Trojaner-Board - Mystart Incredibar mit Systemwiederherstellung entfernt

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Mystart Incredibar mit Systemwiederherstellung entfernt - Computer wirklich bereinigt? (https://www.trojaner-board.de/122671-mystart-incredibar-systemwiederherstellung-entfernt-computer-wirklich-bereinigt.html)

Mystart Incredibar mit Systemwiederherstellung entfernt - Computer wirklich bereinigt?

Hallo,

ich habe mir Mystart Incredibar eingefangen, habe das Ganze nun durch eine Systemwiederherstellung entfernt.
Ich weiß aber leider nicht, ob ich es auch wirklich entfernt hab, die Toolbar ist weg und wenn ich einen neuen Tab anklicke kommt auch nicht mehr die Mystart-Seite.

Könnt ihr mir vielleicht helfen herauszufinden ob ich mystart wirklich entfernt habe? Ich kenne mich leider nicht sehr gut aus.
Ich habe hier schon ein ähnliches Thema gelesen, da wurde geantwortet, dass das Ergebnis von Malwarebytes gepostet werden soll, aber dann gab es keine Beiträge mehr.
Ich mach das dann jetzt mal und hoffe verzweifelt auf eure Hilfe:confused:

Ich habe jetzt den vollständigen Suchlauf gestartet und werde anschließend das Ergebnis posten.

Vielen Dank für eure Mühe schon mal im Voraus!

Viele Grüße,
Julia

So hier der erste Bericht:

Code:

 Malwarebytes Anti-Malware (Test) 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.08.23.07
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Julia :: JULIA-TOSH [Administrator]
 

Schutz: Aktiviert
 

23.08.2012 18:00:28

mbam-log-2012-08-23 (18-00-28).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|Q:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 325595

Laufzeit: 38 Minute(n), 47 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 2

HKCR\CLSID\{20C28584-8F10-4D92-987C-0A1008E2435A} (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{20C28584-8F10-4D92-987C-0A1008E2435A} (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Users\Julia\AppData\Roaming\AcroIEHelpe.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Und hier das andere Ergebnis:

Code:

 # AdwCleaner v1.801 - Logfile created 08/23/2012 at 18:48:25

# Updated 14/08/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Julia - JULIA-TOSH

# Boot Mode : Normal

# Running from : C:\Users\Julia\Downloads\adwCleaner1801.exe

# Option [Search]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Found : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\lyfqz9vc.default\extensions\ffxtlbr@incredibar.com

Folder Found : C:\ProgramData\Partner

File Found : C:\Users\Public\Desktop\eBay.lnk
 

***** [Registry] *****
 

[x64] Key Found : HKLM\SOFTWARE\Software
 

***** [Registre - GUID] *****
 

Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}

[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v12.0 (de)
 

Profile name : default 

File : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\lyfqz9vc.default\prefs.js
 

Found : user_pref("extensions.enabledAddons", "ffxtlbr@incredibar.com:1.5.0,{972ce4c6-7e08-4474-a285-3208198[...]
 

*************************
 

AdwCleaner[R1].txt - [1389 octets] - [23/08/2012 18:48:25]
 

########## EOF - C:\AdwCleaner[R1].txt - [1517 octets] ##########

Leider muss ich jetzt gehen und kann erst morgen wieder ins Internet, ich würde mich aber sehr über eure Hilfe freuen. Es ist toll, dass ihr ein solches Forum anbietet!

Viele Grüße,
Julia

:hallo:

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

dann:

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.*

%APPDATA%\*AcroIEH*.*

%APPDATA%\*.exe

%APPDATA%\*.tmp

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hier mein Ergebnis:

Code:

 # AdwCleaner v1.801 - Logfile created 08/24/2012 at 08:08:37

# Updated 14/08/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Julia - JULIA-TOSH

# Boot Mode : Normal

# Running from : C:\Users\Julia\Downloads\adwCleaner1801.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Deleted : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\lyfqz9vc.default\extensions\ffxtlbr@incredibar.com

Folder Deleted : C:\ProgramData\Partner

File Deleted : C:\Users\Public\Desktop\eBay.lnk
 

***** [Registry] *****
 

[x64] Key Deleted : HKLM\SOFTWARE\Software
 

***** [Registre - GUID] *****
 

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v12.0 (de)
 

Profile name : default 

File : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\lyfqz9vc.default\prefs.js
 

Deleted : user_pref("extensions.enabledAddons", "ffxtlbr@incredibar.com:1.5.0,{972ce4c6-7e08-4474-a285-3208198[...]
 

