4A2B-AE89-08A030DA4402}

Widgi.Toolbar: [SBI $16C3A07B] Settings (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\Common Files\Spigot\

Widgi.Toolbar: [SBI $000389AB] Settings (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\Common Files\Spigot\Search Settings\

Widgi.Toolbar: [SBI $9061208C] Settings (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\

Widgi.Toolbar: [SBI $1E14509F] Settings (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\Common Files\Spigot\Search Settings\Res\

Widgi.Toolbar: [SBI $E1F050EF] Settings (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\pdfforge Toolbar\

Widgi.Toolbar: [SBI $03E18DB3] Settings (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\pdfforge Toolbar\IE\

Widgi.Toolbar: [SBI $60A6F1DA] Settings (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\pdfforge Toolbar\Res\

Widgi.Toolbar: [SBI $401695AC] Settings (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\

Widgi.Toolbar: [SBI $65C7C8B1] Shared DLL (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe

Widgi.Toolbar: [SBI $65C7C8B1]  System file (File, nothing done)
  C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
  Properties.size=748440
  Properties.md5=54951548980ECD07B80EAD3C7921F8A1
  Properties.filedate=1330897210
  Properties.filedatetext=2012-03-04 22:40:10

Widgi.Toolbar: [SBI $5AE37010] Shared DLL (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe

Widgi.Toolbar: [SBI $5AE37010]  System file (File, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
  Properties.size=934752
  Properties.md5=E802E0A0874A5B15F2345AB2868214C2
  Properties.filedate=1330897720
  Properties.filedatetext=2012-03-04 22:48:40

Widgi.Toolbar: [SBI $0B12F9B5] Program directory (Directory, nothing done)
  C:\Program Files (x86)\Application Updater\
  Directory.subfile=C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
  Directory.subfile.size=748440
  Directory.subfile.md5=54951548980ECD07B80EAD3C7921F8A1
  Directory.subfile.filedate=1330897210
  Directory.subfile.filedatetext=2012-03-04 22:40:10
  Directory.subfile=C:\Program Files (x86)\Application Updater\config.ini
  Directory.subfile.size=85
  Directory.subfile.md5=9E44EB00BBA056FA9B8440EF1D6C356E
  Directory.subfile.filedate=1331487662
  Directory.subfile.filedatetext=2012-03-11 18:41:01

Widgi.Toolbar: [SBI $B5E507B2]  Text file (File, nothing done)
  C:\Program Files (x86)\Application Updater\config.ini
  Properties.size=85
  Properties.md5=9E44EB00BBA056FA9B8440EF1D6C356E
  Properties.filedate=1331487662
  Properties.filedatetext=2012-03-11 18:41:01

Widgi.Toolbar: [SBI $05E59E37] Program directory (Directory, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\baidu_ff.xml
  Directory.subfile.size=3958
  Directory.subfile.md5=DA0EC54C773C9ABF2378361584814AA8
  Directory.subfile.filedate=1317052132
  Directory.subfile.filedatetext=2011-09-26 16:48:52
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\baidu_ie.xml
  Directory.subfile.size=416
  Directory.subfile.md5=A156DEAAAAE97C4C17CA47482F90B643
  Directory.subfile.filedate=1316772930
  Directory.subfile.filedatetext=2011-09-23 11:15:30
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\config.ini
  Directory.subfile.size=45
  Directory.subfile.md5=DD9603D0052E892266D2C9AE59062A4B
  Directory.subfile.filedate=1331487662
  Directory.subfile.filedatetext=2012-03-11 18:41:01
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
  Directory.subfile.size=934752
  Directory.subfile.md5=E802E0A0874A5B15F2345AB2868214C2
  Directory.subfile.filedate=1330897720
  Directory.subfile.filedatetext=2012-03-04 22:48:40
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\wth.dll
  Directory.subfile.size=23904
  Directory.subfile.md5=D29095C49020F5B3BC367ECF3EEFB0A2
  Directory.subfile.filedate=1330897720
  Directory.subfile.filedatetext=2012-03-04 22:48:40
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\yahoo_ff.xml
  Directory.subfile.size=888
  Directory.subfile.md5=38627C6A272265AD52BD17916F86C353
  Directory.subfile.filedate=1331487662
  Directory.subfile.filedatetext=2012-03-11 18:41:02
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\yahoo_ie.xml
  Directory.subfile.size=470
  Directory.subfile.md5=2B3D3891489B2BFB7AD7F16AFC619F5E
  Directory.subfile.filedate=1331487662
  Directory.subfile.filedatetext=2012-03-11 18:41:01
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandex_ff.xml
  Directory.subfile.size=1837
  Directory.subfile.md5=642203F0A4AEBE9DECD211815B3E57BE
  Directory.subfile.filedate=1317062418
  Directory.subfile.filedatetext=2011-09-26 19:40:18
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandex_ie.xml
  Directory.subfile.size=494
  Directory.subfile.md5=C97A767A76B54855AF46D5B39D5D194B
  Directory.subfile.filedate=1316772930
  Directory.subfile.filedatetext=2011-09-23 11:15:30
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1031.ini
  Directory.subfile.size=749
  Directory.subfile.md5=F9FBD8C34C5629A40F2F43147E3F371C
  Directory.subfile.filedate=1312551806
  Directory.subfile.filedatetext=2011-08-05 14:43:26
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1033.ini
  Directory.subfile.size=640
  Directory.subfile.md5=5B5B79EACD2F49A2E0551D5F82737D20
  Directory.subfile.filedate=1312288124
  Directory.subfile.filedatetext=2011-08-02 13:28:44
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1034.ini
  Directory.subfile.size=806
  Directory.subfile.md5=BDCB2F9993EFA762691EF9890CBE40B7
  Directory.subfile.filedate=1313052926
  Directory.subfile.filedatetext=2011-08-11 09:55:26
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1036.ini
  Directory.subfile.size=760
  Directory.subfile.md5=E07C6E0CFFA219B35B40581E6355D08E
  Directory.subfile.filedate=1312803474
  Directory.subfile.filedatetext=2011-08-08 12:37:54
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1040.ini
  Directory.subfile.size=821
  Directory.subfile.md5=ACDB0F137531CE36DAE57436C8ACAF67
  Directory.subfile.filedate=1313059512
  Directory.subfile.filedatetext=2011-08-11 11:45:12

Widgi.Toolbar: [SBI $9DDBABD2] Program directory (Directory, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\baidu_ff.xml
  Directory.subfile.size=3958
  Directory.subfile.md5=DA0EC54C773C9ABF2378361584814AA8
  Directory.subfile.filedate=1317052132
  Directory.subfile.filedatetext=2011-09-26 16:48:52
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\baidu_ie.xml
  Directory.subfile.size=416
  Directory.subfile.md5=A156DEAAAAE97C4C17CA47482F90B643
  Directory.subfile.filedate=1316772930
  Directory.subfile.filedatetext=2011-09-23 11:15:30
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\config.ini
  Directory.subfile.size=45
  Directory.subfile.md5=DD9603D0052E892266D2C9AE59062A4B
  Directory.subfile.filedate=1331487662
  Directory.subfile.filedatetext=2012-03-11 18:41:01
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
  Directory.subfile.size=934752
  Directory.subfile.md5=E802E0A0874A5B15F2345AB2868214C2
  Directory.subfile.filedate=1330897720
  Directory.subfile.filedatetext=2012-03-04 22:48:40
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\wth.dll
  Directory.subfile.size=23904
  Directory.subfile.md5=D29095C49020F5B3BC367ECF3EEFB0A2
  Directory.subfile.filedate=1330897720
  Directory.subfile.filedatetext=2012-03-04 22:48:40
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\yahoo_ff.xml
  Directory.subfile.size=888
  Directory.subfile.md5=38627C6A272265AD52BD17916F86C353
  Directory.subfile.filedate=1331487662
  Directory.subfile.filedatetext=2012-03-11 18:41:02
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\yahoo_ie.xml
  Directory.subfile.size=470
  Directory.subfile.md5=2B3D3891489B2BFB7AD7F16AFC619F5E
  Directory.subfile.filedate=1331487662
  Directory.subfile.filedatetext=2012-03-11 18:41:01
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandex_ff.xml
  Directory.subfile.size=1837
  Directory.subfile.md5=642203F0A4AEBE9DECD211815B3E57BE
  Directory.subfile.filedate=1317062418
  Directory.subfile.filedatetext=2011-09-26 19:40:18
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandex_ie.xml
  Directory.subfile.size=494
  Directory.subfile.md5=C97A767A76B54855AF46D5B39D5D194B
  Directory.subfile.filedate=1316772930
  Directory.subfile.filedatetext=2011-09-23 11:15:30
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1031.ini
  Directory.subfile.size=749
  Directory.subfile.md5=F9FBD8C34C5629A40F2F43147E3F371C
  Directory.subfile.filedate=1312551806
  Directory.subfile.filedatetext=2011-08-05 14:43:26
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1033.ini
  Directory.subfile.size=640
  Directory.subfile.md5=5B5B79EACD2F49A2E0551D5F82737D20
  Directory.subfile.filedate=1312288124
  Directory.subfile.filedatetext=2011-08-02 13:28:44
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1034.ini
  Directory.subfile.size=806
  Directory.subfile.md5=BDCB2F9993EFA762691EF9890CBE40B7
  Directory.subfile.filedate=1313052926
  Directory.subfile.filedatetext=2011-08-11 09:55:26
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1036.ini
  Directory.subfile.size=760
  Directory.subfile.md5=E07C6E0CFFA219B35B40581E6355D08E
  Directory.subfile.filedate=1312803474
  Directory.subfile.filedatetext=2011-08-08 12:37:54
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1040.ini
  Directory.subfile.size=821
  Directory.subfile.md5=ACDB0F137531CE36DAE57436C8ACAF67
  Directory.subfile.filedate=1313059512
  Directory.subfile.filedatetext=2011-08-11 11:45:12

Widgi.Toolbar: [SBI $F5D85413]  Data (File, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\baidu_ff.xml
  Properties.size=3958
  Properties.md5=DA0EC54C773C9ABF2378361584814AA8
  Properties.filedate=1317052132
  Properties.filedatetext=2011-09-26 16:48:52

Widgi.Toolbar: [SBI $DFDB8C47]  Data (File, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\baidu_ie.xml
  Properties.size=416
  Properties.md5=A156DEAAAAE97C4C17CA47482F90B643
  Properties.filedate=1316772930
  Properties.filedatetext=2011-09-23 11:15:30

Widgi.Toolbar: [SBI $10B6A612]  Data (File, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\config.ini
  Properties.size=45
  Properties.md5=DD9603D0052E892266D2C9AE59062A4B
  Properties.filedate=1331487662
  Properties.filedatetext=2012-03-11 18:41:01

Widgi.Toolbar: [SBI $4779936B]  Data (File, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandex_ff.xml
  Properties.size=1837
  Properties.md5=642203F0A4AEBE9DECD211815B3E57BE
  Properties.filedate=1317062418
  Properties.filedatetext=2011-09-26 19:40:18

Widgi.Toolbar: [SBI $30F0224A]  Data (File, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandex_ie.xml
  Properties.size=494
  Properties.md5=C97A767A76B54855AF46D5B39D5D194B
  Properties.filedate=1316772930
  Properties.filedatetext=2011-09-23 11:15:30

Widgi.Toolbar: [SBI $786A7897] Program directory (Directory, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1031.ini
  Directory.subfile.size=749
  Directory.subfile.md5=F9FBD8C34C5629A40F2F43147E3F371C
  Directory.subfile.filedate=1312551806
  Directory.subfile.filedatetext=2011-08-05 14:43:26
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1033.ini
  Directory.subfile.size=640
  Directory.subfile.md5=5B5B79EACD2F49A2E0551D5F82737D20
  Directory.subfile.filedate=1312288124
  Directory.subfile.filedatetext=2011-08-02 13:28:44
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1034.ini
  Directory.subfile.size=806
  Directory.subfile.md5=BDCB2F9993EFA762691EF9890CBE40B7
  Directory.subfile.filedate=1313052926
  Directory.subfile.filedatetext=2011-08-11 09:55:26
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1036.ini
  Directory.subfile.size=760
  Directory.subfile.md5=E07C6E0CFFA219B35B40581E6355D08E
  Directory.subfile.filedate=1312803474
  Directory.subfile.filedatetext=2011-08-08 12:37:54
  Directory.subfile=C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1040.ini
  Directory.subfile.size=821
  Directory.subfile.md5=ACDB0F137531CE36DAE57436C8ACAF67
  Directory.subfile.filedate=1313059512
  Directory.subfile.filedatetext=2011-08-11 11:45:12

Widgi.Toolbar: [SBI $094059AF]  Text file (File, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1031.ini
  Properties.size=749
  Properties.md5=F9FBD8C34C5629A40F2F43147E3F371C
  Properties.filedate=1312551806
  Properties.filedatetext=2011-08-05 14:43:26

Widgi.Toolbar: [SBI $094059AF]  Text file (File, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1033.ini
  Properties.size=640
  Properties.md5=5B5B79EACD2F49A2E0551D5F82737D20
  Properties.filedate=1312288124
  Properties.filedatetext=2011-08-02 13:28:44

Widgi.Toolbar: [SBI $094059AF]  Text file (File, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1034.ini
  Properties.size=806
  Properties.md5=BDCB2F9993EFA762691EF9890CBE40B7
  Properties.filedate=1313052926
  Properties.filedatetext=2011-08-11 09:55:26

Widgi.Toolbar: [SBI $094059AF]  Text file (File, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1036.ini
  Properties.size=760
  Properties.md5=E07C6E0CFFA219B35B40581E6355D08E
  Properties.filedate=1312803474
  Properties.filedatetext=2011-08-08 12:37:54

Widgi.Toolbar: [SBI $094059AF]  Text file (File, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1040.ini
  Properties.size=821
  Properties.md5=ACDB0F137531CE36DAE57436C8ACAF67
  Properties.filedate=1313059512
  Properties.filedatetext=2011-08-11 11:45:12

Widgi.Toolbar: [SBI $2CCE143F] Program directory (Directory, nothing done)
  C:\Program Files (x86)\Common Files\Spigot\Search Settings\Res\

