Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Probleme mit verschiedenen Funden (https://www.trojaner-board.de/104310-probleme-verschiedenen-funden.html)

cosinus 20.10.2011 20:35
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

JasonVorhees 20.10.2011 20:49
hier der combofix log:
Combofix Logfile:
Code:
ComboFix 11-10-20.05 - xxx 20.10.2011  21:41:51.2.2 - x86
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.3067.2093 [GMT 2:00]
ausgeführt von:: c:\users\standard\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-09-20 bis 2011-10-20  ))))))))))))))))))))))))))))))
.
.
2011-10-20 19:45 . 2011-10-20 19:45        --------        d-----w-        c:\users\Public\AppData\Local\temp
2011-10-20 19:45 . 2011-10-20 19:45        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-10-20 19:45 . 2011-10-20 19:45        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2011-10-20 18:08 . 2011-10-20 18:08        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{51BCE1A2-A755-4FAD-9141-025295B533B3}\offreg.dll
2011-10-20 18:02 . 2011-10-20 19:01        --------        d-----w-        C:\_OTL
2011-10-19 14:35 . 2011-10-03 00:53        611224        ----a-w-        c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-10-18 17:18 . 2011-09-12 23:14        7269712        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{51BCE1A2-A755-4FAD-9141-025295B533B3}\mpengine.dll
2011-10-14 15:23 . 2011-10-14 15:23        --------        d-----w-        c:\users\standard\AppData\Roaming\Avira
2011-10-14 15:23 . 2011-10-11 13:00        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2011-10-14 15:23 . 2011-10-11 13:00        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2011-10-14 15:23 . 2011-10-11 13:00        134344        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2011-10-14 15:23 . 2011-10-14 15:23        --------        d-----w-        c:\programdata\Avira
2011-10-14 15:23 . 2011-10-14 15:23        --------        d-----w-        c:\program files\Avira
2011-10-13 14:52 . 2011-08-27 04:26        571904        ----a-w-        c:\windows\system32\oleaut32.dll
2011-10-13 14:52 . 2011-08-27 04:26        233472        ----a-w-        c:\windows\system32\oleacc.dll
2011-10-13 14:52 . 2011-08-17 04:24        465408        ----a-w-        c:\windows\system32\psisdecd.dll
2011-10-13 14:52 . 2011-08-17 04:19        75776        ----a-w-        c:\windows\system32\psisrndr.ax
2011-10-13 14:52 . 2011-09-06 02:28        2334720        ----a-w-        c:\windows\system32\win32k.sys
2011-09-30 15:55 . 2011-09-30 15:55        --------        d-----w-        c:\users\xxx\AppData\Roaming\Skype
2011-09-23 11:21 . 2011-09-23 11:21        --------        d-----w-        c:\programdata\vrep
2011-09-23 11:20 . 2011-09-23 11:21        --------        d-----w-        c:\program files\V-REP
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-03 00:50 . 2011-06-01 19:30        544656        ----a-w-        c:\windows\system32\deployJava1.dll
2011-09-30 16:10 . 2011-06-01 19:49        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-31 15:00 . 2011-06-01 18:37        22216        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-08-18 10:05 . 2011-08-18 10:05        446464        ----a-w-        c:\windows\system32\HHActivex.dll
2011-08-05 07:29 . 2011-08-05 07:29        200704        ----a-w-        c:\windows\PLFSetI.exe
2011-09-29 07:09 . 2011-09-30 16:04        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 10:06        163328        --sha-r-        c:\windows\System32\flvDX.dll
2007-02-21 11:47        31232        --sha-r-        c:\windows\System32\msfDX.dll
2008-03-16 13:30        216064        --sha-r-        c:\windows\System32\nbDX.dll
2010-01-06 22:00        107520        --sha-r-        c:\windows\System32\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-08-05 2424192]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-07-29 17361032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-28 13797920]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"PLFSetI"="c:\windows\PLFSetI.exe" [2011-08-05 200704]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-05-04 252136]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
.
c:\users\standard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-4-19 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-09-23 50424]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-11 36000]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-09-23 144632]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2011-04-19 993848]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2011-04-19 399416]
S3 k57nd60x;Broadcom NetLink (TM)-Gigabit-Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2009-09-15 6114816]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 51715544
*Deregistered* - 51715544
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
HPService        REG_MULTI_SZ          HPSLPSVC
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr
.
.
------- Zusätzlicher Suchlauf -------
.
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ds8wnvyu.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-FoxTab PDF Converter - c:\program files\FoxTabPDFConverter\Uninstall\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-10-20  21:47:42
ComboFix-quarantined-files.txt  2011-10-20 19:47
.
Vor Suchlauf: 18 Verzeichnis(se), 444.146.552.832 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 444.074.909.696 Bytes frei
.
- - End Of File - - 6AACC9957148990B460D1C83A52101A5
--- --- ---