*************************
 

AdwCleaner[R1].txt - [1514 octets] - [23/08/2012 18:48:25]

AdwCleaner[S1].txt - [1346 octets] - [24/08/2012 08:08:37]
 

########## EOF - C:\AdwCleaner[S1].txt - [1474 octets] ##########

und das von OTL

OTL Logfile:

Code:

OTL logfile created on: 24.08.2012 08:18:45 - Run 1

OTL by OldTimer - Version 3.2.58.1     Folder = C:\Users\Julia\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

5,98 Gb Total Physical Memory | 4,35 Gb Available Physical Memory | 72,81% Memory free

11,95 Gb Paging File | 10,09 Gb Available in Paging File | 84,40% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 232,88 Gb Total Space | 168,73 Gb Free Space | 72,45% Space Free | Partition Type: NTFS

Drive D: | 232,49 Gb Total Space | 220,84 Gb Free Space | 94,99% Space Free | Partition Type: NTFS

 

Computer Name: JULIA-TOSH | User Name: Julia | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.08.24 08:15:37 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe

PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Users\Julia\Desktop\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Users\Julia\Desktop\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2012.05.31 15:00:22 | 000,445,624 | ---- | M] (Sony) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe

PRC - [2012.04.30 11:57:42 | 000,067,072 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe

PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.03.29 15:33:08 | 000,598,312 | ---- | M] (Nero AG) -- c:\Program Files (x86)\Nero\Update\NASvc.exe

PRC - [2011.02.01 13:24:42 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

PRC - [2011.02.01 13:24:40 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

PRC - [2010.12.03 14:57:16 | 000,304,560 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

PRC - [2010.08.16 10:54:50 | 000,034,160 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe

PRC - [2010.08.04 17:11:34 | 001,809,920 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe

PRC - [2009.07.28 20:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe

PRC - [2009.03.10 18:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.05.24 11:50:32 | 000,203,776 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll

MOD - [2012.04.30 11:57:42 | 000,067,072 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe

MOD - [2012.04.30 11:57:42 | 000,039,936 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll

MOD - [2012.03.20 15:17:16 | 000,585,728 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\PhoneUpdate.dll

MOD - [2011.11.01 19:32:48 | 000,573,100 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\sqlite3.dll

MOD - [2011.07.07 14:54:36 | 000,233,984 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\Report.dll

MOD - [2010.01.11 16:44:54 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\VObject.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2012.03.26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV:64bit: - [2012.03.26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV:64bit: - [2011.12.09 20:47:40 | 000,334,720 | ---- | M] (FileOpen Systems Inc.) [Auto | Running] -- C:\Program Files\FileOpen\Services\FileOpenManagerSvc64.exe -- (FileOpenManagerSvc)

SRV:64bit: - [2010.12.09 17:45:26 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)

SRV:64bit: - [2010.12.08 15:42:54 | 000,137,632 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)

SRV:64bit: - [2010.10.20 14:41:00 | 000,138,656 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)

SRV:64bit: - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Users\Julia\Desktop\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.05.15 09:44:54 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.01.18 14:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)

SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)

SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)

SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.03.29 15:33:08 | 000,598,312 | ---- | M] (Nero AG) [Auto | Running] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)

SRV - [2011.02.10 09:25:36 | 000,112,080 | ---- | M] (Toshiba Europe GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)

SRV - [2011.02.01 13:24:42 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)

SRV - [2011.02.01 13:24:40 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)

SRV - [2010.11.29 14:58:30 | 000,054,136 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)

SRV - [2010.10.12 19:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)

SRV - [2010.08.04 17:11:34 | 001,809,920 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.01.28 16:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.03.10 18:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.04.27 09:15:06 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)

DRV:64bit: - [2012.04.27 09:15:06 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)

DRV:64bit: - [2012.03.20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.10.04 08:51:48 | 000,020,592 | ---- | M] (Compal Electronics, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CeKbFilter.sys -- (CeKbFilter)

DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)

DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)

DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)

DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)

DRV:64bit: - [2011.05.10 02:41:28 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.02.08 19:07:00 | 000,038,096 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)

DRV:64bit: - [2011.02.03 19:59:06 | 001,413,680 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2011.01.13 20:58:30 | 000,413,800 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.01.12 17:51:44 | 000,439,320 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2011.01.05 01:08:58 | 001,109,096 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)

DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2010.10.19 16:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)

DRV:64bit: - [2010.07.20 17:43:22 | 000,247,400 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV:64bit: - [2010.03.22 10:55:20 | 000,046,192 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)

DRV:64bit: - [2009.07.30 20:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)

DRV:64bit: - [2009.07.14 16:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA

IE - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA

IE - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.update: false

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.juraexamen.com/forum"

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\9\NP_wtapp.dll ()

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.05.15 09:44:54 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2011.12.27 15:20:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julia\AppData\Roaming\mozilla\Extensions

[2012.08.24 08:08:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julia\AppData\Roaming\mozilla\Firefox\Profiles\lyfqz9vc.default\extensions

[2012.07.19 14:03:56 | 000,002,057 | ---- | M] () -- C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\lyfqz9vc.default\searchplugins\youtube-videosuche.xml

[2012.05.20 11:24:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.05.15 09:44:54 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.02.20 10:42:09 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.20 10:42:09 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.02.20 10:42:09 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.20 10:42:09 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.20 10:42:09 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.02.20 10:42:09 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [FileOpenBroker] C:\Program Files\FileOpen\Services\FileOpenBroker64.exe (FileOpen Systems Inc.)