Widgi.Toolbar: [SBI $E91FEAE1] Program directory (Directory, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\WidgiHelper.exe
  Directory.subfile.size=68960
  Directory.subfile.md5=7124474DBC6B1C24EDEFF39702CADE1E
  Directory.subfile.filedate=1330897704
  Directory.subfile.filedatetext=2012-03-04 22:48:24
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\amazon.gif
  Directory.subfile.size=976
  Directory.subfile.md5=2113CCD1843F1BEFF79E9E5013CB1F45
  Directory.subfile.filedate=1255710578
  Directory.subfile.filedatetext=2009-10-16 17:29:38
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\dropinsavings.gif
  Directory.subfile.size=2028
  Directory.subfile.md5=B5944EDC7AADF4E530F722C37DF06C84
  Directory.subfile.filedate=1323966630
  Directory.subfile.filedatetext=2011-12-15 17:30:30
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\dropinsavingsabt.gif
  Directory.subfile.size=1942
  Directory.subfile.md5=B1F8051EF9F443509F502A18EECCA50F
  Directory.subfile.filedate=1323966630
  Directory.subfile.filedatetext=2011-12-15 17:30:30
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\ebay.gif
  Directory.subfile.size=920
  Directory.subfile.md5=6184113E3CEA69ED84DEBF9EBC15614D
  Directory.subfile.filedate=1255710578
  Directory.subfile.filedatetext=2009-10-16 17:29:38
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\facebook.gif
  Directory.subfile.size=100
  Directory.subfile.md5=DD0ECEF270DAC9869AD987B3723F4121
  Directory.subfile.filedate=1314700600
  Directory.subfile.filedatetext=2011-08-30 11:36:40
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\googleplus.gif
  Directory.subfile.size=1085
  Directory.subfile.md5=E2B5633817B345E692FC93BFF30DA182
  Directory.subfile.filedate=1314702622
  Directory.subfile.filedatetext=2011-08-30 12:10:22
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\icon_settings.gif
  Directory.subfile.size=941
  Directory.subfile.md5=934612DB06B052027E26EA362B5FC57B
  Directory.subfile.filedate=1244657714
  Directory.subfile.filedatetext=2009-06-10 19:15:14
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_branding.gif
  Directory.subfile.size=1365
  Directory.subfile.md5=651B9292689487D15DF55F6AD14A2057
  Directory.subfile.filedate=1244631590
  Directory.subfile.filedatetext=2009-06-10 11:59:50
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_branding_hover.gif
  Directory.subfile.size=1462
  Directory.subfile.md5=312F2B09641BA1003A9F1EE14EE79F6A
  Directory.subfile.filedate=1244631590
  Directory.subfile.filedatetext=2009-06-10 11:59:50
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_icon.gif
  Directory.subfile.size=1027
  Directory.subfile.md5=299A1911C0C28C39556F9C7D1B219A7D
  Directory.subfile.filedate=1245932496
  Directory.subfile.filedatetext=2009-06-25 13:21:36
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_portal_logo.gif
  Directory.subfile.size=2695
  Directory.subfile.md5=7FA0C2F788B637949004F892263BDDFE
  Directory.subfile.filedate=1244631590
  Directory.subfile.filedatetext=2009-06-10 11:59:50
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\radio-close.gif
  Directory.subfile.size=258
  Directory.subfile.md5=357D79F5850F56AC238F7BFE0C31985C
  Directory.subfile.filedate=1319726524
  Directory.subfile.filedatetext=2011-10-27 15:42:04
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\radio-minimize.gif
  Directory.subfile.size=237
  Directory.subfile.md5=B513CFE9AD370B8D2A8E8C19E8E8CD51
  Directory.subfile.filedate=1319726524
  Directory.subfile.filedatetext=2011-10-27 15:42:04
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\radiobeta.gif
  Directory.subfile.size=1027
  Directory.subfile.md5=98FF4DAEBF15E97C1DCFA31F2325AC59
  Directory.subfile.filedate=1314968980
  Directory.subfile.filedatetext=2011-09-02 14:09:40
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search-button-hover.gif
  Directory.subfile.size=1029
  Directory.subfile.md5=4922C75F4D9975F847E2CAE95D69BC09
  Directory.subfile.filedate=1230632556
  Directory.subfile.filedatetext=2008-12-30 11:22:36
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search-button.gif
  Directory.subfile.size=1037
  Directory.subfile.md5=4950662A97FB05D1C5DCE6A2192ADB8E
  Directory.subfile.filedate=1230632556
  Directory.subfile.filedatetext=2008-12-30 11:22:36
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search-chevron-hover.gif
  Directory.subfile.size=948
  Directory.subfile.md5=03D6C15A2D04370DB72FC1D43F92B3E6
  Directory.subfile.filedate=1230632556
  Directory.subfile.filedatetext=2008-12-30 11:22:36
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search-chevron.gif
  Directory.subfile.size=846
  Directory.subfile.md5=4FE6D25A5D981847730E75DA391B66DC
  Directory.subfile.filedate=1230632556
  Directory.subfile.filedatetext=2008-12-30 11:22:36
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search_amazon.gif
  Directory.subfile.size=1004
  Directory.subfile.md5=2329A190840620B30D80C7E8F4B4C51C
  Directory.subfile.filedate=1244657714
  Directory.subfile.filedatetext=2009-06-10 19:15:14
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search_baidu.gif
  Directory.subfile.size=614
  Directory.subfile.md5=35413285571F6052D773CFE59C1DF7E9
  Directory.subfile.filedate=1314784926
  Directory.subfile.filedatetext=2011-08-31 11:02:06
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search_ebay.gif
  Directory.subfile.size=929
  Directory.subfile.md5=69286ABD58F84241A321A06D14A3B1BE
  Directory.subfile.filedate=1244657714
  Directory.subfile.filedatetext=2009-06-10 19:15:14
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search_yahoo.gif
  Directory.subfile.size=941
  Directory.subfile.md5=7C8E1580C8FFDD48909C6BE4FAABE2DA
  Directory.subfile.filedate=1254226904
  Directory.subfile.filedatetext=2009-09-29 13:21:44
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search_yandex.gif
  Directory.subfile.size=327
  Directory.subfile.md5=615699B55309FC7B68FA25F4E679B9D5
  Directory.subfile.filedate=1314784926
  Directory.subfile.filedatetext=2011-08-31 11:02:06
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\twitter.gif
  Directory.subfile.size=166
  Directory.subfile.md5=A36DB71BE1818EAF5F36DE957D2B210C
  Directory.subfile.filedate=1314702622
  Directory.subfile.filedatetext=2011-08-30 12:10:22
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\widgets.xml
  Directory.subfile.size=7714
  Directory.subfile.md5=2D70005D95DD6691B8B2BCAE348D71E2
  Directory.subfile.filedate=1323966630
  Directory.subfile.filedatetext=2011-12-15 17:30:30
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\IE\5.1\config.ini
  Directory.subfile.size=38
  Directory.subfile.md5=7FE90FDE22A0C8382D34CC593260BD64
  Directory.subfile.filedate=1331487662
  Directory.subfile.filedatetext=2012-03-11 18:41:01
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll
  Directory.subfile.size=1077600
  Directory.subfile.md5=14EC3987D53DD03AD04661CAD101B533
  Directory.subfile.filedate=1330897716
  Directory.subfile.filedatetext=2012-03-04 22:48:36
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1031.ini
  Directory.subfile.size=3851
  Directory.subfile.md5=98DF25C648931EBD2983CB3AEDA36F1E
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1033.ini
  Directory.subfile.size=3556
  Directory.subfile.md5=CBB6D789310894546B0C575C6AE6E791
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1034.ini
  Directory.subfile.size=4082
  Directory.subfile.md5=6A7FA0954048198B8E0B8B28B1B73BD4
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1036.ini
  Directory.subfile.size=4039
  Directory.subfile.md5=783F291AA17730B0D6A218695934ECAC
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1040.ini
  Directory.subfile.size=3977
  Directory.subfile.md5=0860D82A7C4A8E464C28A347C0B183C4
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58

Widgi.Toolbar: [SBI $D23DEEBB] Program directory (Directory, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\IE\
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\IE\5.1\config.ini
  Directory.subfile.size=38
  Directory.subfile.md5=7FE90FDE22A0C8382D34CC593260BD64
  Directory.subfile.filedate=1331487662
  Directory.subfile.filedatetext=2012-03-11 18:41:01
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll
  Directory.subfile.size=1077600
  Directory.subfile.md5=14EC3987D53DD03AD04661CAD101B533
  Directory.subfile.filedate=1330897716
  Directory.subfile.filedatetext=2012-03-04 22:48:36

Widgi.Toolbar: [SBI $47F603E8] Program directory (Directory, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\amazon.gif
  Directory.subfile.size=976
  Directory.subfile.md5=2113CCD1843F1BEFF79E9E5013CB1F45
  Directory.subfile.filedate=1255710578
  Directory.subfile.filedatetext=2009-10-16 17:29:38
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\dropinsavings.gif
  Directory.subfile.size=2028
  Directory.subfile.md5=B5944EDC7AADF4E530F722C37DF06C84
  Directory.subfile.filedate=1323966630
  Directory.subfile.filedatetext=2011-12-15 17:30:30
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\dropinsavingsabt.gif
  Directory.subfile.size=1942
  Directory.subfile.md5=B1F8051EF9F443509F502A18EECCA50F
  Directory.subfile.filedate=1323966630
  Directory.subfile.filedatetext=2011-12-15 17:30:30
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\ebay.gif
  Directory.subfile.size=920
  Directory.subfile.md5=6184113E3CEA69ED84DEBF9EBC15614D
  Directory.subfile.filedate=1255710578
  Directory.subfile.filedatetext=2009-10-16 17:29:38
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\facebook.gif
  Directory.subfile.size=100
  Directory.subfile.md5=DD0ECEF270DAC9869AD987B3723F4121
  Directory.subfile.filedate=1314700600
  Directory.subfile.filedatetext=2011-08-30 11:36:40
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\googleplus.gif
  Directory.subfile.size=1085
  Directory.subfile.md5=E2B5633817B345E692FC93BFF30DA182
  Directory.subfile.filedate=1314702622
  Directory.subfile.filedatetext=2011-08-30 12:10:22
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\icon_settings.gif
  Directory.subfile.size=941
  Directory.subfile.md5=934612DB06B052027E26EA362B5FC57B
  Directory.subfile.filedate=1244657714
  Directory.subfile.filedatetext=2009-06-10 19:15:14
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_branding.gif
  Directory.subfile.size=1365
  Directory.subfile.md5=651B9292689487D15DF55F6AD14A2057
  Directory.subfile.filedate=1244631590
  Directory.subfile.filedatetext=2009-06-10 11:59:50
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_branding_hover.gif
  Directory.subfile.size=1462
  Directory.subfile.md5=312F2B09641BA1003A9F1EE14EE79F6A
  Directory.subfile.filedate=1244631590
  Directory.subfile.filedatetext=2009-06-10 11:59:50
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_icon.gif
  Directory.subfile.size=1027
  Directory.subfile.md5=299A1911C0C28C39556F9C7D1B219A7D
  Directory.subfile.filedate=1245932496
  Directory.subfile.filedatetext=2009-06-25 13:21:36
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_portal_logo.gif
  Directory.subfile.size=2695
  Directory.subfile.md5=7FA0C2F788B637949004F892263BDDFE
  Directory.subfile.filedate=1244631590
  Directory.subfile.filedatetext=2009-06-10 11:59:50
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\radio-close.gif
  Directory.subfile.size=258
  Directory.subfile.md5=357D79F5850F56AC238F7BFE0C31985C
  Directory.subfile.filedate=1319726524
  Directory.subfile.filedatetext=2011-10-27 15:42:04
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\radio-minimize.gif
  Directory.subfile.size=237
  Directory.subfile.md5=B513CFE9AD370B8D2A8E8C19E8E8CD51
  Directory.subfile.filedate=1319726524
  Directory.subfile.filedatetext=2011-10-27 15:42:04
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\radiobeta.gif
  Directory.subfile.size=1027
  Directory.subfile.md5=98FF4DAEBF15E97C1DCFA31F2325AC59
  Directory.subfile.filedate=1314968980
  Directory.subfile.filedatetext=2011-09-02 14:09:40
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search-button-hover.gif
  Directory.subfile.size=1029
  Directory.subfile.md5=4922C75F4D9975F847E2CAE95D69BC09
  Directory.subfile.filedate=1230632556
  Directory.subfile.filedatetext=2008-12-30 11:22:36
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search-button.gif
  Directory.subfile.size=1037
  Directory.subfile.md5=4950662A97FB05D1C5DCE6A2192ADB8E
  Directory.subfile.filedate=1230632556
  Directory.subfile.filedatetext=2008-12-30 11:22:36
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search-chevron-hover.gif
  Directory.subfile.size=948
  Directory.subfile.md5=03D6C15A2D04370DB72FC1D43F92B3E6
  Directory.subfile.filedate=1230632556
  Directory.subfile.filedatetext=2008-12-30 11:22:36
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search-chevron.gif
  Directory.subfile.size=846
  Directory.subfile.md5=4FE6D25A5D981847730E75DA391B66DC
  Directory.subfile.filedate=1230632556
  Directory.subfile.filedatetext=2008-12-30 11:22:36
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search_amazon.gif
  Directory.subfile.size=1004
  Directory.subfile.md5=2329A190840620B30D80C7E8F4B4C51C
  Directory.subfile.filedate=1244657714
  Directory.subfile.filedatetext=2009-06-10 19:15:14
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search_baidu.gif
  Directory.subfile.size=614
  Directory.subfile.md5=35413285571F6052D773CFE59C1DF7E9
  Directory.subfile.filedate=1314784926
  Directory.subfile.filedatetext=2011-08-31 11:02:06
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search_ebay.gif
  Directory.subfile.size=929
  Directory.subfile.md5=69286ABD58F84241A321A06D14A3B1BE
  Directory.subfile.filedate=1244657714
  Directory.subfile.filedatetext=2009-06-10 19:15:14
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search_yahoo.gif
  Directory.subfile.size=941
  Directory.subfile.md5=7C8E1580C8FFDD48909C6BE4FAABE2DA
  Directory.subfile.filedate=1254226904
  Directory.subfile.filedatetext=2009-09-29 13:21:44
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\search_yandex.gif
  Directory.subfile.size=327
  Directory.subfile.md5=615699B55309FC7B68FA25F4E679B9D5
  Directory.subfile.filedate=1314784926
  Directory.subfile.filedatetext=2011-08-31 11:02:06
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\twitter.gif
  Directory.subfile.size=166
  Directory.subfile.md5=A36DB71BE1818EAF5F36DE957D2B210C
  Directory.subfile.filedate=1314702622
  Directory.subfile.filedatetext=2011-08-30 12:10:22
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\widgets.xml
  Directory.subfile.size=7714
  Directory.subfile.md5=2D70005D95DD6691B8B2BCAE348D71E2
  Directory.subfile.filedate=1323966630
  Directory.subfile.filedatetext=2011-12-15 17:30:30
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1031.ini
  Directory.subfile.size=3851
  Directory.subfile.md5=98DF25C648931EBD2983CB3AEDA36F1E
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1033.ini
  Directory.subfile.size=3556
  Directory.subfile.md5=CBB6D789310894546B0C575C6AE6E791
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1034.ini
  Directory.subfile.size=4082
  Directory.subfile.md5=6A7FA0954048198B8E0B8B28B1B73BD4
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1036.ini
  Directory.subfile.size=4039
  Directory.subfile.md5=783F291AA17730B0D6A218695934ECAC
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1040.ini
  Directory.subfile.size=3977
  Directory.subfile.md5=0860D82A7C4A8E464C28A347C0B183C4
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\amazon.gif
  Properties.size=976
  Properties.md5=2113CCD1843F1BEFF79E9E5013CB1F45
  Properties.filedate=1255710578
  Properties.filedatetext=2009-10-16 17:29:38

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\dropinsavings.gif
  Properties.size=2028
  Properties.md5=B5944EDC7AADF4E530F722C37DF06C84
  Properties.filedate=1323966630
  Properties.filedatetext=2011-12-15 17:30:30

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\dropinsavingsabt.gif
  Properties.size=1942
  Properties.md5=B1F8051EF9F443509F502A18EECCA50F
  Properties.filedate=1323966630
  Properties.filedatetext=2011-12-15 17:30:30

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\ebay.gif
  Properties.size=920
  Properties.md5=6184113E3CEA69ED84DEBF9EBC15614D
  Properties.filedate=1255710578
  Properties.filedatetext=2009-10-16 17:29:38

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\facebook.gif
  Properties.size=100
  Properties.md5=DD0ECEF270DAC9869AD987B3723F4121
  Properties.filedate=1314700600
  Properties.filedatetext=2011-08-30 11:36:40

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\googleplus.gif
  Properties.size=1085
  Properties.md5=E2B5633817B345E692FC93BFF30DA182
  Properties.filedate=1314702622
  Properties.filedatetext=2011-08-30 12:10:22

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\icon_settings.gif
  Properties.size=941
  Properties.md5=934612DB06B052027E26EA362B5FC57B
  Properties.filedate=1244657714
  Properties.filedatetext=2009-06-10 19:15:14

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_branding.gif
  Properties.size=1365
  Properties.md5=651B9292689487D15DF55F6AD14A2057
  Properties.filedate=1244631590
  Properties.filedatetext=2009-06-10 11:59:50

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_branding_hover.gif
  Properties.size=1462
  Properties.md5=312F2B09641BA1003A9F1EE14EE79F6A
  Properties.filedate=1244631590
  Properties.filedatetext=2009-06-10 11:59:50