cosinus 20.10.2011 21:00
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

JasonVorhees 20.10.2011 22:17
alles erledigt, hier die logs:


aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-10-20 22:42:20
-----------------------------
22:42:20.215 OS Version: Windows 6.1.7601 Service Pack 1
22:42:20.215 Number of processors: 2 586 0x170A
22:42:20.215 ComputerName: XXX-PC UserName: xxx
22:42:22.211 Initialize success
22:43:49.806 AVAST engine defs: 11102002
22:43:58.168 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
22:43:58.168 Disk 0 Vendor: Hitachi_HTS545050B9A300 PB4OC60F Size: 476940MB BusType: 11
22:44:00.274 Disk 0 MBR read successfully
22:44:00.274 Disk 0 MBR scan
22:44:00.305 Disk 0 Windows 7 default MBR code
22:44:00.367 Disk 0 scanning sectors +976771072
22:44:00.664 Disk 0 scanning C:\Windows\system32\drivers
22:45:08.009 Service scanning
22:45:09.273 Modules scanning
22:46:39.940 Disk 0 trace - called modules:
22:46:39.955 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll PCIIDEX.SYS msahci.sys
22:46:39.971 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861bc3b8]
22:46:39.971 3 CLASSPNP.SYS[8b1be59e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x86095030]
22:46:41.469 AVAST engine scan C:\Windows
22:46:55.384 AVAST engine scan C:\Windows\system32
22:57:45.281 AVAST engine scan C:\Windows\system32\drivers
22:58:06.981 AVAST engine scan C:\Users\xxx
22:58:52.408 AVAST engine scan C:\ProgramData
22:59:40.175 Scan finished successfully
23:08:34.273 Disk 0 MBR has been saved successfully to "C:\Users\standard\Desktop\MBR.dat"
23:08:34.273 The log file has been saved successfully to "C:\Users\standard\Desktop\aswMBR.txt"




OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:41:26 on 20.10.2011

OS: Windows 7  Service Pack 1 (Build 7601), 32-bit
Default Browser: Mozilla Corporation Firefox 7.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\MLCFG32.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\Users\xxx\AppData\Local\Temp\catchme.sys  (File not found)
"kxtdipow" (kxtdipow) - ? - C:\Users\xxx\AppData\Local\Temp\kxtdipow.sys  (Hidden registry entry, rootkit activity | File not found)
"MBAMSwissArmy" (MBAMSwissArmy) - ? - C:\Windows\system32\drivers\mbamswissarmy.sys  (File not found)
"mbr" (mbr) - ? - C:\ComboFix\mbr.sys  (Hidden registry entry, rootkit activity | File not found)
"PSI" (PSI) - "Secunia" - C:\Windows\System32\DRIVERS\psi_mf.sys
"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"UBHelper" (UBHelper) - "NewTech Infosystems Corporation" - C:\Windows\system32\drivers\UBHelper.sys
"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll
{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A} "Enterprise-Projekte" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{5574006C-28F5-4a65-A28C-74DE6BFBE0BB} "Haali Matroska Shell Property Page" - ? - C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{327669A0-59A7-4be9-B99E-1C9F3A57611A} "Haali Matroska Thumbnail Extractor" - ? - C:\Program Files\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll
{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.7.0_01" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\npjpi170_01.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} "Java Plug-in 1.7.0_01" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\npjpi170_01.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.7.0_01" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\npjpi170_01.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "@C:\Windows\WindowsMobile\INetRepl.dll,-222" - "Microsoft Corporation" - C:\Windows\WindowsMobile\INetRepl.dll
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\Windows\WindowsMobile\INetRepl.dll
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Smart Web Printing ein- oder ausblenden" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{0347C33E-8762-4905-BF09-768834316C61} "HP Print Enhancer" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2ssv.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{2EECD738-5844-4a99-B4B6-146BF802613B} "{2EECD738-5844-4a99-B4B6-146BF802613B}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe  (Shortcut exists | File exists)
"Secunia PSI Tray.lnk" - "Secunia" - C:\Program Files\Secunia\PSI\psi_tray.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
"SUPERAntiSpyware" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"HP Software Update" - "Hewlett-Packard" - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"hpqSRMon" - "Hewlett-Packard" - C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
"PLFSetI" - ? - C:\Windows\PLFSetI.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Redmon" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
"HP Network Devices Support" (HPSLPSVC) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll
"NTI Backup Now 5 Backup Service" (NTIBackupSvc) - "NewTech InfoSystems, Inc." - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
"NTI Backup Now 5 Scheduler Service" (NTISchedulerSvc) - "NewTech Infosystems, Inc." - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll
"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
"Secunia PSI Agent" (Secunia PSI Agent) - "Secunia" - C:\Program Files\Secunia\PSI\PSIA.exe
"Secunia Update Agent" (Secunia Update Agent) - "Secunia" - C:\Program Files\Secunia\PSI\sua.exe