O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [Toshiba Registration] C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe (Toshiba Europe GmbH)

O4:64bit: - HKLM..\Run: [Toshiba TEMPRO] C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)

O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE (TOSHIBA Corporation)

O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)

O4 - HKLM..\Run: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Users\Julia\Desktop\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NBAgent] c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)

O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA)

O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)

O4 - HKU\.DEFAULT..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)

O4 - HKU\S-1-5-18..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)

O4 - HKU\S-1-5-21-2632050956-65084648-1620196704-1000..\Run: [Sony PC Companion] C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Sony)

O4 - HKU\S-1-5-21-2632050956-65084648-1620196704-1000..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1

O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found

O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found

O8:64bit: - Extra context menu item: Zu TOSHIBA Bulletin Board hinzufügen - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Zu TOSHIBA Bulletin Board hinzufügen - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)

O9:64bit: - Extra Button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-229 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom64.dll (TODO: <会社名>)

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom64.dll (TODO: <会社名>)

O9 - Extra Button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-229 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)

O9 - Extra 'Tools' menuitem : @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.4

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{81C079F3-6C8E-4AD9-96FB-933E495C684D}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{920896DE-8F8D-4229-BC80-EEDF677AB83F}: DhcpNameServer = 192.168.1.4

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{a392608c-902e-11e1-8065-b870f4d6f7f0}\Shell - "" = AutoRun

O33 - MountPoints2\{a392608c-902e-11e1-8065-b870f4d6f7f0}\Shell\AutoRun\command - "" = F:\Startme.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

 

 

SafeBootMin:64bit: AppMgmt - Service

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: MCODS - Reg Error: Value error.

SafeBootMin:64bit: MsMpSvc - C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: MCODS - Reg Error: Value error.

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - Service

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: MCODS - Reg Error: Value error.

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: MsMpSvc - C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: MCODS - Reg Error: Value error.

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.08.24 08:16:37 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe

[2012.08.23 17:59:09 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\Malwarebytes

[2012.08.23 17:58:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.08.23 17:58:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.08.23 17:58:54 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.08.23 17:58:54 | 000,000,000 | ---D | C] -- C:\Users\Julia\Desktop\Malwarebytes' Anti-Malware

[2012.08.23 15:47:57 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\YoudaGames

[2012.08.23 15:45:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Perion

[2012.08.14 09:02:37 | 000,000,000 | ---D | C] -- C:\Windows\de

[2012.08.14 09:01:34 | 000,000,000 | ---D | C] -- C:\Windows\fr

[2012.08.14 09:01:28 | 000,000,000 | ---D | C] -- C:\Windows\en

[2012.08.14 09:01:21 | 000,000,000 | ---D | C] -- C:\Windows\it

[2012.08.14 09:01:14 | 000,000,000 | ---D | C] -- C:\Windows\nl

[2012.08.14 08:56:17 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\{DE24A260-BCCC-43B5-A050-62F57A89D7FE}

[2012.08.14 08:56:07 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\{687ACB97-898E-4695-88F1-0CA600F587E5}

[2012.08.14 08:55:12 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\{4C423CC4-5E91-4DA6-A7C1-F2759E01AC19}

[2012.08.14 08:55:02 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\{2EB8A029-5E7F-46CD-A708-CC81FB4ED87E}

[2012.08.14 08:52:32 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\{EE330307-88F8-4CD8-BD36-AAAD55E1D66A}

[2012.08.14 08:52:22 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\{15133041-3877-4E61-928D-9304AD2C74C3}

[2012.08.14 08:44:12 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\Windows Live

[2012.08.14 08:43:55 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\{475869B6-F4B7-466D-9CDC-EB4FD0A9F5C1}

[2012.08.14 08:43:55 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\{0B7CE222-F7E9-40B2-AEAA-DBBA601788D6}

[2012.08.14 08:43:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony Media Go Install

[2012.08.14 08:43:12 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\Sony

[1 C:\Users\Julia\AppData\Roaming\*.tmp files -> C:\Users\Julia\AppData\Roaming\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.08.24 08:17:19 | 000,024,912 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.08.24 08:17:19 | 000,024,912 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.08.24 08:15:37 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe

[2012.08.24 08:13:01 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.08.24 08:10:32 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.08.24 08:09:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.08.24 08:09:46 | 519,380,991 | -HS- | M] () -- C:\hiberfil.sys

[2012.08.24 07:58:06 | 000,414,968 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.08.23 17:58:59 | 000,000,793 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.08.16 18:56:56 | 001,506,902 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.08.16 18:56:56 | 000,656,972 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.08.16 18:56:56 | 000,618,814 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.08.16 18:56:56 | 000,131,454 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.08.16 18:56:56 | 000,107,836 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.08.16 08:33:24 | 000,002,033 | ---- | M] () -- C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk

[2012.08.01 09:10:15 | 000,002,788 | ---- | M] () -- C:\Users\Public\Desktop\WildTangent Games App - toshiba.lnk

[1 C:\Users\Julia\AppData\Roaming\*.tmp files -> C:\Users\Julia\AppData\Roaming\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.08.23 17:58:59 | 000,000,793 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.08.16 08:33:24 | 000,002,033 | ---- | C] () -- C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk

[2012.07.09 17:53:32 | 000,000,051 | ---- | C] () -- C:\Users\Julia\AppData\Roaming\blckdom.res

[2011.12.28 16:39:04 | 001,529,424 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.10.04 09:13:57 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI