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_icon.gif
  Properties.size=1027
  Properties.md5=299A1911C0C28C39556F9C7D1B219A7D
  Properties.filedate=1245932496
  Properties.filedatetext=2009-06-25 13:21:36

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\pdfc_portal_logo.gif
  Properties.size=2695
  Properties.md5=7FA0C2F788B637949004F892263BDDFE
  Properties.filedate=1244631590
  Properties.filedatetext=2009-06-10 11:59:50

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\radio-close.gif
  Properties.size=258
  Properties.md5=357D79F5850F56AC238F7BFE0C31985C
  Properties.filedate=1319726524
  Properties.filedatetext=2011-10-27 15:42:04

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\radio-minimize.gif
  Properties.size=237
  Properties.md5=B513CFE9AD370B8D2A8E8C19E8E8CD51
  Properties.filedate=1319726524
  Properties.filedatetext=2011-10-27 15:42:04

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\radiobeta.gif
  Properties.size=1027
  Properties.md5=98FF4DAEBF15E97C1DCFA31F2325AC59
  Properties.filedate=1314968980
  Properties.filedatetext=2011-09-02 14:09:40

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\search-button-hover.gif
  Properties.size=1029
  Properties.md5=4922C75F4D9975F847E2CAE95D69BC09
  Properties.filedate=1230632556
  Properties.filedatetext=2008-12-30 11:22:36

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\search-button.gif
  Properties.size=1037
  Properties.md5=4950662A97FB05D1C5DCE6A2192ADB8E
  Properties.filedate=1230632556
  Properties.filedatetext=2008-12-30 11:22:36

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\search-chevron-hover.gif
  Properties.size=948
  Properties.md5=03D6C15A2D04370DB72FC1D43F92B3E6
  Properties.filedate=1230632556
  Properties.filedatetext=2008-12-30 11:22:36

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\search-chevron.gif
  Properties.size=846
  Properties.md5=4FE6D25A5D981847730E75DA391B66DC
  Properties.filedate=1230632556
  Properties.filedatetext=2008-12-30 11:22:36

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\search_amazon.gif
  Properties.size=1004
  Properties.md5=2329A190840620B30D80C7E8F4B4C51C
  Properties.filedate=1244657714
  Properties.filedatetext=2009-06-10 19:15:14

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\search_baidu.gif
  Properties.size=614
  Properties.md5=35413285571F6052D773CFE59C1DF7E9
  Properties.filedate=1314784926
  Properties.filedatetext=2011-08-31 11:02:06

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\search_ebay.gif
  Properties.size=929
  Properties.md5=69286ABD58F84241A321A06D14A3B1BE
  Properties.filedate=1244657714
  Properties.filedatetext=2009-06-10 19:15:14

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\search_yahoo.gif
  Properties.size=941
  Properties.md5=7C8E1580C8FFDD48909C6BE4FAABE2DA
  Properties.filedate=1254226904
  Properties.filedatetext=2009-09-29 13:21:44

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\search_yandex.gif
  Properties.size=327
  Properties.md5=615699B55309FC7B68FA25F4E679B9D5
  Properties.filedate=1314784926
  Properties.filedatetext=2011-08-31 11:02:06

Widgi.Toolbar: [SBI $0C74B726]  Picture (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\twitter.gif
  Properties.size=166
  Properties.md5=A36DB71BE1818EAF5F36DE957D2B210C
  Properties.filedate=1314702622
  Properties.filedatetext=2011-08-30 12:10:22

Widgi.Toolbar: [SBI $5066117C] Program directory (Directory, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1031.ini
  Directory.subfile.size=3851
  Directory.subfile.md5=98DF25C648931EBD2983CB3AEDA36F1E
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1033.ini
  Directory.subfile.size=3556
  Directory.subfile.md5=CBB6D789310894546B0C575C6AE6E791
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1034.ini
  Directory.subfile.size=4082
  Directory.subfile.md5=6A7FA0954048198B8E0B8B28B1B73BD4
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1036.ini
  Directory.subfile.size=4039
  Directory.subfile.md5=783F291AA17730B0D6A218695934ECAC
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58
  Directory.subfile=C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1040.ini
  Directory.subfile.size=3977
  Directory.subfile.md5=0860D82A7C4A8E464C28A347C0B183C4
  Directory.subfile.filedate=1326984658
  Directory.subfile.filedatetext=2012-01-19 15:50:58

Widgi.Toolbar: [SBI $F290DF89]  Text file (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1031.ini
  Properties.size=3851
  Properties.md5=98DF25C648931EBD2983CB3AEDA36F1E
  Properties.filedate=1326984658
  Properties.filedatetext=2012-01-19 15:50:58

Widgi.Toolbar: [SBI $F290DF89]  Text file (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1033.ini
  Properties.size=3556
  Properties.md5=CBB6D789310894546B0C575C6AE6E791
  Properties.filedate=1326984658
  Properties.filedatetext=2012-01-19 15:50:58

Widgi.Toolbar: [SBI $F290DF89]  Text file (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1034.ini
  Properties.size=4082
  Properties.md5=6A7FA0954048198B8E0B8B28B1B73BD4
  Properties.filedate=1326984658
  Properties.filedatetext=2012-01-19 15:50:58

Widgi.Toolbar: [SBI $F290DF89]  Text file (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1036.ini
  Properties.size=4039
  Properties.md5=783F291AA17730B0D6A218695934ECAC
  Properties.filedate=1326984658
  Properties.filedatetext=2012-01-19 15:50:58

Widgi.Toolbar: [SBI $F290DF89]  Text file (File, nothing done)
  C:\Program Files (x86)\pdfforge Toolbar\Res\Lang\res1040.ini
  Properties.size=3977
  Properties.md5=0860D82A7C4A8E464C28A347C0B183C4
  Properties.filedate=1326984658
  Properties.filedatetext=2012-01-19 15:50:58

Widgi.Toolbar: [SBI $E4808FA3] Settings (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\Application Updater\

IncrediBar: [SBI $4A0F744C] Root class (Registry Key, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.ExtensionHelperObject

IncrediBar: [SBI $4A0F744C] Root class (Registry Key, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.ExtensionHelperObject.1

IncrediBar: [SBI $4A0F744C] Class ID (Registry Key, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}

IncrediBar: [SBI $4A0F744C] Browser helper object (Registry Key, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}

IncrediBar: [SBI $4A0F744C] Root class (Registry Key, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.ExtensionHelperObject.1

IncrediBar: [SBI $4A0F744C] Class ID (Registry Key, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}

IncrediBar: [SBI $4A0F744C] Browser helper object (Registry Key, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}

IncrediBar: [SBI $4A0F744C] Root class (Registry Key, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.ExtensionHelperObject

IncrediBar: [SBI $418BC215]  Library (File, nothing done)
  C:\Program Files\Web Assistant\Extension32.dll
  Properties.size=162816
  Properties.md5=614BEB86450036E7717DE8D180D7119C
  Properties.filedate=1336482860
  Properties.filedatetext=2012-05-08 14:14:20

IncrediBar: [SBI $C5EA0EAF]  Library (File, nothing done)
  C:\Program Files\Web Assistant\Extension64.dll
  Properties.size=201728
  Properties.md5=539DC269BB307FF28280C751D79CF355
  Properties.filedate=1336482868
  Properties.filedatetext=2012-05-08 14:14:28

SweetIM: [SBI $51CF2A45] Settings (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\SweetIM\simapp_id

SweetIM: [SBI $3C0145EF] Settings (Registry Value, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\SweetIM\simapp_id

SweetIM: [SBI $CF88A0B7]  Data (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Mozilla\Firefox\Profiles\mpazrgl1.default\searchplugins\sweetim.xml
  Properties.size=3915
  Properties.md5=EF691DD0310399372EAD6FACEEDBE1BB
  Properties.filedate=1351966632
  Properties.filedatetext=2012-11-03 19:17:12

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\affiliates.exlibris.ch\pap20.sol
  Properties.size=98
  Properties.md5=08D700DB6DE8E41D230D3F330C85307E
  Properties.filedate=1337588686
  Properties.filedatetext=2012-05-21 09:24:46

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\cdn.flashtalking.com\ftLocalComms.sol
  Properties.size=61
  Properties.md5=548A59F7B165D23D1FFCC95519BFAD69
  Properties.filedate=1345299242
  Properties.filedatetext=2012-08-18 15:14:02

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\cdn.movad.net\movad.sol
  Properties.size=67
  Properties.md5=B8B905E13D2BEC197AFBEA38D2ECA081
  Properties.filedate=1353315044
  Properties.filedatetext=2012-11-19 09:50:44

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\cdn.zopim.com\YjH4qjKxHWeIMxGDVjeSTT7nC3urVz6FSession_SO.sol
  Properties.size=766
  Properties.md5=2016A67F4EB642A50391D8F29AE33F88
  Properties.filedate=1338201262
  Properties.filedatetext=2012-05-28 11:34:22

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\cdn.zopim.com\YjH4qjKxHWeIMxGDVjeSTT7nC3urVz6FVolatile_SO.sol
  Properties.size=225
  Properties.md5=7F514741E868269E8DF0467A6BDFDD68
  Properties.filedate=1338201262
  Properties.filedatetext=2012-05-28 11:34:22

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\cf.komonews.com\analytics.sol
  Properties.size=498
  Properties.md5=FC9630EC7BC7B6A802478A22BE795ABD
  Properties.filedate=1350419102
  Properties.filedatetext=2012-10-16 21:25:02

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\d.yimg.com\VolumePrefs.sol
  Properties.size=55
  Properties.md5=680CC18183453BA30B3B748933B29AE7
  Properties.filedate=1345964812
  Properties.filedatetext=2012-08-26 08:06:51

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\d.yimg.com\YEPBWPrefs.sol
  Properties.size=71
  Properties.md5=6F785E49C88C834D7DD456F0C9500001
  Properties.filedate=1345964478
  Properties.filedatetext=2012-08-26 08:01:18

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\d.yimg.com\YEPVitalitySharedObject.sol
  Properties.size=58
  Properties.md5=7AD10E376C0415AC6E10DAB394EE1FBB
  Properties.filedate=1345964476
  Properties.filedatetext=2012-08-26 08:01:16

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\dlr2.wdpromedia.com\globalAudio.sol
  Properties.size=50
  Properties.md5=388AA8ADCC26944E0DF539C2979F388C
  Properties.filedate=1339614714
  Properties.filedatetext=2012-06-13 20:11:54

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\effectivemeasure.net\EM_APP.sol
  Properties.size=100
  Properties.md5=5568E94234D2023FC023EF4D1F0FD067
  Properties.filedate=1350240843
  Properties.filedatetext=2012-10-14 19:54:03

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\embed.redtube.com\com.rtplayer.sol
  Properties.size=48
  Properties.md5=EC9799EC8DAF0169AF7BE1D92ABE58D3
  Properties.filedate=1347015717
  Properties.filedatetext=2012-09-07 12:01:56

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\img.fastcdn.me\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=C9828AC7EA29DCA4350DA4AC94B63002
  Properties.filedate=1348934940
  Properties.filedatetext=2012-09-29 17:09:00

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\img.widgets.video.s-msn.com\CountryCode.sol
  Properties.size=112
  Properties.md5=42A85FD4A08D890647EA213EB968EE4D
  Properties.filedate=1345965252
  Properties.filedatetext=2012-08-26 08:14:12

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\img.widgets.video.s-msn.com\reportingSegment.sol
  Properties.size=83
  Properties.md5=1F5BD0DB94977B79EDE502A98886D626
  Properties.filedate=1345965239
  Properties.filedatetext=2012-08-26 08:13:59

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\is3.myvideo.de\com.conviva.livePass.sol
  Properties.size=224
  Properties.md5=FCFF4C23EF67A57A23065DD8B2647455
  Properties.filedate=1353191065
  Properties.filedatetext=2012-11-17 23:24:24

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\is4.myvideo.de\com.conviva.livePass.sol
  Properties.size=220
  Properties.md5=EA22ACF0FA9A3ACF2DF15B6F79EA45A4
  Properties.filedate=1353176662
  Properties.filedatetext=2012-11-17 19:24:22

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\localhost\adepermissions.sol
  Properties.size=454
  Properties.md5=853106BA80B8ED4E63D53026D435C078
  Properties.filedate=1349889573
  Properties.filedatetext=2012-10-10 18:19:32

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\localhost\adept.sol
  Properties.size=2698
  Properties.md5=5474047143BFB1C8728A79D2DEC6F187
  Properties.filedate=1349209777
  Properties.filedatetext=2012-10-02 21:29:36

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\manor.ch\food_wo48.sol
  Properties.size=73
  Properties.md5=2667015DE2901AF2CB174A36ECF36B2A
  Properties.filedate=1337685648
  Properties.filedatetext=2012-05-22 12:20:47

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\media.mtvnservices.com\com.conviva.livePass.sol
  Properties.size=224
  Properties.md5=7EFB86D4B8E48F9474F55569A65126FD
  Properties.filedate=1345965172
  Properties.filedatetext=2012-08-26 08:12:52

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\media.mtvnservices.com\com.mtvnet.mediaplayer.UserPrefs.sol
  Properties.size=391
  Properties.md5=39863463951EE341363EE7D29B40F558
  Properties.filedate=1345965184
  Properties.filedatetext=2012-08-26 08:13:03

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\media.mtvnservices.com\com.mtvnservices.media.as3player.model.user.SavedPreferencesVO.sol
  Properties.size=184
  Properties.md5=3D0BDE718F64E12E8E006306C340C1BC
  Properties.filedate=1345965184
  Properties.filedatetext=2012-08-26 08:13:03

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\media.mtvnservices.com\MetadataHistory.sol
  Properties.size=49
  Properties.md5=F6BA2B9A059F7B1E493E72A312FF32FB
  Properties.filedate=1345965184
  Properties.filedatetext=2012-08-26 08:13:03

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\members.bet365.com\FCE.sol
  Properties.size=88
  Properties.md5=F1FFA618A93D6071C7871A47A7DAC5A7
  Properties.filedate=1353829035
  Properties.filedatetext=2012-11-25 08:37:15

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\nimg.joyclub.de\fupvid.sol
  Properties.size=67
  Properties.md5=FB55FB6E32695C836FDDC4EB73938818
  Properties.filedate=1353013021
  Properties.filedatetext=2012-11-15 21:57:01

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\pampa.postaffiliatepro.com\pap20.sol
  Properties.size=98
  Properties.md5=707C70E2623DD65E5018E3788504871C
  Properties.filedate=1347196937
  Properties.filedatetext=2012-09-09 14:22:17

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\player.ooyala.com\auth.sol
  Properties.size=70
  Properties.md5=5128F20F331C1593BB36A95872D2688C
  Properties.filedate=1343765788
  Properties.filedatetext=2012-07-31 21:16:28

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\player.ooyala.com\auth2.sol
  Properties.size=132
  Properties.md5=282F47A4EB297018B58367D2B25AFC0A
  Properties.filedate=1343765840
  Properties.filedatetext=2012-07-31 21:17:19

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\player.ooyala.com\perf.sol
  Properties.size=122
  Properties.md5=208298CE5BD288C9AA9E3D2A73FEEC31
  Properties.filedate=1343765828
  Properties.filedatetext=2012-07-31 21:17:07

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\s.delvenetworks.com\cachedPlayerConfiguration.sol
  Properties.size=8064
  Properties.md5=9326E11A37BEBC381B674ADA6B81744B
  Properties.filedate=1353314241
  Properties.filedatetext=2012-11-19 09:37:21

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\s.delvenetworks.com\com.conviva.livePass.sol
  Properties.size=224
  Properties.md5=8CA0F2944A97551DDB47E8734E93471C
  Properties.filedate=1353314246
  Properties.filedatetext=2012-11-19 09:37:25

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\s.delvenetworks.com\player.sol
  Properties.size=74
  Properties.md5=4FA72E5FCF7A5C98901D78E42287872F
  Properties.filedate=1353314241
  Properties.filedatetext=2012-11-19 09:37:21