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 21.10.2011 13:10
GMER ging nicht?

JasonVorhees 21.10.2011 16:30
doch ging schon aber der log wurde nicht gespeichert habs nochmal durchlaufen lassen:
GMER Logfile:
Code:
GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-10-21 17:28:27
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS545050B9A300 rev.PB4OC60F
Running: wdyi2xk9.exe; Driver: C:\Users\xxx\AppData\Local\Temp\kxtdipow.sys


---- System - GMER 1.0.15 ----

SSDT            90C481DE                                                                                          ZwCreateSection
SSDT            90C481E8                                                                                          ZwRequestWaitReplyPort
SSDT            90C481E3                                                                                          ZwSetContextThread
SSDT            90C481ED                                                                                          ZwSetSecurityObject
SSDT            90C481F2                                                                                          ZwSystemDebugControl
SSDT            90C4817F                                                                                          ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwSaveKey + 13D1                                                                      82C79349 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                            82CB2D52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text          ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                82CB9EAC 4 Bytes  [DE, 81, C4, 90]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                82CBA208 4 Bytes  [E8, 81, C4, 90]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                82CBA24C 4 Bytes  [E3, 81, C4, 90]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                82CBA2C8 4 Bytes  [ED, 81, C4, 90]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                82CBA31C 4 Bytes  [F2, 81, C4, 90]
.text          ...                                                                                               

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                    [73C42437] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]              [73C25600] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]              [73C256BE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                    [73C424B2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]          [73C38514] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]            [73C34CC8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]            [73C3506F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]          [73C35144] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP]  [73C36671] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]            [73C3826B] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]      [73C387BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]    [73C3901B] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]          [73C3E1BE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2464] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]              [73C34BFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\0000004d                                                                  halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \FileSystem\fastfat \Fat                                                                          fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
--- --- ---

cosinus 22.10.2011 16:00
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


JasonVorhees 22.10.2011 19:24
also hier ersmal malewarebyte und superantispyware, eset folgt.

superanti. hatte einige funde, die 2 letzten sind von einer simulationssoftware, wahrscheinlich fehlalarm?
die cookies hab ich entfernen lassen.




Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 7999

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

22.10.2011 20:04:48
mbam-log-2011-10-22 (20-04-48).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|G:\|P:\|)
Durchsuchte Objekte: 315818
Laufzeit: 1 Stunde(n), 49 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 10/22/2011 at 07:27 PM

Application Version : 5.0.1134

Core Rules Database Version : 7837
Trace Rules Database Version: 5649

Scan type : Complete Scan
Total Scan Time : 01:09:45

Operating System Information
Windows 7 Professional 32-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned : 764
Memory threats detected : 0
Registry items scanned : 40318
Registry threats detected : 0
File items scanned : 45733
File threats detected : 295