[2011.10.04 09:00:37 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe

[2011.02.03 19:56:58 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll

[2010.11.09 12:09:58 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\SPCtl.dll

 
 ========== LOP Check ==========

 

[2012.07.09 17:53:41 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\12001.036

[2012.04.13 10:08:03 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Amazon

[2012.05.10 15:46:25 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\CasualForge

[2012.01.09 15:32:37 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\DAEMON Tools Lite

[2012.03.05 08:53:08 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\FileOpen

[2012.04.27 23:51:34 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\GamesCafe

[2012.04.13 23:09:02 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\iWin

[2012.07.09 17:53:18 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\kock

[2012.05.23 13:34:32 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Legacy

[2012.04.27 23:40:51 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Mean Hamster

[2012.05.15 14:36:31 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Notepad++

[2012.07.29 09:31:58 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\PlayFirst

[2012.04.05 08:56:31 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Sandlot Games

[2012.08.23 17:35:07 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\SoftGrid Client

[2012.08.14 08:43:12 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Sony

[2011.12.29 11:59:24 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Toshiba

[2011.12.27 15:24:22 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TOSHIBA Online Product Information

[2011.12.28 16:39:49 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TP

[2012.08.23 17:38:05 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\WildTangent

[2012.03.11 15:44:15 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\WildTangent All My Gods

[2012.07.09 17:53:20 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\xmldm

[2012.08.23 15:47:57 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\YoudaGames

[2012.04.16 17:54:02 | 000,032,554 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.07.09 17:53:41 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\12001.036

[2012.01.10 09:42:17 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Adobe

[2012.04.13 10:08:03 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Amazon

[2012.05.10 15:46:25 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\CasualForge

[2012.01.09 15:32:37 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\DAEMON Tools Lite

[2012.03.05 08:53:08 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\FileOpen

[2012.04.27 23:51:34 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\GamesCafe

[2011.12.27 14:50:29 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Identities

[2012.04.13 23:09:02 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\iWin

[2012.07.09 17:53:18 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\kock

[2012.05.23 13:34:32 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Legacy

[2012.03.30 16:10:47 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Macromedia

[2012.08.23 17:59:09 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Malwarebytes

[2012.04.27 23:40:51 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Mean Hamster

[2010.11.21 09:16:41 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Media Center Programs

[2012.07.18 13:19:32 | 000,000,000 | --SD | M] -- C:\Users\Julia\AppData\Roaming\Microsoft

[2011.12.27 15:20:48 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Mozilla

[2012.04.13 21:22:02 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Nero

[2012.05.15 14:36:31 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Notepad++

[2012.07.29 09:31:58 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\PlayFirst

[2012.04.05 08:56:31 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Sandlot Games

[2012.07.14 12:40:11 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Skype

[2012.08.23 17:35:07 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\SoftGrid Client

[2012.08.14 08:43:12 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Sony

[2011.12.29 11:59:24 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Toshiba

[2011.12.27 15:24:22 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TOSHIBA Online Product Information

[2011.12.28 16:39:49 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TP

[2012.08.23 17:38:05 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\WildTangent

[2012.03.11 15:44:15 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\WildTangent All My Gods

[2012.07.09 17:53:20 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\xmldm

[2012.08.23 15:47:57 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\YoudaGames

 
 < %APPDATA%\*.exe /s >

[2012.03.05 08:52:24 | 000,014,846 | R--- | M] () -- C:\Users\Julia\AppData\Roaming\Microsoft\Installer\{8D8B35B1-4F80-412C-8F96-0BEE6AF1C57D}\FileOpenNew.exe

[2012.08.01 09:10:14 | 001,008,000 | ---- | M] (WildTangent) -- C:\Users\Julia\AppData\Roaming\WildTangent\WildTangent Games\App\DPConfig\InstallTouchpoints-wildgames.exe

[2012.05.22 03:34:34 | 000,571,040 | ---- | M] (WildTangent, Inc.) -- C:\Users\Julia\AppData\Roaming\WildTangent\WildTangent Games\App\Update\Updater.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2011.01.12 17:51:44 | 000,439,320 | ---- | M] (Intel Corporation) MD5=D469B77687E12FE43E344806740B624D -- C:\Windows\SysNative\drivers\iaStor.sys

[2011.01.12 17:51:44 | 000,439,320 | ---- | M] (Intel Corporation) MD5=D469B77687E12FE43E344806740B624D -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_a36325196df56f7d\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Users\Julia\Desktop\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.* >

[2012.07.12 07:57:42 | 000,000,174 | -HS- | M] () -- C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

[2012.01.09 16:22:12 | 000,001,347 | ---- | M] () -- C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

 
 < %APPDATA%\*AcroIEH*.* >

[2012.07.09 17:53:48 | 000,000,048 | ---- | M] () -- C:\Users\Julia\AppData\Roaming\AcroIEHelpe.txt

[1 C:\Users\Julia\AppData\Roaming\*.tmp files -> C:\Users\Julia\AppData\Roaming\*.tmp -> ]

 
 < %APPDATA%\*.exe >

 
 < %APPDATA%\*.tmp >

[1 C:\Users\Julia\AppData\Roaming\*.tmp files -> C:\Users\Julia\AppData\Roaming\*.tmp -> ]