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\s.ytimg.com\subtitlesModuleData.sol
  Properties.size=180
  Properties.md5=4238860882998B3F1E01193F267774F3
  Properties.filedate=1351450654
  Properties.filedatetext=2012-10-28 19:57:34

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\s.ytimg.com\videostats.sol
  Properties.size=275
  Properties.md5=A436193D876E55C9A02F0E7F20BDDE02
  Properties.filedate=1353225855
  Properties.filedatetext=2012-11-18 09:04:14

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\secure-us.imrworldwide.com\_ggCvar.sol
  Properties.size=74
  Properties.md5=879990A6A43568D06BD84336F84AAE76
  Properties.filedate=1345965174
  Properties.filedatetext=2012-08-26 08:12:54

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\secure-us.imrworldwide.com\_ggCvar_temp.sol
  Properties.size=79
  Properties.md5=F453CE91D185C257835CDF42249AB425
  Properties.filedate=1345965174
  Properties.filedatetext=2012-08-26 08:12:54

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\secure-us.imrworldwide.com\_ggMCvar_1.sol
  Properties.size=221
  Properties.md5=54A6D69EC4424A7C94D3C35100B2C49C
  Properties.filedate=1345965184
  Properties.filedatetext=2012-08-26 08:13:03

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server1.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=27D8343FFABB292E44F04F9CC9517E0B
  Properties.filedate=1345370928
  Properties.filedatetext=2012-08-19 11:08:47

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server10.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=3129BB7EBEF1969A8AB85E4E3E054AA1
  Properties.filedate=1348995064
  Properties.filedatetext=2012-09-30 09:51:04

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server11.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=CA07D7C3078773C3D5671BFDA2EE8BCF
  Properties.filedate=1347790522
  Properties.filedatetext=2012-09-16 11:15:21

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server12.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=C92B583536065740D1BE5FFE55917C94
  Properties.filedate=1346059213
  Properties.filedatetext=2012-08-27 10:20:13

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server13.stream2k.com\com.jeroenwijering.sol
  Properties.size=64
  Properties.md5=865EAD44280C3C157B07931834AA1725
  Properties.filedate=1349682603
  Properties.filedatetext=2012-10-08 08:50:03

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server14.stream2k.com\com.jeroenwijering.sol
  Properties.size=64
  Properties.md5=FC690FE055BD8469285D2E0F58CC5A8E
  Properties.filedate=1347183776
  Properties.filedatetext=2012-09-09 10:42:55

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server15.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=EB067735E5D7F27074DE0D63CBF877DE
  Properties.filedate=1350282264
  Properties.filedatetext=2012-10-15 07:24:24

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server17.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=E03CFFE0962D6889BBEA3FF8DCEAB1D9
  Properties.filedate=1348932546
  Properties.filedatetext=2012-09-29 16:29:06

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server19.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=08D7067E6679AEEB6303FB51AF8F7EFD
  Properties.filedate=1350891641
  Properties.filedatetext=2012-10-22 08:40:40

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server20.stream2k.com\com.jeroenwijering.sol
  Properties.size=64
  Properties.md5=600BEEF13AD7C45C2E41E1ECA473FB76
  Properties.filedate=1345370185
  Properties.filedatetext=2012-08-19 10:56:25

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server21.stream2k.com\com.jeroenwijering.sol
  Properties.size=64
  Properties.md5=806B50154C6EDFAC07B643E5994D70E2
  Properties.filedate=1349207353
  Properties.filedatetext=2012-10-02 20:49:13

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server22.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=5263E96335361FE6A2D340338D14B137
  Properties.filedate=1347172926
  Properties.filedatetext=2012-09-09 07:42:06

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server23.stream2k.com\com.jeroenwijering.sol
  Properties.size=64
  Properties.md5=A6128ADA37CBEA7EB308AF32049D64A1
  Properties.filedate=1349686070
  Properties.filedatetext=2012-10-08 09:47:49

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server24.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=8C3AE6DF6F893D38B0ECBE059A2C8B01
  Properties.filedate=1349206239
  Properties.filedatetext=2012-10-02 20:30:39

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server27.stream2k.com\com.jeroenwijering.sol
  Properties.size=61
  Properties.md5=4CD40084356CA8AECBD05696E85C11C5
  Properties.filedate=1348078443
  Properties.filedatetext=2012-09-19 19:14:03

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server28.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=8A10818590C3E4CED33F4EF6B58B6633
  Properties.filedate=1348993042
  Properties.filedatetext=2012-09-30 09:17:21

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server3.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=021F5F4EA1DBF9ED21ECD5D2A1F4663D
  Properties.filedate=1339967281
  Properties.filedatetext=2012-06-17 22:08:00

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server30.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=0D0B50EE0606CF9920E3DBE781438135
  Properties.filedate=1347867590
  Properties.filedatetext=2012-09-17 08:39:50

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server31.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=7FD831375D5AD56AD730FE7F7FC2F2C4
  Properties.filedate=1347183982
  Properties.filedatetext=2012-09-09 10:46:22

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server32.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=CA07D7C3078773C3D5671BFDA2EE8BCF
  Properties.filedate=1340616003
  Properties.filedatetext=2012-06-25 10:20:02

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server34.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=D734A16983EDCE8074BC5CEB7E98C794
  Properties.filedate=1350990224
  Properties.filedatetext=2012-10-23 12:03:44

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server35.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=A6F8DF3F9D2D8F61CE43085581E56155
  Properties.filedate=1346610076
  Properties.filedatetext=2012-09-02 19:21:15

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server36.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=6E1F499A4D76134F93B1467ACD4DEB16
  Properties.filedate=1351496885
  Properties.filedatetext=2012-10-29 08:48:04

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server37.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=EB067735E5D7F27074DE0D63CBF877DE
  Properties.filedate=1347780607
  Properties.filedatetext=2012-09-16 08:30:07

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server39.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=23C42444800CDE0DB11354CF6BC90239
  Properties.filedate=1347271670
  Properties.filedatetext=2012-09-10 11:07:49

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server4.stream2k.com\com.jeroenwijering.sol
  Properties.size=63
  Properties.md5=D87AE941FE7E9195397A4AF0F9B4BC7B
  Properties.filedate=1342952493
  Properties.filedatetext=2012-07-22 11:21:33

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server41.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=4054B403DFD8B2AF46C1A071338BD2BD
  Properties.filedate=1344782364
  Properties.filedatetext=2012-08-12 15:39:24

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server42.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=09AEA4F6BCF58DA05A6BD1303C33726C
  Properties.filedate=1347294735
  Properties.filedatetext=2012-09-10 17:32:15

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server45.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=EB6FD0114500D6973F331FB0A97820A4
  Properties.filedate=1345965990
  Properties.filedatetext=2012-08-26 08:26:30

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server5.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=BC93E717A4D1AADD4A3DD220AD482D58
  Properties.filedate=1338804601
  Properties.filedatetext=2012-06-04 11:10:01

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server52.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=7F693F65CB333E9E543BE6F909EC70C4
  Properties.filedate=1347359844
  Properties.filedatetext=2012-09-11 11:37:23

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server55.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=CA07D7C3078773C3D5671BFDA2EE8BCF
  Properties.filedate=1347864885
  Properties.filedatetext=2012-09-17 07:54:44

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server6.stream2k.com\com.jeroenwijering.sol
  Properties.size=53
  Properties.md5=9056E02037099DF1A5E409B9A7DA4592
  Properties.filedate=1350291560
  Properties.filedatetext=2012-10-15 09:59:19

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server7.stream2k.com\com.jeroenwijering.sol
  Properties.size=71
  Properties.md5=8214B815110DFB32B3634590343D0235
  Properties.filedate=1348469702
  Properties.filedatetext=2012-09-24 07:55:01

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server8.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=C92B583536065740D1BE5FFE55917C94
  Properties.filedate=1344873744
  Properties.filedatetext=2012-08-13 17:02:24

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\server9.stream2k.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=F67F39C879DC3D79C45C5E8C30CA3EE8
  Properties.filedate=1343801486
  Properties.filedatetext=2012-08-01 07:11:25

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\serving-sys.com\261674.sol
  Properties.size=62
  Properties.md5=934EAB19A832F1CF74928C460C91449F
  Properties.filedate=1352492424
  Properties.filedatetext=2012-11-09 21:20:24

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\ssl.hurra.com\restore.hurra.com.sol
  Properties.size=178
  Properties.md5=0C594843CA45E10ABB85AE653CA05ABA
  Properties.filedate=1350291891
  Properties.filedatetext=2012-10-15 10:04:50

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\static.issuu.com\analytics.sol
  Properties.size=435
  Properties.md5=9765648DA28DEAAA69781F36A02B0794
  Properties.filedate=1351440682
  Properties.filedatetext=2012-10-28 17:11:21

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\static1.spilcdn.com\analytics.sol
  Properties.size=419
  Properties.md5=A37D5E6CB2CEAE14473773F9A8CB62BA
  Properties.filedate=1353849933
  Properties.filedatetext=2012-11-25 14:25:32

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\streamcloud.eu\com.jeroenwijering.sol
  Properties.size=53
  Properties.md5=0B89995DE4EE105C4A4DBCBA0FDD70B0
  Properties.filedate=1352715131
  Properties.filedatetext=2012-11-12 11:12:11

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\weltbild.scene7.com\s7_storage_init.sol
  Properties.size=321
  Properties.md5=F8F25EC3381F964D9B6DC1BD197F6D14
  Properties.filedate=1350222357
  Properties.filedatetext=2012-10-14 14:45:56

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\weltbild.scene7.com\s7_storage_tracker.sol
  Properties.size=152
  Properties.md5=8FC9683CE87442FA614259870E01C104
  Properties.filedate=1350222357
  Properties.filedatetext=2012-10-14 14:45:57

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.bangyoulater.com\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=8597FA60D9BA308EB146F3A82B2DE8EC
  Properties.filedate=1351016527
  Properties.filedatetext=2012-10-23 19:22:07

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.bet365.com\b365lipcs.sol
  Properties.size=377
  Properties.md5=55913E69AD42682E0B1890C8B478820F
  Properties.filedate=1353829047
  Properties.filedatetext=2012-11-25 08:37:27

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.bet365.com\b365push.sol
  Properties.size=54
  Properties.md5=B158A50B9C9EB65C9B409C27A16AAADE
  Properties.filedate=1352034769
  Properties.filedatetext=2012-11-04 14:12:49

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.bet365.com\betslip365.sol
  Properties.size=58
  Properties.md5=87D85331E7DA894E4938D5AABEA02FCE
  Properties.filedate=1353829040
  Properties.filedatetext=2012-11-25 08:37:19

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.bet365.com\htrGgjy810GhjsyjwutirtizqjGifyfGhjsyjwutihttpnj.sol
  Properties.size=144
  Properties.md5=49EB3AF0C4FF1FB358D6A820096EE536
  Properties.filedate=1353829047
  Properties.filedatetext=2012-11-25 08:37:27

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.dailymotion.com\com.dm.player.sol
  Properties.size=155
  Properties.md5=9E0844D5B4AD0BC15E4C13B965D14162
  Properties.filedate=1345964601
  Properties.filedatetext=2012-08-26 08:03:21

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.fitnessraum.de\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=29DD959E1243D3725037CA720013C4D4
  Properties.filedate=1352046260
  Properties.filedatetext=2012-11-04 17:24:19

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.mytraining.de\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=6F1FB4C607464009920198DB1FE4B55D
  Properties.filedate=1352046445
  Properties.filedatetext=2012-11-04 17:27:25

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.tripadvisor.com\TA.sol
  Properties.size=62
  Properties.md5=79376BCB45AFBB298862D9999CBF24CD
  Properties.filedate=1348330238
  Properties.filedatetext=2012-09-22 17:10:38

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.tripadvisor.de\TA.sol
  Properties.size=62
  Properties.md5=79376BCB45AFBB298862D9999CBF24CD
  Properties.filedate=1349002325
  Properties.filedatetext=2012-09-30 11:52:05

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.ultimedia.com\analytics.sol
  Properties.size=485
  Properties.md5=E399881249ED6ED2B747612DDFC3DB51
  Properties.filedate=1341685405
  Properties.filedatetext=2012-07-07 19:23:24

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.zdf.de\com.conviva.livePass.sol
  Properties.size=229
  Properties.md5=D773BCC2F18F57CABC9AF2F62932964C
  Properties.filedate=1352019723
  Properties.filedatetext=2012-11-04 10:02:03

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\yesload.net\com.jeroenwijering.sol
  Properties.size=54
  Properties.md5=7FD831375D5AD56AD730FE7F7FC2F2C4
  Properties.filedate=1353940615
  Properties.filedatetext=2012-11-26 15:36:54

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\eu-st.xhamster.com\xembed5.swf\dat.sol
  Properties.size=41
  Properties.md5=FC7285375CF1E81CF708BEF47763F673
  Properties.filedate=1351247810
  Properties.filedatetext=2012-10-26 11:36:49

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\h2porn.com\#kernelteam\preferences.sol
  Properties.size=91
  Properties.md5=3DD721692A0A4CD4F1D66AD426B041B0
  Properties.filedate=1351625513
  Properties.filedatetext=2012-10-30 20:31:52

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\p.iivt.com\iivt.swf\iivt.sol
  Properties.size=40
  Properties.md5=876253F221A6B27E56C72960401F2F72
  Properties.filedate=1349263045
  Properties.filedatetext=2012-10-03 12:17:24

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\skype.com\#ui\preferences.sol
  Properties.size=234
  Properties.md5=8D60DA099BCB68B12A861AA1EC559BC4
  Properties.filedate=1352828957
  Properties.filedatetext=2012-11-13 18:49:16

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\static.sockshare.com\video_player.swf\org.flowplayer.sol
  Properties.size=67
  Properties.md5=44D19B3C560CFC35AA9E307DB5D40847
  Properties.filedate=1347783753
  Properties.filedatetext=2012-09-16 09:22:32

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.bravotube.net\#kernelteam\preferences.sol
  Properties.size=70
  Properties.md5=86BA541A1DF996E6FEE216F17DFC1541
  Properties.filedate=1351625640
  Properties.filedatetext=2012-10-30 20:33:59

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\back7.keycaptcha.com\js\keycaptcha-logo\kcv_uid.sol
  Properties.size=39
  Properties.md5=DECCC38FA2FEDDDD54310979FB7A7189
  Properties.filedate=1353176816
  Properties.filedatetext=2012-11-17 19:26:56

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\casino.com\flash\flash_object_81.swf\emerp.sol
  Properties.size=370
  Properties.md5=AB6055DC054D688D45FB6AD5FDA25E33
  Properties.filedate=1351494725
  Properties.filedatetext=2012-10-29 08:12:04

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\cdn.zopim.com\swf\ZClientController.swf\ZopConfig.sol
  Properties.size=155
  Properties.md5=40245A97BC99DDED3B33ECF90633B9DA
  Properties.filedate=1338201248
  Properties.filedatetext=2012-05-28 11:34:07

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\cdn1.static.keezmovies.phncdn.com\flash\player.swf\keezmovies_opts.sol
  Properties.size=47
  Properties.md5=81560E86184C2E80B0D750E2D5106D77
  Properties.filedate=1348474379
  Properties.filedatetext=2012-09-24 09:12:58

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\cdn1.static.pornhub.phncdn.com\flash\player2012.swf\ph_opts.sol
  Properties.size=54
  Properties.md5=2BE5763A2A3988F905E44BDF83557DF7
  Properties.filedate=1353528118
  Properties.filedatetext=2012-11-21 21:01:58

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\cdn1.static.pornhub.phncdn.com\flash\player2012.swf\pornhub_preroll_.sol
  Properties.size=62
  Properties.md5=EC05BC15504598EC53DFE7B1944013E8
  Properties.filedate=1348742762
  Properties.filedatetext=2012-09-27 11:46:01