Adware.Tracking Cookie
C:\USERS\STANDARD\AppData\Roaming\Microsoft\Windows\Cookies\CF3960Y5.txt [ Cookie:standard@clkads.com/adServe/ ]
C:\USERS\STANDARD\AppData\Roaming\Microsoft\Windows\Cookies\IU9S0IG5.txt [ Cookie:standard@clkads.com/adServe/static/ ]
C:\USERS\STANDARD\AppData\Roaming\Microsoft\Windows\Cookies\WM29VMK0.txt [ Cookie:standard@clkads.com/adServe/banners ]
C:\USERS\STANDARD\Cookies\CF3960Y5.txt [ Cookie:standard@clkads.com/adServe/ ]
C:\USERS\STANDARD\Cookies\IU9S0IG5.txt [ Cookie:standard@clkads.com/adServe/static/ ]
C:\USERS\STANDARD\Cookies\WM29VMK0.txt [ Cookie:standard@clkads.com/adServe/banners ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\M8BQDVMN.txt [ Cookie:xxx@events.webflowmetrics.com/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\62LBW23V.txt [ Cookie:xxx@babylon.com/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@www.vodafone[1].txt [ Cookie:xxx@www.vodafone.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@windows.microsoft[1].txt [ Cookie:xxx@windows.microsoft.com/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@lead-alliance[2].txt [ Cookie:xxx@lead-alliance.net/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@adsfac[2].txt [ Cookie:xxx@adsfac.eu/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@o2online[1].txt [ Cookie:xxx@o2online.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@active-srv02[1].txt [ Cookie:xxx@active-srv02.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@advolution[2].txt [ Cookie:xxx@advolution.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@gmads[2].txt [ Cookie:xxx@gmads.net/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@msn[1].txt [ Cookie:xxx@msn.com/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@mlsat02[1].txt [ Cookie:xxx@mlsat02.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@openxm02.ipxmuc-a.cxo[2].txt [ Cookie:xxx@openxm02.ipxmuc-a.cxo.name/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@adscale[1].txt [ Cookie:xxx@adscale.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@www1.mpnrs[2].txt [ Cookie:xxx@www1.mpnrs.com/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@dslshop.vodafone[1].txt [ Cookie:xxx@dslshop.vodafone.de/eshop ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@adyard[1].txt [ Cookie:xxx@adyard.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@flashtalking[2].txt [ Cookie:xxx@flashtalking.com/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@alice-dsl[1].txt [ Cookie:xxx@alice-dsl.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@bmw[1].txt [ Cookie:xxx@bmw.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@herrenausstatter[2].txt [ Cookie:xxx@herrenausstatter.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@chip[2].txt [ Cookie:xxx@chip.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@www.microsoft[1].txt [ Cookie:xxx@www.microsoft.com/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@admax.quisma[1].txt [ Cookie:xxx@admax.quisma.com/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@refinedads[2].txt [ Cookie:xxx@refinedads.com/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@ih.adscale[3].txt [ Cookie:xxx@ih.adscale.de/adscale-ih/impr ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@ih.adscale[2].txt [ Cookie:xxx@ih.adscale.de/adscale-ih/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@www.kdukvh[1].txt [ Cookie:xxx@www.kdukvh.com/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@ivwbox[2].txt [ Cookie:xxx@ivwbox.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@nuggad[1].txt [ Cookie:xxx@nuggad.net/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@dsl.1und1[1].txt [ Cookie:xxx@dsl.1und1.de/ ]
C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxx@bing[2].txt [ Cookie:xxx@bing.com/ ]
C:\USERS\XXX\Cookies\M8BQDVMN.txt [ Cookie:xxx@events.webflowmetrics.com/ ]
C:\USERS\XXX\Cookies\62LBW23V.txt [ Cookie:xxx@babylon.com/ ]
.apmebf.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.im.banner.t-online.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.ru4.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
adserver2.web-gear.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
statse.webtrendslive.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
track.effiliation.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adinterax.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.content.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.moviepilot.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.im.banner.t-online.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.moviepilot.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.moviepilot.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.moviepilot.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.clickaider.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
track.adform.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.unitymedia.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.unitymedia.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.unitymedia.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wnkisjczecq.stats.esomniture.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.bs.serving-sys.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.stats4free.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.stats4free.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.stats4free.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
m1.webstats.motigo.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.ad.adnet.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.ad.adnet.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adinterax.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.adition.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.adition.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.content.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.beyond-media.at [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adviva.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.fastclick.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.stepstone.112.2o7.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.paypal.112.2o7.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.stats.paypal.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.lucidmedia.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.zanox-affiliate.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.dyntracker.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.pornolize.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.pornolize.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.pornolize.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.ru4.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.oracle.112.2o7.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tribalfusion.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.kontera.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
tracking.quisma.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
track.effiliation.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
track.effiliation.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
track.effiliation.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
track.effiliation.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.zanox.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.zanox-affiliate.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
track.adform.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adform.net [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad3.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ads.adxvalue.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ads.adxvalue.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ads.adxvalue.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ads.adxvalue.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ads.adxvalue.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad.adserver01.de [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad1.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad4.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
ad2.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\STANDARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8ACZHZN9.DEFAULT\COOKIES.SQLITE ]