 
 <           >
 

< End of report >

--- --- ---

[/code]

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Code:

:OTL

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} 

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

IE - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} 

IE - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

FF - prefs.js..browser.search.update: false 

FF - prefs.js..browser.search.useDBForOrder: true 

FF - prefs.js..browser.startup.homepage: "http://www.juraexamen.com/forum" 

FF - prefs.js..network.proxy.type: 0 

FF - user.js - File not found 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found 

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 

O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found 

O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found 

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found 

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found 

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found 

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found 

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 

O32 - HKLM CDRom: AutoRun - 1 

O33 - MountPoints2\{a392608c-902e-11e1-8065-b870f4d6f7f0}\Shell - "" = AutoRun 

O33 - MountPoints2\{a392608c-902e-11e1-8065-b870f4d6f7f0}\Shell\AutoRun\command - "" = F:\Startme.exe 
 

[2012.08.16 08:33:24 | 000,002,033 | ---- | M] () -- C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk 

[2012.07.09 17:53:32 | 000,000,051 | ---- | C] () -- C:\Users\Julia\AppData\Roaming\blckdom.res 

[2012.07.09 17:53:41 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\12001.036 

[2012.07.09 17:53:18 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\kock 

[2012.07.09 17:53:20 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\xmldm 

[2012.07.09 17:53:48 | 000,000,048 | ---- | M] () -- C:\Users\Julia\AppData\Roaming\AcroIEHelpe.txt 

[2011.12.28 16:39:49 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TP 

 

:Files

C:\Users\Julia\AppData\Roaming\120*
 

C:\Users\Julia\AppData\Local\{*}

C:\ProgramData\*.exe

C:\ProgramData\TEMP

C:\Users\Julia\AppData\Local\Temp\*.exe

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

[emptyflash]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Hier das Ergebnis:

Code:

 All processes killed

========== OTL ==========

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKEY_USERS\S-1-5-21-2632050956-65084648-1620196704-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

HKU\S-1-5-21-2632050956-65084648-1620196704-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

Prefs.js: false removed from browser.search.update

Prefs.js: true removed from browser.search.useDBForOrder

Prefs.js: "hxxp://www.juraexamen.com/forum" removed from browser.startup.homepage

Prefs.js: 0 removed from network.proxy.type

64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.

64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLinkedConnections deleted successfully.

64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\An OneNote s&enden\ deleted successfully.

64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.

64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xcel exportieren\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\An OneNote s&enden\ not found.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ not found.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xcel exportieren\ not found.

Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Starting removal of ActiveX control {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.

Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.

64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a392608c-902e-11e1-8065-b870f4d6f7f0}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a392608c-902e-11e1-8065-b870f4d6f7f0}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a392608c-902e-11e1-8065-b870f4d6f7f0}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a392608c-902e-11e1-8065-b870f4d6f7f0}\ not found.

File F:\Startme.exe not found.

C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk moved successfully.

C:\Users\Julia\AppData\Roaming\blckdom.res moved successfully.

C:\Users\Julia\AppData\Roaming\12001.036\components folder moved successfully.

C:\Users\Julia\AppData\Roaming\12001.036 folder moved successfully.

C:\Users\Julia\AppData\Roaming\kock folder moved successfully.

C:\Users\Julia\AppData\Roaming\xmldm folder moved successfully.

C:\Users\Julia\AppData\Roaming\AcroIEHelpe.txt moved successfully.

C:\Users\Julia\AppData\Roaming\TP folder moved successfully.

========== FILES ==========

File\Folder C:\Users\Julia\AppData\Roaming\120* not found.

C:\Users\Julia\AppData\Local\{0B7CE222-F7E9-40B2-AEAA-DBBA601788D6} folder moved successfully.

C:\Users\Julia\AppData\Local\{15133041-3877-4E61-928D-9304AD2C74C3} folder moved successfully.

C:\Users\Julia\AppData\Local\{2EB8A029-5E7F-46CD-A708-CC81FB4ED87E} folder moved successfully.

C:\Users\Julia\AppData\Local\{475869B6-F4B7-466D-9CDC-EB4FD0A9F5C1} folder moved successfully.

C:\Users\Julia\AppData\Local\{4C423CC4-5E91-4DA6-A7C1-F2759E01AC19} folder moved successfully.

C:\Users\Julia\AppData\Local\{687ACB97-898E-4695-88F1-0CA600F587E5} folder moved successfully.

C:\Users\Julia\AppData\Local\{DE24A260-BCCC-43B5-A050-62F57A89D7FE} folder moved successfully.

C:\Users\Julia\AppData\Local\{EE330307-88F8-4CD8-BD36-AAAD55E1D66A} folder moved successfully.

File\Folder C:\ProgramData\*.exe not found.

File\Folder C:\ProgramData\TEMP not found.

C:\Users\Julia\AppData\Local\Temp\SkypeSetup.exe moved successfully.

C:\Users\Julia\AppData\Local\Temp\xmlUpdater.exe moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\Julia\Desktop\cmd.bat deleted successfully.