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\ph-static.phncdn.com\flash\pornhubSkin.swf\pornhub_opts.sol
  Properties.size=44
  Properties.md5=BC194AB4DE72034026F0CBFACA6E40F6
  Properties.filedate=1347015326
  Properties.filedatetext=2012-09-07 11:55:25

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\static.xvideos.com\swf\flv_player_site_v4.swf\hexaplayerVolumeCookie.sol
  Properties.size=61
  Properties.md5=315EFC2B22C338CA28CF1126167B41F5
  Properties.filedate=1351247230
  Properties.filedatetext=2012-10-26 11:27:10

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\widget.ricardo.ch\flash\ricardo.swf\ric_sessionId.sol
  Properties.size=46
  Properties.md5=C53108054A01858B9735D19E304E2888
  Properties.filedate=1352566726
  Properties.filedatetext=2012-11-10 17:58:46

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.drtuber.com\player\videoplayer.swf\dat.sol
  Properties.size=34
  Properties.md5=326A7648F6C4370EC3F327E3023A63A6
  Properties.filedate=1351625591
  Properties.filedatetext=2012-10-30 20:33:11

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www.drtuber.com\player\videoplayer_embed4.swf\dat.sol
  Properties.size=34
  Properties.md5=326A7648F6C4370EC3F327E3023A63A6
  Properties.filedate=1347016033
  Properties.filedatetext=2012-09-07 12:07:12

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\mäder\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CMP6V6BM\www2l.incredimail.com\fc\fc.swf\im.sol
  Properties.size=160
  Properties.md5=A18931765E0F41C06A8717D4911040E3
  Properties.filedate=1338028047
  Properties.filedatetext=2012-05-26 11:27:27

DoubleClick: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Benutzer): mäder) (Browser: Cookie, nothing done)
  

WebTrends live: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Benutzer): mäder) (Browser: Cookie, nothing done)
  

FastClick: [SBI $8E73A7FB] Tracking cookie (Firefox: mäder (default)) (Browser: Cookie, nothing done)
  

DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: mäder (default)) (Browser: Cookie, nothing done)
  

Statcounter: [SBI $8E73A7FB] Tracking cookie (Firefox: mäder (default)) (Browser: Cookie, nothing done)
  

DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: mäder (default)) (Browser: Cookie, nothing done)
  

WebTrends live: [SBI $8E73A7FB] Tracking cookie (Firefox: mäder (default)) (Browser: Cookie, nothing done)
  

Log: [SBI $8E73A7FB]  Install: setupact.log (File, nothing done)
  C:\Windows\setupact.log
  Properties.size=1859
  Properties.md5=F5D13340C28B061A17107800FED3DE07
  Properties.filedate=1353996928
  Properties.filedatetext=2012-11-27 07:15:27

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Internet Explorer\TypedURLs

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Microsoft Management Console\Recent File List

MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

MS Paint: [SBI $07867C39] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

MS Wordpad: [SBI $4C02334D] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows.OpenWith: [SBI $9E8D5C8A] Open with list - .CDA extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList

Windows.OpenWith: [SBI $89F66B4F] Open with list - .CH extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CH\OpenWithList

Windows.OpenWith: [SBI $F1129B32] Open with list - .CPL extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CPL\OpenWithList

Windows Explorer: [SBI $A2C7B3CD] Recent wallpaper list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpaper\MRU

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Cookie: [SBI $49804B54] Browser: Cookie (70) (Browser: Cookie, nothing done)
  

Cache: [SBI $49804B54] Browser: Cache (236) (Browser: Cache, nothing done)
  

Verlauf: [SBI $49804B54] Browser: History (2579) (Browser: History, nothing done)
  

Cookie: [SBI $49804B54] Browser: Cookie (273) (Browser: Cookie, nothing done)
  


--- Spybot - Search & Destroy version: 2.0.12.131  DLL (build: 20121113) ---

2012-11-13 blindman.exe (2.0.12.151)
2012-11-13 explorer.exe (2.0.12.173)
2012-11-13 SDBootCD.exe (2.0.12.109)
2012-11-13 SDCleaner.exe (2.0.12.110)
2012-11-13 SDDelFile.exe (2.0.12.94)
2012-11-13 SDFiles.exe (2.0.12.135)
2012-11-13 SDFileScanHelper.exe (2.0.12.1)
2012-11-13 SDFSSvc.exe (2.0.12.205)
2012-11-13 SDImmunize.exe (2.0.12.130)
2012-11-13 SDLogReport.exe (2.0.12.107)
2012-11-13 SDPESetup.exe (2.0.12.3)
2012-11-13 SDPEStart.exe (2.0.12.86)
2012-11-13 SDPhoneScan.exe (2.0.12.27)
2012-11-13 SDPRE.exe (2.0.12.13)
2012-11-13 SDPrepPos.exe (2.0.12.10)
2012-11-13 SDQuarantine.exe (2.0.12.103)
2012-11-13 SDRootAlyzer.exe (2.0.12.116)
2012-11-13 SDSBIEdit.exe (2.0.12.39)
2012-11-13 SDScan.exe (2.0.12.173)
2012-11-13 SDScript.exe (2.0.12.53)
2012-11-13 SDSettings.exe (2.0.12.130)
2012-11-13 SDShred.exe (2.0.12.105)
2012-11-13 SDSysRepair.exe (2.0.12.101)
2012-11-13 SDTools.exe (2.0.12.150)
2012-11-13 SDTray.exe (2.0.12.127)
2012-11-13 SDUpdate.exe (2.0.12.89)
2012-11-13 SDUpdSvc.exe (2.0.12.76)
2012-11-13 SDWelcome.exe (2.0.12.126)
2012-11-13 SDWSCSvc.exe (2.0.12.2)
2012-11-27 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2012-11-13 SDAdvancedCheckLibrary.dll (2.0.12.98)
2012-11-13 SDECon32.dll (2.0.12.113)
2012-11-13 SDECon64.dll (2.0.12.113)
2012-11-13 SDEvents.dll (2.0.12.2)
2012-11-13 SDFileScanLibrary.dll (2.0.12.9)
2012-11-13 SDHelper.dll (2.0.12.88)
2012-11-13 SDImmunizeLibrary.dll (2.0.12.2)
2012-11-13 SDLists.dll (2.0.12.4)
2012-11-13 SDResources.dll (2.0.12.7)
2012-11-13 SDScanLibrary.dll (2.0.12.131)
2012-11-13 SDTasks.dll (2.0.12.15)
2012-11-13 SDWinLogon.dll (2.0.12.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2012-11-13 Tools.dll (2.0.12.36)
2012-11-13 UninsSrv.dll (2.0.12.52)
2012-11-14 Includes\Adware.sbi (*)
2012-11-14 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
2012-11-14 Includes\Keyloggers.sbi (*)
2012-11-14 Includes\KeyloggersC.sbi (*)
2012-11-14 Includes\Malware.sbi (*)
2012-11-14 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2012-11-14 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2012-11-14 Includes\Spyware.sbi (*)
2012-11-14 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2005-02-17 Includes\Tracks.uti (*)
2012-11-14 Includes\Trojans.sbi (*)
2012-11-14 Includes\TrojansC-02.sbi (*)
2012-11-14 Includes\TrojansC-03.sbi (*)
2012-11-14 Includes\TrojansC-04.sbi (*)
2012-11-14 Includes\TrojansC-05.sbi (*)
2012-11-14 Includes\TrojansC.sbi (*)
         
Search results from Spybot - Search & Destroy

27.11.2012 07:58:22
Scan took 00:12:37.
5 items found.


Code:
ATTFilter
Search results from Spybot - Search & Destroy

27.11.2012 07:58:22
Scan took 00:12:37.
5 items found.

DoubleClick: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Benutzer): mäder) (Browser: Cookie, nothing done)
  

WebTrends live: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Benutzer): mäder) (Browser: Cookie, nothing done)
  

Cookie: [SBI $49804B54] Browser: Cookie (70) (Browser: Cookie, nothing done)
  

Cache: [SBI $49804B54] Browser: Cache (1) (Browser: Cache, nothing done)
  

Verlauf: [SBI $49804B54] Browser: History (775) (Browser: History, nothing done)
  


--- Spybot - Search & Destroy version: 2.0.12.131  DLL (build: 20121113) ---

2012-11-13 blindman.exe (2.0.12.151)
2012-11-13 explorer.exe (2.0.12.173)
2012-11-13 SDBootCD.exe (2.0.12.109)
2012-11-13 SDCleaner.exe (2.0.12.110)
2012-11-13 SDDelFile.exe (2.0.12.94)
2012-11-13 SDFiles.exe (2.0.12.135)
2012-11-13 SDFileScanHelper.exe (2.0.12.1)
2012-11-13 SDFSSvc.exe (2.0.12.205)
2012-11-13 SDImmunize.exe (2.0.12.130)
2012-11-13 SDLogReport.exe (2.0.12.107)
2012-11-13 SDPESetup.exe (2.0.12.3)
2012-11-13 SDPEStart.exe (2.0.12.86)
2012-11-13 SDPhoneScan.exe (2.0.12.27)
2012-11-13 SDPRE.exe (2.0.12.13)
2012-11-13 SDPrepPos.exe (2.0.12.10)
2012-11-13 SDQuarantine.exe (2.0.12.103)
2012-11-13 SDRootAlyzer.exe (2.0.12.116)
2012-11-13 SDSBIEdit.exe (2.0.12.39)
2012-11-13 SDScan.exe (2.0.12.173)
2012-11-13 SDScript.exe (2.0.12.53)
2012-11-13 SDSettings.exe (2.0.12.130)
2012-11-13 SDShred.exe (2.0.12.105)
2012-11-13 SDSysRepair.exe (2.0.12.101)
2012-11-13 SDTools.exe (2.0.12.150)
2012-11-13 SDTray.exe (2.0.12.127)
2012-11-13 SDUpdate.exe (2.0.12.89)
2012-11-13 SDUpdSvc.exe (2.0.12.76)
2012-11-13 SDWelcome.exe (2.0.12.126)
2012-11-13 SDWSCSvc.exe (2.0.12.2)
2012-11-27 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2012-11-13 SDAdvancedCheckLibrary.dll (2.0.12.98)
2012-11-13 SDECon32.dll (2.0.12.113)
2012-11-13 SDECon64.dll (2.0.12.113)
2012-11-13 SDEvents.dll (2.0.12.2)
2012-11-13 SDFileScanLibrary.dll (2.0.12.9)
2012-11-13 SDHelper.dll (2.0.12.88)
2012-11-13 SDImmunizeLibrary.dll (2.0.12.2)
2012-11-13 SDLists.dll (2.0.12.4)
2012-11-13 SDResources.dll (2.0.12.7)
2012-11-13 SDScanLibrary.dll (2.0.12.131)
2012-11-13 SDTasks.dll (2.0.12.15)
2012-11-13 SDWinLogon.dll (2.0.12.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2012-11-13 Tools.dll (2.0.12.36)
2012-11-13 UninsSrv.dll (2.0.12.52)
2012-11-14 Includes\Adware.sbi (*)
2012-11-14 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
2012-11-14 Includes\Keyloggers.sbi (*)
2012-11-14 Includes\KeyloggersC.sbi (*)
2012-11-14 Includes\Malware.sbi (*)
2012-11-14 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2012-11-14 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2012-11-14 Includes\Spyware.sbi (*)
2012-11-14 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2005-02-17 Includes\Tracks.uti (*)
2012-11-14 Includes\Trojans.sbi (*)
2012-11-14 Includes\TrojansC-02.sbi (*)
2012-11-14 Includes\TrojansC-03.sbi (*)
2012-11-14 Includes\TrojansC-04.sbi (*)
2012-11-14 Includes\TrojansC-05.sbi (*)
2012-11-14 Includes\TrojansC.sbi (*)
         

28.11.2012 17:57:25
Scan took 00:29:29.
4 items found.


Code:
ATTFilter
Search results from Spybot - Search & Destroy

28.11.2012 17:57:25
Scan took 00:29:29.
4 items found.

Log: [SBI $8E73A7FB]  Install: setupact.log (File, nothing done)
  C:\Windows\setupact.log
  Properties.size=112
  Properties.md5=AC849B99E032F4017BB1CE37934DD4AF
  Properties.filedate=1354119712
  Properties.filedatetext=2012-11-28 17:21:52

Cookie: [SBI $49804B54] Browser: Cookie (2) (Browser: Cookie, nothing done)
  

Cache: [SBI $49804B54] Browser: Cache (5) (Browser: Cache, nothing done)
  

Verlauf: [SBI $49804B54] Browser: History (3) (Browser: History, nothing done)
  


--- Spybot - Search & Destroy version: 2.0.12.131  DLL (build: 20121113) ---

2012-11-13 blindman.exe (2.0.12.151)
2012-11-13 explorer.exe (2.0.12.173)
2012-11-13 SDBootCD.exe (2.0.12.109)
2012-11-13 SDCleaner.exe (2.0.12.110)
2012-11-13 SDDelFile.exe (2.0.12.94)
2012-11-13 SDFiles.exe (2.0.12.135)
2012-11-13 SDFileScanHelper.exe (2.0.12.1)
2012-11-13 SDFSSvc.exe (2.0.12.205)
2012-11-13 SDImmunize.exe (2.0.12.130)
2012-11-13 SDLogReport.exe (2.0.12.107)
2012-11-13 SDPESetup.exe (2.0.12.3)
2012-11-13 SDPEStart.exe (2.0.12.86)
2012-11-13 SDPhoneScan.exe (2.0.12.27)
2012-11-13 SDPRE.exe (2.0.12.13)
2012-11-13 SDPrepPos.exe (2.0.12.10)
2012-11-13 SDQuarantine.exe (2.0.12.103)
2012-11-13 SDRootAlyzer.exe (2.0.12.116)
2012-11-13 SDSBIEdit.exe (2.0.12.39)
2012-11-13 SDScan.exe (2.0.12.173)
2012-11-13 SDScript.exe (2.0.12.53)
2012-11-13 SDSettings.exe (2.0.12.130)
2012-11-13 SDShred.exe (2.0.12.105)
2012-11-13 SDSysRepair.exe (2.0.12.101)
2012-11-13 SDTools.exe (2.0.12.150)
2012-11-13 SDTray.exe (2.0.12.127)
2012-11-13 SDUpdate.exe (2.0.12.89)
2012-11-13 SDUpdSvc.exe (2.0.12.76)
2012-11-13 SDWelcome.exe (2.0.12.126)
2012-11-13 SDWSCSvc.exe (2.0.12.2)
2012-11-27 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2012-11-13 SDAdvancedCheckLibrary.dll (2.0.12.98)
2012-11-13 SDECon32.dll (2.0.12.113)
2012-11-13 SDECon64.dll (2.0.12.113)
2012-11-13 SDEvents.dll (2.0.12.2)
2012-11-13 SDFileScanLibrary.dll (2.0.12.9)
2012-11-13 SDHelper.dll (2.0.12.88)
2012-11-13 SDImmunizeLibrary.dll (2.0.12.2)
2012-11-13 SDLists.dll (2.0.12.4)
2012-11-13 SDResources.dll (2.0.12.7)
2012-11-13 SDScanLibrary.dll (2.0.12.131)
2012-11-13 SDTasks.dll (2.0.12.15)
2012-11-13 SDWinLogon.dll (2.0.12.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2012-11-13 Tools.dll (2.0.12.36)
2012-11-13 UninsSrv.dll (2.0.12.52)
2012-11-20 Includes\Adware.sbi (*)
2012-11-28 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
2012-11-14 Includes\Keyloggers.sbi (*)
2012-11-14 Includes\KeyloggersC.sbi (*)
2012-11-21 Includes\Malware.sbi (*)
2012-11-28 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2012-11-28 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2012-11-14 Includes\Spyware.sbi (*)
2012-11-14 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2012-11-14 Includes\Trojans.sbi (*)
2012-11-14 Includes\TrojansC-02.sbi (*)
2012-11-28 Includes\TrojansC-03.sbi (*)
2012-11-14 Includes\TrojansC-04.sbi (*)
2012-11-14 Includes\TrojansC-05.sbi (*)
2012-11-14 Includes\TrojansC.sbi (*)
         
Hier jetzt von Malewarebytes:


26.11.2012 19:40:38
mbam-log-2012-11-26 (19-40-38).txt


Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.26.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mäder :: MÄDER-PC [Administrator]

Schutz: Aktiviert

26.11.2012 19:40:38
mbam-log-2012-11-26 (19-40-38).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 510266
Laufzeit: 2 Stunde(n), 9 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 3
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explore.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\itunes.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\mäder\AppData\Roaming\msconfig.dat (Trojan.Agent.GNI) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

26.11.2012 21:55:37
mbam-log-2012-11-26 (21-55-37).txt

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.26.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mäder :: MÄDER-PC [Administrator]

Schutz: Aktiviert

26.11.2012 21:55:37
mbam-log-2012-11-26 (21-55-37).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 510153
Laufzeit: 1 Stunde(n), 40 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

27.11.2012 12:21:51
mbam-log-2012-11-27 (12-21-51).txt


Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.26.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mäder :: MÄDER-PC [Administrator]

Schutz: Aktiviert

27.11.2012 12:21:51
mbam-log-2012-11-27 (12-21-51).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 510669
Laufzeit: 1 Stunde(n), 38 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
und noch das letzte

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.27.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mäder :: MÄDER-PC [Administrator]

Schutz: Aktiviert

27.11.2012 19:40:29
mbam-log-2012-11-27 (19-40-29).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 500535
Laufzeit: 1 Stunde(n), 40 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

Geändert von drud (28.11.2012 um 18:44 Uhr)

Alt 02.12.2012, 15:51   #2
ryder
/// TB-Ausbilder
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?