Trojan.Agent/Gen-Krpytik
C:\PROGRAM FILES\MHJ-SOFTWARE\SPS-VISU-V4_8X\S5DBW32.DLL

Adware.Vundo/Variant-X32[Header]
C:\PROGRAM FILES\MHJ-SOFTWARE\SPS-VISU-V4_8X\S7P_RW32.DLL

JasonVorhees 22.10.2011 20:45
und hier der eset log, wider ein fund, wieder in einer simulationssoftware.

die sind aber beide direkt vom hersteller heruntergeladen also nichts illegales oder so.

wäre aber schon ein seltsamer zufall wenn es 2x ein fehlalarm ist oder?

mfg


ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-07-30 06:11:52
# local_time=2011-07-30 08:11:52 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 28156 48579616 20948 0
# compatibility_mode=5893 16776573 100 94 28044 63673986 0 0
# compatibility_mode=8192 67108863 100 0 5085925 5085925 0 0
# scanned=295181
# found=13
# cleaned=0
# scan_time=6737
C:\Windows.old\ProgramData\Microsoft\Windows\Start Menu\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\ProgramData\Startmenü\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\ProgramData\Startmenü\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\Users\All Users\Anwendungsdaten\Microsoft\Windows\Start Menu\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\Users\All Users\Anwendungsdaten\Microsoft\Windows\Start Menu\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\Users\All Users\Anwendungsdaten\Startmenü\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\Users\All Users\Anwendungsdaten\Startmenü\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\Users\All Users\Microsoft\Windows\Start Menu\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\Users\All Users\Microsoft\Windows\Start Menu\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\Users\All Users\Startmenü\Programme\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\Users\All Users\Startmenü\Programs\eBay.url Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
F:\Toolz\Video converter\installer_youtube_flv_to_avi_converter_pro_5_9_80_Deutsch.exe Win32/Hoax.ArchSMS.KC application (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-06 11:52:36
# local_time=2011-08-06 01:52:36 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 524007 49165194 93118 0
# compatibility_mode=5893 16776573 100 94 100166 64259564 0 0
# compatibility_mode=8192 67108863 100 0 5671503 5671503 0 0
# scanned=134031
# found=0
# cleaned=0
# scan_time=3204
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-06 12:58:48
# local_time=2011-08-06 02:58:48 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 528477 49169664 97588 0
# compatibility_mode=5893 16776573 100 94 104636 64264034 0 0
# compatibility_mode=8192 67108863 100 0 5675973 5675973 0 0
# scanned=133969
# found=0
# cleaned=0
# scan_time=2706
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-17 06:48:16
# local_time=2011-08-17 08:48:16 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 451777 50143717 96676 0
# compatibility_mode=5893 16776574 100 94 40662 65238087 0 0
# compatibility_mode=8192 67108863 100 0 6650026 6650026 0 0
# scanned=78
# found=0
# cleaned=0
# scan_time=4
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-17 07:39:03
# local_time=2011-08-17 09:39:03 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 451859 50143799 96758 0
# compatibility_mode=5893 16776573 100 94 40744 65238169 0 0
# compatibility_mode=8192 67108863 100 0 6650108 6650108 0 0
# scanned=150728
# found=2
# cleaned=0
# scan_time=2985
C:\Users\standard\AppData\Local\Mozilla\Firefox\Profiles\8aczhzn9.default\Cache\2\89\6B676d01 JS/Kryptik.BT trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\standard\AppData\Local\Mozilla\Firefox\Profiles\8aczhzn9.default\Cache\6\33\9E305d01 JS/Kryptik.BY trojan (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-18 09:06:47
# local_time=2011-08-18 11:06:47 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 8626 50192679 38647 0
# compatibility_mode=5893 16776573 100 94 89624 65287049 0 0
# compatibility_mode=8192 67108863 100 0 6698988 6698988 0 0
# scanned=106550
# found=0
# cleaned=0
# scan_time=2569
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-31 10:57:46
# local_time=2011-08-31 12:57:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 5669 51322609 5091 0
# compatibility_mode=5893 16776573 100 94 12227 66416979 0 0
# compatibility_mode=8192 67108863 100 0 7828918 7828918 0 0
# scanned=111663
# found=1
# cleaned=0
# scan_time=2499
C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe a variant of Win32/InstallCore.B application (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=stopped
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-01 11:52:54
# local_time=2011-09-01 01:52:54 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 95835 51412775 0 0
# compatibility_mode=5893 16776573 100 94 102393 66507145 0 0
# compatibility_mode=8192 67108863 100 0 7919084 7919084 0 0
# scanned=100092
# found=1
# cleaned=1
# scan_time=2020
C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe a variant of Win32/InstallCore.C application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-02 12:12:52
# local_time=2011-09-02 02:12:52 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 10749 51499452 3543 0
# compatibility_mode=5893 16776573 100 94 10639 66593822 0 0
# compatibility_mode=8192 67108863 100 0 8005761 8005761 0 0
# scanned=143485
# found=0
# cleaned=0
# scan_time=2962
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-18 04:00:27
# local_time=2011-09-18 06:00:27 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 22318 52898442 68768 0
# compatibility_mode=5893 16776573 100 94 75768 67992812 0 0
# compatibility_mode=8192 67108863 100 0 9404751 9404751 0 0
# scanned=275
# found=0
# cleaned=0
# scan_time=6
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-18 04:56:35
# local_time=2011-09-18 06:56:35 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 22393 52898517 68843 0
# compatibility_mode=5893 16776573 100 94 75843 67992887 0 0
# compatibility_mode=8192 67108863 100 0 9404826 9404826 0 0
# scanned=142259
# found=0
# cleaned=0
# scan_time=3299
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-19 03:24:12
# local_time=2011-10-19 05:24:12 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 429339 429339 0 0
# compatibility_mode=5893 16776573 100 94 2811 70666322 0 0
# compatibility_mode=8192 67108863 100 0 12078261 12078261 0 0
# scanned=119709
# found=2
# cleaned=0
# scan_time=2742
C:\Users\standard\AppData\Local\temp\ICReinstall\cnet_V-REP EVALUATION V2_5_9 Setup_exe.exe a variant of Win32/InstallCore.D application (unable to clean) 00000000000000000000000000000000 I
C:\Users\standard\Desktop\cnet_V-REP EVALUATION V2_5_9 Setup_exe.exe a variant of Win32/InstallCore.D application (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4bb2ef35dbcdf84da7465ebfa3c7e687
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-22 07:31:58
# local_time=2011-10-22 09:31:58 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 702877 702877 0 0
# compatibility_mode=5893 16776573 100 94 534 70939860 0 0
# compatibility_mode=8192 67108863 100 0 12351799 12351799 0 0
# scanned=135072
# found=1
# cleaned=0
# scan_time=3249
C:\Users\standard\Desktop\cnet_V-REP EVALUATION V2_5_9 Setup_exe.exe a variant of Win32/InstallCore.D application (unable to clean) 00000000000000000000000000000000 I