C:\Users\Julia\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Julia

->Temp folder emptied: 168705308 bytes

->Temporary Internet Files folder emptied: 361318528 bytes

->FireFox cache emptied: 197933326 bytes

->Flash cache emptied: 50986 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 215711458 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 53187 bytes

RecycleBin emptied: 2455400 bytes

 

Total Files Cleaned = 902,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: Default

 

User: Default User

 

User: Julia

->Flash cache emptied: 0 bytes

 

User: Public

 

Total Flash Files Cleaned = 0,00 mb

 

 

OTL by OldTimer - Version 3.2.58.1 log created on 08272012_075105
 

Files\Folders moved on Reboot...

C:\Users\Julia\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Sehr gut! :daumenhoc

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Rechner läuft sehr gut, keinerlei Probleme.
Hier das Malware-Ergebnis

Code:

 Malwarebytes Anti-Malware (Test) 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.08.28.02
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Julia :: JULIA-TOSH [Administrator]
 

Schutz: Aktiviert
 

28.08.2012 09:40:36

mbam-log-2012-08-28 (09-40-36).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|Q:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 316472

Laufzeit: 36 Minute(n), 33 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Und adw:

Code:

 # AdwCleaner v1.801 - Logfile created 08/28/2012 at 11:20:42

# Updated 14/08/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Julia - JULIA-TOSH

# Boot Mode : Normal

# Running from : C:\Users\Julia\Downloads\adwCleaner1801.exe

# Option [Search]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 
 

***** [Registry] *****
 
 

***** [Registre - GUID] *****
 
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v12.0 (de)
 

Profile name : default 

File : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\lyfqz9vc.default\prefs.js
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [1514 octets] - [23/08/2012 18:48:25]

AdwCleaner[S1].txt - [1473 octets] - [24/08/2012 08:08:37]

AdwCleaner[R2].txt - [852 octets] - [28/08/2012 11:20:42]
 

########## EOF - C:\AdwCleaner[R2].txt - [979 octets] ##########

Sehr gut! :daumenhoc

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

So hier nochmal Adw

Code:

 # AdwCleaner v1.801 - Logfile created 08/29/2012 at 10:33:48

# Updated 14/08/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Julia - JULIA-TOSH

# Boot Mode : Normal

# Running from : C:\Users\Julia\Downloads\adwCleaner1801.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 
 

***** [Registry] *****
 
 

***** [Registre - GUID] *****
 
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v12.0 (de)
 

Profile name : default 

File : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\lyfqz9vc.default\prefs.js
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [1514 octets] - [23/08/2012 18:48:25]

AdwCleaner[S1].txt - [1473 octets] - [24/08/2012 08:08:37]

AdwCleaner[R2].txt - [979 octets] - [28/08/2012 11:20:42]

AdwCleaner[S2].txt - [911 octets] - [29/08/2012 10:33:48]
 

########## EOF - C:\AdwCleaner[S2].txt - [1038 octets] ##########

Und hier der Bericht von Emsisoft:

Code:

Emsisoft Anti-Malware - Version 6.6

Letztes Update: 29.08.2012 11:25:54
 

Scan Einstellungen:
 

Scan Methode: Detail Scan

Objekte: Rootkits, Speicher, Traces, C:\, D:\, Q:\

Archiv Scan: An

ADS Scan: An
 

Scan Beginn:        29.08.2012 11:27:00
 

C:\_OTL\MovedFiles\08272012_075105\C_Users\Julia\AppData\Roaming\12001.036\components\AcroFF.dll         gefunden: Trojan.Win32.Spy.Banker.AMN!E1
 

Gescannt        568722

Gefunden        1
 

Scan Ende:        29.08.2012 12:00:19

Scan Zeit:        0:33:19

Den Fund von Emsisoft hab ich jetzt in Quarantäne, ich hoffe das ist ok.

Malware mit Combofix beseitigen

Lade Combofix von einem der folgenden Download-Spiegel herunter:

BleepingComputer.com - ForoSpyware.com

und speichere das Programm auf den Desktop, nicht woanders hin, das ist wichtig!
Beachte die ausführliche Original-Anleitung.

Zurzeit ist Combofix auf folgenden Windows-Versionen lauffähig:

Windows XP (nur 32-bit)
Windows Vista (32-bit/64-bit)
Windows 7 (32-bit/64-bit)

Vorbereitung und wichtige Hinweise

Bitte während des Scans mit Combofix Antiviren- sowie Antispy-Programme, die Firewall und evtl. vorhandenes Skript-Blocking (Norton) deaktivieren.
Liste der zu deaktivierenden Programme.
Bei Unklarheiten bitte fragen.

ComboFix wird Deine Einstellungen in Bezug auf den Bildschirmschoner zurücksetzen.
Diese Einstellungen kannst Du nach Beendigung unserer Bereinigung wieder ändern.
Mache nichts anderes, wenn es Dir nicht gelungen ist, Combofix laufen zu lassen.
Teile uns das mit und warte auf unsere Anweisungen.

Starte die Combofix.exe mit Rechtsklick => Als Administrator ausführen und folge den Anweisungen.
Während des Laufs von Combofix nichts anderes am Computer machen!
Akzeptiere die Bedingungen (Disclaimer) mit "Ja".