Ich werde dir bei deinem Problem helfen. Eine Bereinigung ist mitunter mit viel Arbeit für Dich (und mich) verbunden. Bevor es los geht, habe ich etwas Lesestoff für dich.
Zitat:
Lesestoff:
Regeln für die Bereinigung
Damit die Bereinigung funktioniert bitte ich dich, die folgenden Punkte aufmerksam zu lesen:
  • Bitte arbeite alle Schritte der Reihe nach ab. Gib mir bitte zu jedem Schritt Rückmeldung (Logfile oder Antwort) und zwar gesammelt, wenn du alles erledigt hast.
  • Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder Deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
  • Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
  • Poste die Logfiles direkt in deinen Thread (möglichst in Code-Tags). Nicht anhängen ausser ich fordere Dich dazu auf, oder das Logfile wäre zu gross. Erschwert mir nämlich das Auswerten.
  • Mache deinen Namen nur dann unkenntlich, wenn es unbedingt sein muss.
  • Beim ersten Anzeichen illegal genutzer Software (Cracks, Patches und Co) wird der Support ohne Diskussion eingestellt.
  • Sollte ich nicht nach 3 Tagen geantwortet haben, dann (und nur dann) schicke mir bitte eine PM.
  • Eine Bitte: Mache bitte solange mit, bis ich oder ein anderer Helfer dir mitteilt, dass du "sauber" bist. Das gebietet alleine schon die Höflichkeit und ein Verschwinden der Symptome bedeutet nicht, dass die Schädlinge auch wirklich alle entfernt wurden.
  • Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Wenn du das alles gelesen und verstanden hast, kannst du loslegen!
Schritt 1:
Deinstalliere Spybot und Ccleaner.

Schritt 2:
AdwCleaner: Werbeprogramme suchen und löschen

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Schreibe mir nur ob der Schritt geklappt hat, das anfallende Logfile brauchen wir nicht.
Schritt 3:
Scan mit DDS (+ attach)
Downloade dir bitte DDS (von sUBs) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop.

dds.com | dds.scr | dds.pif
  • Schließe alle laufenden Programme und starte DDS mit Doppelklick.
  • Der Desktop wird verschwinden, das ist normal.
  • Stelle folgendes ein:

    [X] dds.txt
    [X] attach.txt
    [ ] options for dds.txt

  • Ändere keine Einstellung ohne Anweisung.
  • Klicke auf Start.
  • Es werden 2 Logfiles auf deinem Desktop erstellt.
    • dds.txt
    • attach.txt
  • Poste die beiden Logfile hier, möglichst in CODE-Tags.
__________________

__________________

Alt 02.12.2012, 16:48   #3
drud
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



hallo ryder

vielen dank für deine hilfe!!!

Schritt 1 ausgeführt: Spybot und CCCleaner deinstalliert.

Schritt 2 ausgeführt: dieser Schritt hat geklappt. Ich bin einzig nicht sicher, ob der Internet-Explorer (geöffnet mit dieser Seite hier) noch im "Hintergrund" lief. PC wurde aber erfolgreich neu gestartet.

Schritt 3 ausgeführt: hier die Log-Files!

dds.txt
DDS Logfile:
Code:
ATTFilter
DDS (Ver_2012-11-20.01) - NTFS_AMD64 
Internet Explorer: 9.0.8112.16455  BrowserJavaVersion: 10.9.2
Run by mäder at 16:42:26 on 2012-12-02
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.41.1031.18.8096.5881 [GMT 1:00]
.
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Program Files (x86)\Common Files\InstantOn\InsOnSrv.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Common Files\InstantOn\InsOnWMI.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
C:\Windows\System32\igfxtray.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\syncables\syncables desktop\syncables.exe
C:\Program Files (x86)\syncables\syncables desktop\jre\bin\javaw.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files (x86)\syncables\syncables desktop\syncablesMAPI.exe
C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Users\mäder\Desktop\dds.com
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.ch/
uDefault_Page_URL = hxxp://asus.msn.com
mStart Page = hxxp://asus.msn.com
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: CIESpeechBHO Class: {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Google Dictionary Compression sdch: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler                                                                                                                                                                                                                  
uRun: [Syncables] C:\Program Files (x86)\syncables\syncables desktop\Syncables.exe
uRun: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe                                                                                                                                                                                                      
mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
mRun: [RemoteControl10] "C:\Program Files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe"                                                                                                                                                                                                             
mRun: [TrayServer] C:\Program Files (x86)\MAGIX\Video_deluxe_17_Plus_Sonderedition\TrayServer.exe                                                                                                                                                                                           
mRun: [NeroFilterCheck] C:\Program Files (x86)\Common Files\Ahead\Lib\NeroCheck.exe                                                                                                                                                                                                              
mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"                                                                                                                                                                                                         
mRun: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"                                                                                              
mRun: [FreePDF Assistant] "C:\Program Files (x86)\FreePDF_XP\fpassist.exe"                                                                                                                                                                                                                         
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"                                                                                                                                                                                      
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe
uPolicies-Explorer: NoDriveAutoRun = dword:0
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
LSP: C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
   If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.3.0/GarminAxControl_32.CAB
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{365C8262-290E-4378-82AF-89BB619849A5} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{365C8262-290E-4378-82AF-89BB619849A5}\557514D28323334323 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{365C8262-290E-4378-82AF-89BB619849A5}\E4457425F54376036356D637A693 : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{365C8262-290E-4378-82AF-89BB619849A5}\E4457425F54376036356D637A693F523 : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{531A3AF7-8C75-49B3-B2EC-2A1E47B07375} : DHCPNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs= C:\Windows\SysWOW64\nvinit.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
IFEO: AcroRd32.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: asusvibelauncher.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: backache.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: backbone.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: cdprinter.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-mStart Page = hxxp://asus.msn.com
x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3 
x64-Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"                                                                                                                                                                                                                    
x64-Run: [AthBtTray] "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"                                                                                                                                                                                                                   
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
x64-Run: [Logitech Download Assistant] C:\Windows\System32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
x64-Run: [SynAsusAcpi] C:\Program Files (x86)\Synaptics\SynTP\SynAsusAcpi.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
.
INFO: x64-HKLM has more than 50 listed domains.
   If you wish to scan all of them, select the 'Force scan all domains' option.
.
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
x64-IFEO: AcroRd32.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: asusvibelauncher.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: backache.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: backbone.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: cdprinter.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
.
Note: multiple IFEO entries found. Please refer to Attach.txt
Hosts: 127.0.0.1	www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\mäder\AppData\Roaming\Mozilla\Firefox\Profiles\mpazrgl1.default\
.
============= SERVICES / DRIVERS ===============
.
R0 nvpciflt;nvpciflt;C:\Windows\System32\drivers\nvpciflt.sys [2011-9-15 25960]
R1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-5-26 17536]
R1 avkmgr;avkmgr;C:\Windows\System32\drivers\avkmgr.sys [2012-10-9 27800]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2012-7-11 140672]
R2 AntiVirMailService;Avira Email Schutz;C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [2012-10-9 379168]
R2 AntiVirSchedulerService;Avira Planer;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2012-10-9 85280]
R2 AntiVirService;Avira Echtzeit-Scanner;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2012-10-9 109344]
R2 AntiVirWebService;Avira Browser-Schutz;C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe [2012-10-9 565024]
R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-3 15416]
R2 ASUS InstantOn;ASUS InstantOn Service;C:\Program Files (x86)\Common Files\InstantOn\InsOnSrv.exe [2011-7-8 88704]
R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgntflt.sys [2012-10-9 98888]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-11-26 399432]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-11-26 676936]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-5-27 378472]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-12-14 2123584]
R2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\System32\drivers\TurboB.sys [2010-4-17 13832]
R3 AiCharger;ASUS Charger Driver;C:\Windows\System32\drivers\AiCharger.sys [2011-9-15 16768]
R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-6-2 128488]
R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-6-2 401896]
R3 AthBTPort;Atheros Virtual Bluetooth Class;C:\Windows\System32\drivers\btath_flt.sys [2011-3-13 36000]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\Windows\System32\drivers\btath_a2dp.sys [2011-3-13 298656]
R3 BTATH_BUS;Atheros Bluetooth Bus;C:\Windows\System32\drivers\btath_bus.sys [2011-3-13 28832]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\Windows\System32\drivers\btath_hcrp.sys [2011-3-13 201376]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\Windows\System32\drivers\btath_lwflt.sys [2011-3-13 55456]
R3 BTATH_RCP;Bluetooth AVRCP Device;C:\Windows\System32\drivers\btath_rcp.sys [2011-3-13 154272]
R3 BtFilter;BtFilter;C:\Windows\System32\drivers\btfilter.sys [2011-3-13 280224]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-8-19 76912]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-11-26 25928]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-11-8 11856]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AmUStor;AM USB Stroage Driver;C:\Windows\System32\drivers\AmUStor.sys [2011-3-18 74840]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-4-13 48488]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
S3 Partner Service;Partner Service;"C:\ProgramData\Partner\Partner.exe" --> C:\ProgramData\Partner\Partner.exe [?]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-18 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2011-2-18 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-2-15 52736]
S3 usbUDisc;usbUDisc;C:\Windows\System32\drivers\USBDrv_AMD64.sys [2012-9-5 17280]
S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-11-12 1255736]
S4 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-9-15 379520]
S4 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-3-13 138400]
S4 AtherosSvc;AtherosSvc;C:\Program Files (x86)\Bluetooth Suite\AdminService.exe [2011-3-13 74912]
S4 Fabs;FABS - Helping agent for MAGIX media database;C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-5-24 1840128]
S4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-4-26 2702848]
S4 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]
S4 Splashtop MDES;Splashtop Meta Data Export Service;C:\ASUS.SYS\SIONExportService.exe [2011-5-10 338208]
S4 TurboBoost;Intel(R) Turbo Boost Technology Monitor;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2010-4-17 134928]
S4 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-9-15 2655768]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-23 57184]
.
=============== Created Last 30 ================
.
2012-12-02 15:42:28	--------	d-----w-	C:\Users\mõder\AppData\Local\Microsoft
2012-12-02 15:32:17	9125352	----a-w-	C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FCD09AD8-96A8-4FF9-9249-2E52CD8306EB}\mpengine.dll
2012-11-27 22:01:18	95208	----a-w-	C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2012-11-27 21:10:41	--------	d-----w-	C:\Users\mäder\AppData\Roaming\SUPERAntiSpyware.com
2012-11-27 21:10:14	--------	d-----w-	C:\ProgramData\SUPERAntiSpyware.com
2012-11-27 21:10:14	--------	d-----w-	C:\Program Files\SUPERAntiSpyware
2012-11-27 18:28:17	--------	d-----w-	C:\Program Files (x86)\Secunia
2012-11-27 06:19:41	--------	d-----w-	C:\ProgramData\Spybot - Search & Destroy
2012-11-27 06:19:31	--------	d-----w-	C:\Program Files (x86)\Spybot - Search & Destroy 2
2012-11-26 18:34:54	--------	d-----w-	C:\Users\mäder\AppData\Roaming\Malwarebytes
2012-11-26 18:34:46	--------	d-----w-	C:\ProgramData\Malwarebytes
2012-11-26 18:34:45	25928	----a-w-	C:\Windows\System32\drivers\mbam.sys
2012-11-26 18:34:45	--------	d-----w-	C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-11-17 17:00:38	2560	----a-w-	C:\Windows\System32\drivers\de-DE\wdf01000.sys.mui
2012-11-17 17:00:37	9728	----a-w-	C:\Windows\System32\Wdfres.dll
2012-11-17 17:00:37	785512	----a-w-	C:\Windows\System32\drivers\Wdf01000.sys
2012-11-17 17:00:37	54376	----a-w-	C:\Windows\System32\drivers\WdfLdr.sys
2012-11-17 16:54:04	87040	----a-w-	C:\Windows\System32\drivers\WUDFPf.sys
2012-11-17 16:54:04	84992	----a-w-	C:\Windows\System32\WUDFSvc.dll
2012-11-17 16:54:04	198656	----a-w-	C:\Windows\System32\drivers\WUDFRd.sys
2012-11-17 16:54:04	194048	----a-w-	C:\Windows\System32\WUDFPlatform.dll
2012-11-17 16:54:03	744448	----a-w-	C:\Windows\System32\WUDFx.dll
2012-11-17 16:54:03	45056	----a-w-	C:\Windows\System32\WUDFCoinstaller.dll
2012-11-17 16:54:03	229888	----a-w-	C:\Windows\System32\WUDFHost.exe
2012-11-16 11:42:14	55296	----a-w-	C:\Windows\System32\dhcpcsvc6.dll
2012-11-16 11:42:14	44032	----a-w-	C:\Windows\SysWow64\dhcpcsvc6.dll
2012-11-16 11:42:14	226816	----a-w-	C:\Windows\System32\dhcpcore6.dll
2012-11-16 11:42:14	193536	----a-w-	C:\Windows\SysWow64\dhcpcore6.dll
2012-11-16 11:40:19	95744	----a-w-	C:\Windows\System32\synceng.dll
2012-11-16 11:40:19	78336	----a-w-	C:\Windows\SysWow64\synceng.dll
.
==================== Find3M  ====================
.
2012-11-13 11:52:08	98888	----a-w-	C:\Windows\System32\drivers\avgntflt.sys
2012-11-11 17:49:33	73656	----a-w-	C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-11-11 17:49:33	697272	----a-w-	C:\Windows\SysWow64\FlashPlayerApp.exe
2012-10-18 18:25:58	3149824	----a-w-	C:\Windows\System32\win32k.sys
2012-10-16 08:38:37	135168	----a-w-	C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38:34	350208	----a-w-	C:\Windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39:52	561664	----a-w-	C:\Windows\apppatch\AcLayers.dll
2012-10-09 18:41:08	27800	----a-w-	C:\Windows\System32\drivers\avkmgr.sys
2012-10-08 11:31:03	2312704	----a-w-	C:\Windows\System32\jscript9.dll
2012-10-08 11:23:52	1392128	----a-w-	C:\Windows\System32\wininet.dll
2012-10-08 11:22:55	1494528	----a-w-	C:\Windows\System32\inetcpl.cpl
2012-10-08 11:18:22	173056	----a-w-	C:\Windows\System32\ieUnatt.exe
2012-10-08 11:17:35	599040	----a-w-	C:\Windows\System32\vbscript.dll
2012-10-08 11:13:33	2382848	----a-w-	C:\Windows\System32\mshtml.tlb
2012-10-08 07:56:24	1800704	----a-w-	C:\Windows\SysWow64\jscript9.dll
2012-10-08 07:48:03	1129472	----a-w-	C:\Windows\SysWow64\wininet.dll
2012-10-08 07:47:44	1427968	----a-w-	C:\Windows\SysWow64\inetcpl.cpl
2012-10-08 07:44:05	142848	----a-w-	C:\Windows\SysWow64\ieUnatt.exe
2012-10-08 07:43:21	420864	----a-w-	C:\Windows\SysWow64\vbscript.dll
2012-10-08 07:40:56	2382848	----a-w-	C:\Windows\SysWow64\mshtml.tlb
2012-10-03 17:56:54	1914248	----a-w-	C:\Windows\System32\drivers\tcpip.sys
2012-10-03 17:44:21	70656	----a-w-	C:\Windows\System32\nlaapi.dll
2012-10-03 17:44:21	303104	----a-w-	C:\Windows\System32\nlasvc.dll
2012-10-03 17:44:17	246272	----a-w-	C:\Windows\System32\netcorehc.dll
2012-10-03 17:44:17	18944	----a-w-	C:\Windows\System32\netevent.dll
2012-10-03 17:44:16	216576	----a-w-	C:\Windows\System32\ncsi.dll
2012-10-03 17:42:16	569344	----a-w-	C:\Windows\System32\iphlpsvc.dll
2012-10-03 16:42:24	18944	----a-w-	C:\Windows\SysWow64\netevent.dll
2012-10-03 16:42:24	175104	----a-w-	C:\Windows\SysWow64\netcorehc.dll
2012-10-03 16:42:23	156672	----a-w-	C:\Windows\SysWow64\ncsi.dll
2012-10-03 16:07:26	45568	----a-w-	C:\Windows\System32\drivers\tcpipreg.sys
2012-09-29 20:37:31	821736	----a-w-	C:\Windows\SysWow64\npDeployJava1.dll
2012-09-29 20:37:31	746984	----a-w-	C:\Windows\SysWow64\deployJava1.dll
2012-09-29 20:23:09	108008	----a-w-	C:\Windows\System32\WindowsAccessBridge-64.dll
2012-09-29 20:23:08	916456	----a-w-	C:\Windows\System32\deployJava1.dll
2012-09-29 20:23:08	1034216	----a-w-	C:\Windows\System32\npDeployJava1.dll
2012-09-14 19:19:29	2048	----a-w-	C:\Windows\System32\tzres.dll
2012-09-14 18:28:53	2048	----a-w-	C:\Windows\SysWow64\tzres.dll
2012-09-05 18:50:45	17280	----a-w-	C:\Windows\System32\drivers\USBDrv_AMD64.sys
.
============= FINISH: 16:43:38.83 ===============
         