cosinus 23.10.2011 18:16
Zitat:
C:\Users\standard\Desktop\cnet_V-REP EVALUATION V2_5_9 Setup_exe.exe
Was soll das sein, kennst du das?

JasonVorhees 24.10.2011 18:20
hi, sorry dass ich jezt erst schreibe.

ja das ist eine simulationssoftware für roboter.

der andere fund von super, war eine simulationssoftware für sps.

grüße

cosinus 24.10.2011 18:36
Dann ist es ok. Sonst nur Cookies.
Rechner wieder im Lot?

JasonVorhees 24.10.2011 18:48
Eigentlich hatte ich gehofft dass du mir das sagst;)

Ja also Probleme habe ich keine, und malewarebyte etc. Hat auch nicht gemeckert.

Denke es passt alles.

Vielen vielen dank schonmal:). :). :)

cosinus 24.10.2011 18:54
Das ist nur die abschließende Frage wenn ich fertig bin, ich will ja wissen ob das System aus deiner Sicht wieder rund und problemlos läuft :)

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

JasonVorhees 25.10.2011 19:12
Vielen Vielen dank:) :) :)

hast mir wirklich sehr geholfen...

ihr habt wirklich eine top seite mit kompetenten "Helfern" auf die beine gestellt, wirklich top!!!

wünsche noch einen schönen abend.

eine frage hätte ich noch:
Konnte man euch nicht auch per paypal eine spende zukommen lassen oder erinnere ich mich falsch?

mfg


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:37 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131