Sollte Combofix eine aktuellere Version anbieten, Downlaod erlauben.
Klicke "Ja", um mit dem Suchlauf nach Malware fortzufahren.
Es erscheint eine blaue Eingabeaufforderung, Combofix wird für den Suchlauf vorbereitet.
Bitte nicht in dieses Combofix-Fenster klicken.
Das könnte Dein System einfrieren oder hängen bleiben lassen.
Es wird ein Backup Deiner Registry erstellt.
Nun werden die einzelnen Stufen des Programms abgearbeitet, das kann eine Weile dauern.

Wenn ComboFix fertig ist, wird es ein Log erstellen (bitte warten, das dauert einen Moment).
Unbedingt warten, bis sich das Combofix-Fenster geschlossen hat und das Logfile im Editor erscheint.
Bitte poste die Log-Dateien C:\ComboFix.txt und C:\Qoobox\Add-Remove Programs.txt in Code-Tags hier in den Thread.

Hinweis: Combofix macht aus verschiedenen Gründen den Internet Explorer zum Standard-Browser und erstellt ein IE-Icon auf dem Desktop.
Das IE-Desktop-Icon kannst Du nach der Bereinigung wieder löschen und Deinen bevorzugten Browser wieder als Standard-Browser einstellen.

Combofix nicht auf eigene Faust einsetzen. Wenn keine entsprechende Infektion vorliegt, kann das den Rechner lahmlegen und/oder nachhaltig schädigen!

Hallo,

ich glaube Combofix hat sich aufgehängt, ich habe es minimiert und sonst aber nichts anderes getan, keine anderen Programme oder Ähnliches geöffnet. Wenn ich nun auf die Taskleiste klicke um das Fenster wieder zu sehen, passiert nichts. Auch der Task-Manager lässt sich nicht starten.
Was soll ich tun?

Viele Grüße,
Julia

Noch ein Nachtrag:

Combofix hängt sich auf bei dem Zielverzeichnis:

C:\32788R22FWJFW

Vielleicht nutzt das etwas? Ich kenne mich leider nicht aus.

Gibts ein Log?

C:\ComboFix.txt

Nein, zumindest finde ich kein Log. Hab heute nochmal versucht Combofix laufen zu lassen und hab es drei Stunden lang in dem genannten Zielverzeichnis gelassen, aber es geht da nicht weiter, der PC hängt sich auf.

Vielen Dank für deine geduldige Hilfe.

Deinstalliere alle Virenscanner und versuche es erneut.

(Lade Combofix neu runter!)

Da hab ich vorher wohl was nicht richtig gemacht, aber nachdem ich jetzt alle Virenscanner deinstalliert habe, hat es funktioniert :singsing:

Log Combofix.txt:

Combofix Logfile:

Code:

ComboFix 12-08-31.08 - Julia 01.09.2012  13:12:28.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.6122.4563 [GMT 2:00]

ausgeführt von:: c:\users\Julia\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Julia\AppData\Roaming\srvblck5.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-08-01 bis 2012-09-01  ))))))))))))))))))))))))))))))

.

.

2012-09-01 11:25 . 2012-09-01 11:25        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-08-31 12:31 . 2012-08-03 02:27        62134624        ----a-w-        c:\windows\system32\MRT.exe

2012-08-31 09:25 . 2012-08-31 09:25        --------        d-----w-        c:\users\Julia\AppData\Local\Apps

2012-08-30 15:03 . 2012-08-30 15:03        477168        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll

2012-08-30 15:03 . 2012-08-30 15:03        --------        d-----w-        c:\program files (x86)\Java

2012-08-29 08:49 . 2012-09-01 10:40        --------        d-----w-        c:\program files (x86)\Emsisoft Anti-Malware

2012-08-27 05:51 . 2012-08-27 05:51        --------        d-----w-        C:\_OTL

2012-08-23 15:59 . 2012-08-23 15:59        --------        d-----w-        c:\users\Julia\AppData\Roaming\Malwarebytes

2012-08-23 15:58 . 2012-08-23 15:58        --------        d-----w-        c:\programdata\Malwarebytes

2012-08-23 13:47 . 2012-08-23 13:47        --------        d-----w-        c:\users\Julia\AppData\Roaming\YoudaGames

2012-08-23 13:45 . 2012-08-23 13:45        --------        d-----w-        c:\program files (x86)\Perion

2012-08-14 07:02 . 2012-08-14 07:02        --------        d-----w-        c:\windows\de

2012-08-14 07:01 . 2012-08-14 07:01        --------        d-----w-        c:\windows\fr

2012-08-14 07:01 . 2012-08-14 07:01        --------        d-----w-        c:\windows\en

2012-08-14 07:01 . 2012-08-14 07:01        --------        d-----w-        c:\windows\it

2012-08-14 07:01 . 2012-08-14 07:01        --------        d-----w-        c:\windows\nl

2012-08-14 06:56 . 2012-08-14 06:56        15712        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\ea2c15631cd79e902\MeshBetaRemover.exe

2012-08-14 06:56 . 2012-08-14 06:56        89944        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\e9d25b531cd79e901\DSETUP.dll

2012-08-14 06:56 . 2012-08-14 06:56        537432        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\e9d25b531cd79e901\DXSETUP.exe