--- --- ---



attach.txt
Code:
ATTFilter
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium 
Boot Device: \Device\HarddiskVolume2
Install Date: 11.11.2011 10:22:55
System Uptime: 02.12.2012 16:36:15 (0 hours ago)
.
Motherboard: ASUSTeK Computer Inc. |  | N55SF
Processor: Intel(R) Core(TM) i7-2670QM CPU @ 2.20GHz | CPU 1 | 880/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 259 GiB total, 186.239 GiB free.
D: is FIXED (NTFS) - 312 GiB total, 148.812 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {36fc9e60-c465-11cf-8056-444553540000}
Description: USB Device(VID_1f3a_PID_efe8)
Device ID: ROOT\USB\0000
Manufacturer: USB Devices
Name: USB Device(VID_1f3a_PID_efe8)
PNP Device ID: ROOT\USB\0000
Service: usbUDisc
.
==== System Restore Points ===================
.
RP161: 17.11.2012 17:52:11 - Windows Update
RP162: 20.11.2012 20:31:35 - Windows Update
RP163: 24.11.2012 13:29:39 - Windows Update
RP164: 02.12.2012 16:31:34 - Windows Update
.
==== Image File Execution Options =============
.
IFEO: AcroRd32.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: asusvibelauncher.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: backache.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: backbone.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: cdprinter.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: fancystart.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: fastboot.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: fpassist.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: fpjoin.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: fpucnfg.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: freepdf.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: isuspm.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: labelprint.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: mediaespresso.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: musiceditor.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: olrsubmission.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: pdfreader.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: pdr8.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: pdvdlaunchpolicy.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: photodesigner.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: power2go.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: power2goexpress.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: powerstarter.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: quickstart.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: sbase.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: scalc.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: sdraw.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: setup.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: simpress.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: skype.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: smath.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: soffice.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: swriter.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: videodeluxe.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
IFEO: video_deluxe_17_plus_sonderedition_de-de_setup.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: AcroRd32.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: asusvibelauncher.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: backache.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: backbone.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: cdprinter.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: fancystart.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: fastboot.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: fpassist.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: fpjoin.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: fpucnfg.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: freepdf.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: isuspm.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: labelprint.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: mediaespresso.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: musiceditor.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: olrsubmission.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: pdfreader.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: pdr8.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: pdvdlaunchpolicy.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: photodesigner.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: power2go.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: power2goexpress.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: powerstarter.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: quickstart.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: sbase.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: scalc.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: sdraw.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: setup.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: simpress.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: skype.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: smath.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: soffice.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: swriter.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: videodeluxe.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
x64-IFEO: video_deluxe_17_plus_sonderedition_de-de_setup.exe - "C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe"
.
==== Installed Programs ======================
.
??? ActiveX ?? Windows Live Mesh ???? ??????? ???????
???? ??? Windows Live
???? ???? ActiveX ????? ?? Windows Live Mesh ????????? ???????
???? Windows Live
????? Windows Live
?????? ??????? ?? Windows Live
??????? ?????????? Windows Live Mesh ActiveX ??? ????????? ???????????
??????? Windows Live Mesh ActiveX ???
???????? ?????????? Windows Live
?????????? Windows Live
ACDSee Pro 5
Adobe Digital Editions
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.3) - Deutsch
Alcor Micro USB Card Reader
Allway Sync version 12.0.0
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Asmedia ASM104x USB 3.0 Host Controller Driver
ASUS AI Recovery
ASUS FancyStart
ASUS LifeFrame3
ASUS Live Update
ASUS Music Maker
ASUS Power4Gear Hybrid
ASUS SmartLogon
ASUS Splendid Video Enhancement Technology
ASUS USB Charger Plus
ASUS Video Magic
ASUS Virtual Camera
ASUS WebStorage
AsusScr_N5_En
AsusVibe2.0
Atheros Client Installation Program
ATK Package
Avira Antivirus Premium
Bluetooth Win7 Suite (64)
Bonjour
Contrôle ActiveX Windows Live Mesh pour connexions à distance
Control ActiveX de Windows Live Mesh para conexiones remotas
Controlo ActiveX do Windows Live Mesh para Ligações Remotas
CyberLink LabelPrint
CyberLink MediaEspresso
CyberLink Power2Go
CyberLink PowerDirector
CyberLink PowerDVD 10
D3DX10
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Fast Boot
FileZilla Client 3.5.3
Firebird SQL Server - MAGIX Edition
Free Audio Converter version 5.0.6.221
FreePDF (Remove only)
Galeria de Fotografias do Windows Live
Galerie de photos Windows Live
Galería fotográfica de Windows Live
Google Chrome
Google Toolbar for Internet Explorer
Google Update Helper
GPL Ghostscript
Hotel Dash Suite Success
iCloud
ifolor Bestellsoftware 3.7
ifolor Designer
Incomedia WebSite X5 v8 - Evolution
IncrediMail
IncrediMail 2.0
InstantOn for NB
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) Turbo Boost Technology Monitor
IrfanView (remove only)
iTunes
Java 7 Update 7 (64-bit)
Java 7 Update 9
Java Auto Updater
Java(TM) 6 Update 30
JavaFX 2.1.1
Junk Mail filter update
MAGIX Fotos auf DVD MX Deluxe
MAGIX Screenshare
MAGIX Speed burnR (MSI)
MAGIX Video deluxe 17 Plus Sonderedition
MAGIX Video deluxe 17 Plus Sonderedition Video Plugins
Malwarebytes Anti-Malware Version 1.65.1.1000
Mesh Runtime
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Client Profile DEU Language Pack
Microsoft Application Error Reporting
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010
Microsoft Office Excel MUI (German) 2010
Microsoft Office Groove MUI (German) 2010
Microsoft Office InfoPath MUI (German) 2010
Microsoft Office Office 64-bit Components 2010
Microsoft Office OneNote MUI (German) 2010
Microsoft Office Outlook MUI (German) 2010
Microsoft Office PowerPoint MUI (German) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (German) 2010
Microsoft Office Proof (Italian) 2010
Microsoft Office Proofing (German) 2010
Microsoft Office Publisher MUI (German) 2010
Microsoft Office Shared 64-bit MUI (German) 2010
Microsoft Office Shared MUI (German) 2010
Microsoft Office Word MUI (German) 2010
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
Mozilla Firefox 15.0.1 (x86 de)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2721691)
MSXML 4.0 SP3 Parser (KB973685)
Music Now!
Nero 7 Essentials
Nuance PDF Reader
NVIDIA 3D Vision Driver 268.74
NVIDIA Control Panel 268.74
NVIDIA Graphics Driver 268.74
NVIDIA HD Audio Driver 1.2.22.1
NVIDIA Install Application
NVIDIA Optimus 1.0.23
NVIDIA Stereoscopic 3D Driver
NVIDIA Update Components
PDFCreator
pdfforge Toolbar v5.1
Photo Notifier and Animation Creator
Raccolta foto di Windows Live
Realtek High Definition Audio Driver
RedMon - Redirection Port Monitor
S?????? f?t???af??? t?? Windows Live
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)
Security Update for Microsoft Excel 2010 (KB2597126) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2687417) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2687436) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553260) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589322) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2597986) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft Visio Viewer 2010 (KB2598287) 32-Bit Edition
Security Update for Microsoft Word 2010 (KB2553488) 32-Bit Edition
SilentInstall
Skype™ 5.10
SonicMaster
St???e?? e?????? ActiveX t?? Windows Live Mesh ??a ap?µa???sµ??e? s??d?se??
SUPERAntiSpyware
Synaptics Pointing Device Driver
syncables desktop SE
TuneUp Utilities 2012
TuneUp Utilities Language Pack (de-DE)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553272) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2687277) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
Vasco da Gama 4 HDPro
Windows-Treiberpaket - OLYMPUS IMAGING CORP. Camera Communication Driver Package (09/09/2009 1.0.0.0)
Windows Live
Windows Live ???
Windows Live ????
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Fotogalerie
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinFlash
Wireless Console 3
WN111v2
.
==== End Of File ===========================
         
Bin gespannt auf die weiteren Schrite. Tausend Dank!!!

LG
__________________

Alt 02.12.2012, 16:54   #4
ryder
/// TB-Ausbilder
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



Gut.

Schritt 1:
Dann Deinstalliere SUPERAntiSpyware und Tuneup.

Schritt 2:
Scan mit Combofix
Zitat:
WARNUNG:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________
Digitale Freibeuter gegen Malware!
Keine Hilfe per PM!

Alt 02.12.2012, 16:59   #5
drud
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



Danke.

Eine Verständnis-Frage: was passiert, wenn ich Tuneup deinstalliere? Damit wurden ja einige Einstellungen am PC angepasst... Kann ich das einfach so ohne weiteres deinstallieren?


Alt 02.12.2012, 17:00   #6
ryder
/// TB-Ausbilder
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



Ja es kann sein, dass es deinen PC schon vermurkst hat. Also schnell weg damit.
__________________
--> Polizei-Trojaner (Schweiz) - ist er schon weg?

Alt 02.12.2012, 17:01   #7
drud
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



OK. Ich dachte immer, das sei was gutes Ich machs weg, danke! Lege jetzt gleich los...

Sollte ich meine Daten vorher noch sichern? also zumindest das D-Laufwerk (dort ist das wichtigste drauf). Oder passiert da nichts?

Alt 02.12.2012, 17:03   #8
ryder
/// TB-Ausbilder
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



Warum hast du das gedacht? Weil es bunt ist? WEG damit ...
__________________
Digitale Freibeuter gegen Malware!
Keine Hilfe per PM!

Alt 02.12.2012, 17:05   #9
drud
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Ausrufezeichen

Polizei-Trojaner (Schweiz) - ist er schon weg?



Ich bin eine Frau -> weil es mir empfohlen wurde

Wie gesagt, ich machs jetzt grad weg. Aber passiert meinen Daten auf dem D-Laufwerk nichts? (ist mir sehr wichtig, danke!)

Muss ich bei der Deinstallation von Tuneup etwas spezielles beachten?

Hilfe: Superantispyware fragt bei der Deinstallation:

Do you wish to remove all programm settigs, logs and quarantined items?

Ja oder Nein?

Alt 02.12.2012, 17:10   #10
ryder
/// TB-Ausbilder
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



ja alles weg weg weg!!
__________________
Digitale Freibeuter gegen Malware!
Keine Hilfe per PM!

Alt 02.12.2012, 17:35   #11
drud
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



Schritt 1: erledigt (Deinstallation Tuneup und Superantispyware)

Schritt 2: erledigt

Code:
ATTFilter
ComboFix 12-12-01.02 - mäder 02.12.2012  17:22:23.1.8 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.41.1031.18.8096.5717 [GMT 1:00]
ausgeführt von:: c:\users\mõder\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\windows\msvcr71.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-11-02 bis 2012-12-02  ))))))))))))))))))))))))))))))
.
.
2012-12-02 16:27 . 2012-12-02 16:27	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2012-12-02 16:27 . 2012-12-02 16:27	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-12-02 16:15 . 2012-12-02 16:15	76232	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{FCD09AD8-96A8-4FF9-9249-2E52CD8306EB}\offreg.dll
2012-12-02 15:42 . 2012-12-02 15:42	--------	d-----w-	c:\users\mõder
2012-12-02 15:32 . 2012-11-19 00:01	9125352	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{FCD09AD8-96A8-4FF9-9249-2E52CD8306EB}\mpengine.dll
2012-11-27 22:01 . 2012-09-24 22:16	95208	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-11-27 18:29 . 2012-11-27 18:29	--------	d-----w-	c:\users\mäder\AppData\Local\Secunia PSI
2012-11-27 18:28 . 2012-11-27 18:28	--------	d-----w-	c:\program files (x86)\Secunia
2012-11-27 06:19 . 2012-11-27 17:33	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2012-11-27 06:19 . 2012-12-02 15:24	--------	d-----w-	c:\program files (x86)\Spybot - Search & Destroy 2
2012-11-27 06:18 . 2012-11-27 06:18	--------	d-----w-	c:\users\mäder\AppData\Local\Programs
2012-11-26 18:34 . 2012-11-26 18:34	--------	d-----w-	c:\users\mäder\AppData\Roaming\Malwarebytes
2012-11-26 18:34 . 2012-11-26 18:34	--------	d-----w-	c:\programdata\Malwarebytes
2012-11-26 18:34 . 2012-11-26 18:34	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-11-26 18:34 . 2012-09-29 18:54	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-11-17 17:00 . 2012-07-26 07:46	2560	----a-w-	c:\windows\system32\drivers\de-DE\wdf01000.sys.mui
2012-11-17 17:00 . 2012-07-26 04:55	785512	----a-w-	c:\windows\system32\drivers\Wdf01000.sys
2012-11-17 17:00 . 2012-07-26 04:55	54376	----a-w-	c:\windows\system32\drivers\WdfLdr.sys
2012-11-17 17:00 . 2012-07-26 02:36	9728	----a-w-	c:\windows\system32\Wdfres.dll
2012-11-17 16:54 . 2012-07-26 03:08	84992	----a-w-	c:\windows\system32\WUDFSvc.dll
2012-11-17 16:54 . 2012-07-26 03:08	194048	----a-w-	c:\windows\system32\WUDFPlatform.dll
2012-11-17 16:54 . 2012-07-26 02:26	87040	----a-w-	c:\windows\system32\drivers\WUDFPf.sys
2012-11-17 16:54 . 2012-07-26 02:26	198656	----a-w-	c:\windows\system32\drivers\WUDFRd.sys
2012-11-17 16:54 . 2012-07-26 03:08	229888	----a-w-	c:\windows\system32\WUDFHost.exe
2012-11-17 16:54 . 2012-07-26 03:08	744448	----a-w-	c:\windows\system32\WUDFx.dll
2012-11-17 16:54 . 2012-07-26 03:08	45056	----a-w-	c:\windows\system32\WUDFCoinstaller.dll
2012-11-16 11:42 . 2012-10-09 18:17	55296	----a-w-	c:\windows\system32\dhcpcsvc6.dll
2012-11-16 11:42 . 2012-10-09 18:17	226816	----a-w-	c:\windows\system32\dhcpcore6.dll
2012-11-16 11:42 . 2012-10-09 17:40	44032	----a-w-	c:\windows\SysWow64\dhcpcsvc6.dll
2012-11-16 11:42 . 2012-10-09 17:40	193536	----a-w-	c:\windows\SysWow64\dhcpcore6.dll
2012-11-16 11:40 . 2012-09-25 22:47	78336	----a-w-	c:\windows\SysWow64\synceng.dll
2012-11-16 11:40 . 2012-09-25 22:46	95744	----a-w-	c:\windows\system32\synceng.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-17 16:54 . 2011-11-11 10:15	66395536	----a-w-	c:\windows\system32\MRT.exe
2012-11-13 11:52 . 2012-10-09 21:15	129216	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-11-13 11:52 . 2012-10-09 21:15	98888	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-11-11 17:49 . 2012-09-29 20:19	697272	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-11-11 17:49 . 2011-11-20 11:36	73656	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-16 08:38 . 2012-11-27 18:33	135168	----a-w-	c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-11-27 18:33	350208	----a-w-	c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-11-27 18:33	561664	----a-w-	c:\windows\apppatch\AcLayers.dll
2012-10-09 18:41 . 2012-10-09 21:15	27800	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2012-09-29 20:37 . 2012-07-05 20:07	821736	----a-w-	c:\windows\SysWow64\npDeployJava1.dll
2012-09-29 20:37 . 2011-11-13 19:17	746984	----a-w-	c:\windows\SysWow64\deployJava1.dll
2012-09-29 20:23 . 2012-09-29 20:23	289768	----a-w-	c:\windows\system32\javaws.exe
2012-09-29 20:23 . 2012-09-29 20:23	189416	----a-w-	c:\windows\system32\javaw.exe
2012-09-29 20:23 . 2012-09-29 20:23	108008	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2012-09-29 20:23 . 2012-09-29 20:23	188904	----a-w-	c:\windows\system32\java.exe
2012-09-29 20:23 . 2012-09-29 09:01	916456	----a-w-	c:\windows\system32\deployJava1.dll
2012-09-29 20:23 . 2012-09-29 09:01	1034216	----a-w-	c:\windows\system32\npDeployJava1.dll
2012-09-14 19:19 . 2012-10-09 21:30	2048	----a-w-	c:\windows\system32\tzres.dll
2012-09-14 18:28 . 2012-10-09 21:30	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2012-09-05 18:50 . 2012-09-05 18:50	17280	----a-w-	c:\windows\system32\drivers\USBDrv_AMD64.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
"Syncables"="c:\program files (x86)\syncables\syncables desktop\Syncables.exe" [2010-07-19 370480]
"MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-23 1601536]
"RemoteControl10"="c:\program files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]
"TrayServer"="c:\program files (x86)\MAGIX\Video_deluxe_17_Plus_Sonderedition\TrayServer.exe" [2008-08-07 90112]
"NeroFilterCheck"="c:\program files (x86)\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-11-27 384800]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-4-13 548528]
FancyStart daemon.lnk - c:\windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe [2011-9-15 12862]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "c:\programdata\Nuance\PDF Reader\Ereg\Ereg.ini"
"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE"
"ASUSWebStorage"=c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe /S
"SonicMasterTray"=c:\program files (x86)\ASUS\SonicMaster\SonicMasterTray.exe
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "c:\program files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"                                                                                        
"UpdatePSTShortCut"="c:\program files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe" "c:\program files (x86)\Cyberlink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"                                                                                            
"ACPW05DE"="c:\program files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe" /pid ACPW05DE
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2011-03-18 74840]
R3 DNIMp50a64;DNIMp50a64 NDIS Protocol Driver;c:\windows\system32\Drivers\DNIMp50a64.sys [x]
R3 DNISp50a64;DNISp50a64 NDIS Protocol Driver;c:\windows\system32\Drivers\DNISp50a64.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-04-26 2702848]
R3 Partner Service;Partner Service;c:\programdata\Partner\Partner.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2011-06-09 25960]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-05-26 17536]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-10-09 27800]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2011-01-25 379520]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [2012-11-27 379168]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-11-27 85280]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2012-11-27 565024]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
S2 ASUS InstantOn;ASUS InstantOn Service;c:\program files (x86)\Common Files\InstantOn\InsOnSrv.exe [2011-07-07 88704]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-03-13 138400]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-03-13 74912]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-05-24 1840128]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936]
S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys [2011-02-26 16768]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-06-02 128488]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-06-02 401896]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-03-13 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-03-13 298656]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-03-13 28832]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-03-13 201376]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-03-13 55456]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-03-13 154272]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-03-13 280224]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-08-24 76912]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - TuneUpUtilitiesDrv
.
Inhalt des "geplante Tasks" Ordners
.
2012-12-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-29 17:49]
.
2012-12-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13 02:33]
.
2012-12-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13 02:33]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2010-09-02 08:41	220160	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2010-09-02 08:41	220160	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-03 1580368]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-19 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-19 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-19 439064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.ch/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://asus.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.1.1
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.3.0/GarminAxControl_32.CAB
FF - ProfilePath - c:\users\mäder\AppData\Roaming\Mozilla\Firefox\Profiles\mpazrgl1.default\
FF - ExtSQL: 2012-10-06 14:42; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\mäder\AppData\Roaming\Mozilla\Firefox\Profiles\mpazrgl1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: 2012-11-11 13:30; {EEE6C361-6118-11DC-9C72-001320C79847}; c:\users\mäder\AppData\Roaming\Mozilla\Firefox\Profiles\mpazrgl1.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-SynAsusAcpi - c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe
AddRemove-Incomedia WebSite X5 v8 - Evolution - c:\windows\system32\iwpsetup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.032"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.abr"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ANI\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ani"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.apd"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.arw"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.bay"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.bmp"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.bw"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CR2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.cr2"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CRW\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.crw"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.cs1"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CUR\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.cur"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.dcr"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DCX\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.dcx"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.dib"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.djv"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DJVU\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.djvu"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.dng"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.emf"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.EPS\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.eps"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.erf"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.fff"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.FPX\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.fpx"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.gif"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.hdr"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ICL\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.icl"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.icn"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.IFF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.iff"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ilbm"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.int"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.inta"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.iw4"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.j2c"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.j2k"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jbr"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jfif"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jif"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JP2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jp2"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jpc"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jpe"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jpeg"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-4073853582-3472843793-526417432-1001)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Jpeg"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jpk"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jpx"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.KDC\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.kdc"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.lbm"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.mef"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.mos"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.mrw"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.nef"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.nrw"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ORF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.orf"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PBM\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pbm"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pbr"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PCD\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pcd"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pct"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PCX\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pcx"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pef"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PGM\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pgm"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pic"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pict"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pix"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.png"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PPM\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ppm"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PSD\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.psd"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PSP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.psp"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pspbrush"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pspimage"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.raf"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.RAS\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ras"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.RAW\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.raw"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.rgb"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.rgba"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.rle"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.rsb"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.rw2"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.rwl"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.SGI\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.sgi"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.sr2"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.srf"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.srw"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TGA\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.tga"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.thm"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.tif"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.tiff"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ttc"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ttf"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v50po\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.v50po"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v50pp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.v50pp"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v50ppf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.v50ppf"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.wbm"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WBMP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.wbmp"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.wmf"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.XBM\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.xbm"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.xif"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.xmp"
.
[HKEY_USERS\S-1-5-21-4073853582-3472843793-526417432-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.XPM\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.xpm"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-12-02  17:28:58
ComboFix-quarantined-files.txt  2012-12-02 16:28
.
Vor Suchlauf: 13 Verzeichnis(se), 199'714'603'008 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 199'175'405'568 Bytes frei
.
- - End Of File - - 0E42F7F84351534110929151EFEDCCE3
         
Ein Neustart hat es nicht gemacht/gegeben. Das Avira Antivir habe ich deaktiviert. Bei Malewarebytes habe ich nichts gemacht, da dsa ja nicht automatisch läuft.

Dafür schreibt mir jetzt der Internetexplorer, dass der "geschützte Modus" deaktiviert ist. Ich musste den deaktivieren, weil im aktiven Modus kam eine Meldung, dass niemand sehen könne, was ich mit dieser Seite Schreibe (Sicherheitszeugs).

Alt 02.12.2012, 17:39   #12
ryder
/// TB-Ausbilder
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



Gut soweit, dann schauen wir noch nach einer Sache:

Customscan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die OTL.exe.
  • Stelle folgendes ein:
    • Haken bei "Alle Benutzer scannen" und "Inklusive 64bit Scans"
    • Ausgabe: Minimal
    • Benutze SafeList in jedem Feld.
    • Haken bei "Benutze Hersteller-Whitelist"
    • Dateien erstellt und verändert innerhalb Datei-Alter
    • Haken bei LOP Prüfung und Purity Prüfung
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.
Code:
ATTFilter
activex
netsvcs
msconfig
drivers32
safebootminimal
safebootnetwork
%SYSTEMDRIVE%\*.
%SYSTEMDRIVE%\*.*
%PROGRAMFILES%\*.*
%PROGRAMFILES(X86)%\*.*
%appdata%\*. 
%appdata%\*.* 
%localappdata%\*. 
%localappdata%\*.*
%allusersprofile%\*. 
%allusersprofile%\*.*
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Scan Button.
  • Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread (möglichst in CODE-Tags)
__________________
Digitale Freibeuter gegen Malware!
Keine Hilfe per PM!

Alt 02.12.2012, 17:45   #13
drud
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



Du ich bin nicht sicher, ob ich das schaffe. das ist bei mir alles auf englisch im OTL.

Also:

Processes,Services, Drivers, Standard Registry und Extra Registry: Use SafeList

Modules: No Company Name (da könte ich noch None oder All einstellen)???

Scan All Users und Include 64bit Scans sind aktiviert. Ebenfalls Minimal Output.

File Age: 30 Days
Use Company-Name WitheList ist aktiviert.

Da istaber auch aktiviert: Use No-Company-Name WhiteList???

Files createt withhin: File Age

Files Modified Within: FileAge

LOP Check und Purity Check habe ich aktiviert.

Was heisst, alle Programme schliessen? Auch Antivir deaktivieren? Oder wie kann ich das ganz schliessen?

Das verstehe ich nicht:

Kopiere nun den Inhalt aus der Codebox in die Textbox. Was muss ich da genau tun, wie geht das?

Alt 02.12.2012, 18:34   #14
ryder
/// TB-Ausbilder
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



Mache bitte nur das was da auch steht. Du kopierst das aus der orangenen Box in OTL hinein.
__________________
Digitale Freibeuter gegen Malware!
Keine Hilfe per PM!

Alt 02.12.2012, 18:47   #15
drud
 
Polizei-Trojaner (Schweiz) - ist er schon weg? - Standard

Polizei-Trojaner (Schweiz) - ist er schon weg?



ja das versuche ich, aber ich bin bei den fett markierten fragen unsicher.

ich habe jetzt einen printscreen gemacht, wie das fenster bei mir aussieht. habe ich alles richtig angekreuzt? ich verstehe nicht alles, da englisch.

vielen dank!

wenn ich alles richtig markiert habe, dann kopiere ich den text, den du in die gelbe box gestellt hast, dort unten in das fenster von OTL rein.

Antwort

Themen zu Polizei-Trojaner (Schweiz) - ist er schon weg?
abgebrochen, antivir, avira, avira antivir, baidu, daten, ebanking, einträge, folge, foto, gelöscht, gesperrt, guten, hilfe!, internet, laptop, laufwerk, logfiles, nicht mehr, nichts, pdfforge toolbar, programme, registry key, registry value, schweiz, sicherheit, startbildschirm, systemwiederherstellung, user agent, webcam, windows, yandex



Ähnliche Themen: Polizei-Trojaner (Schweiz) - ist er schon weg?


  1. Warnung vor E-Banking Trojaner "Dyre" in der Schweiz
    Diskussionsforum - 11.05.2015 (2)
  2. Interpol-Virus (BKA Trojaner Schweiz)
    Log-Analyse und Auswertung - 02.04.2014 (5)
  3. Interpol Trojaner Windows 7 64 Bit , Schweiz
    Log-Analyse und Auswertung - 05.02.2014 (8)
  4. Fedpol Trojaner Schweiz FRST Analyse
    Plagegeister aller Art und deren Bekämpfung - 17.11.2013 (16)
  5. Cibs pol (schweiz)
    Log-Analyse und Auswertung - 29.05.2013 (26)
  6. Polizei Trojaner Schweiz
    Log-Analyse und Auswertung - 20.05.2013 (9)
  7. Polizei Trojaner Schweiz - Laptop kann nicht mehr gebootet werden
    Log-Analyse und Auswertung - 11.04.2013 (6)
  8. Trojaner Schweiz Polizei Cyber Crime Investigation
    Plagegeister aller Art und deren Bekämpfung - 03.02.2013 (25)
  9. Schweiz. Eidgenossenschaft Polizei Cybercrime Investigation Department Trojaner
    Plagegeister aller Art und deren Bekämpfung - 22.01.2013 (14)
  10. Cybercrime Investigation Department Virus Schweiz
    Plagegeister aller Art und deren Bekämpfung - 17.12.2012 (31)
  11. Cyber Crime Investigation Department Schweiz
    Plagegeister aller Art und deren Bekämpfung - 27.11.2012 (13)
  12. Polizei Cybercrimeinvestigation Virus- Schweiz
    Log-Analyse und Auswertung - 27.11.2012 (21)
  13. Computer von "Cyber-Polizei Schweiz" gesperrt
    Log-Analyse und Auswertung - 11.11.2012 (26)
  14. Cyber Polizei Österreich auf WIN7 bei anderem Account, OLT schon gelaufen
    Log-Analyse und Auswertung - 27.10.2012 (2)
  15. Schon wieder Polizei-Trojaner
    Plagegeister aller Art und deren Bekämpfung - 15.09.2012 (5)
  16. Bundespolizei Trojaner Schweiz
    Plagegeister aller Art und deren Bekämpfung - 30.08.2012 (4)
  17. Bericht: Dresdner Polizei wertete schon 2010 Handydaten aus
    Nachrichten - 23.07.2011 (0)

Zum Thema Polizei-Trojaner (Schweiz) - ist er schon weg? - Guten Abend zusammen Wir haben am Montag, also vor zwei Tagen (26.11.12), den Polizei-Trojaner aufgelesen, der hat sogar ein Foto mit der Webcam gemacht! Da der Laptop sozusagen gesperrt war, - Polizei-Trojaner (Schweiz) - ist er schon weg?...
Archiv
Du betrachtest: Polizei-Trojaner (Schweiz) - ist er schon weg? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.