2012-08-14 06:56 . 2012-08-14 06:56        1801048        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\e9d25b531cd79e901\dsetup32.dll

2012-08-14 06:44 . 2012-08-14 06:56        --------        d-----w-        c:\users\Julia\AppData\Local\Windows Live

2012-08-14 06:43 . 2012-08-14 06:43        --------        d-----w-        c:\program files (x86)\Sony Media Go Install

2012-08-14 06:43 . 2012-08-14 06:43        --------        d-----w-        c:\users\Julia\AppData\Roaming\Sony

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-08-30 15:03 . 2011-08-26 09:12        473072        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2012-06-09 05:43 . 2012-07-11 06:11        14172672        ----a-w-        c:\windows\system32\shell32.dll

2012-06-06 06:49 . 2012-06-06 06:49        1070152        ----a-w-        c:\windows\SysWow64\MSCOMCTL.OCX

2012-06-06 06:06 . 2012-07-11 06:11        2004480        ----a-w-        c:\windows\system32\msxml6.dll

2012-06-06 06:06 . 2012-07-11 06:11        1881600        ----a-w-        c:\windows\system32\msxml3.dll

2012-06-06 06:02 . 2012-07-11 06:11        1133568        ----a-w-        c:\windows\system32\cdosys.dll

2012-06-06 05:05 . 2012-07-11 06:11        1390080        ----a-w-        c:\windows\SysWow64\msxml6.dll

2012-06-06 05:05 . 2012-07-11 06:11        1236992        ----a-w-        c:\windows\SysWow64\msxml3.dll

2012-06-06 05:03 . 2012-07-11 06:11        805376        ----a-w-        c:\windows\SysWow64\cdosys.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TOPI.EXE"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2011-05-16 846936]

"Sony PC Companion"="c:\program files (x86)\Sony\Sony PC Companion\PCCompanion.exe" [2012-05-31 445624]

"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-20 719672]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"NBAgent"="c:\program files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2011-06-29 1409424]

"SVPWUTIL"="c:\program files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe" [2010-11-09 532480]

"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2010-03-04 423936]

"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2010-08-16 34160]

"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2010-11-29 1294712]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"TOPI.EXE"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2011-05-16 846936]

.

c:\users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 227712]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Toshiba Places Icon Utility.lnk - c:\program files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [2011-8-26 1493888]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-26 136176]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2012-04-27 13352]

R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-26 136176]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-05-15 129976]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-07-20 247400]

R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [2012-01-18 155320]

R3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [2011-02-10 112080]

R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-11-29 54136]

R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-08 137632]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]

S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2010-01-28 249200]

S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-10 46448]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

S2 FileOpenManagerSvc;FileOpen Manager Service;c:\program files\FileOpen\Services\FileOpenManagerSvc64.exe [2011-12-09 334720]

S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2010-08-04 1809920]

S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-03-29 598312]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]

S3 CeKbFilter;CeKbFilter;c:\windows\system32\DRIVERS\CeKbFilter.sys [2011-10-04 20592]

S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2011-05-10 174184]

S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2011-02-08 38096]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-13 413800]

S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [2011-01-04 1109096]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

*Deregistered* - FileOpenWebPublisherScreenHookDriver

.

Inhalt des "geplante Tasks" Ordners

.

2012-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-26 09:49]

.

2012-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-26 09:49]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Toshiba TEMPRO"="c:\program files (x86)\Toshiba TEMPRO\TemproTray.exe" [2011-02-10 1546720]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-02-11 11776104]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-01-18 2188904]

"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 710040]

"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]

"Toshiba Registration"="c:\program files\TOSHIBA\Registration\ToshibaReminder.exe" [2011-08-26 150992]

"FileOpenBroker"="c:\program files\FileOpen\Services\FileOpenBroker64.exe" [2011-12-09 900992]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Zu TOSHIBA Bulletin Board hinzufügen - c:\program files\TOSHIBA\BulletinBoard\TosBBCom.dll/1000

IE: {{97F922BD-8563-4184-87EE-8C4ACA438823} - {5D29E593-73A5-400A-B3BD-6B7A1AF05A31} - c:\program files\TOSHIBA\BulletinBoard\TosBBCom.dll

TCP: DhcpNameServer = 192.168.1.4

FF - ProfilePath - c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\lyfqz9vc.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.juraexamen.com/forum

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe

HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE

HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

c:\program files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe

c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-09-01  13:40:18 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-09-01 11:40

.

Vor Suchlauf: 10 Verzeichnis(se), 180.161.339.392 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 179.676.045.312 Bytes frei

.

- - End Of File - - 7E7359859B68EC7A9EFE6E86465E5F9B

--- --- ---

Und Log Qoobox\Add-Remove Programs.txt:

[code] Adobe Flash Player 10 ActiveX
Adobe Reader X (10.1.4) MUI
Adobe Shockwave Player 11.6
All My Gods
Amazon MP3-Downloader 1.0.9
Bejeweled 2 Deluxe
Bejeweled 3
Bistro Boulevard
Brainville
Burger Island
Burger Rush
Chicken Invaders 3 - Revenge of the Yolk
Chloe's Dream Resort
Chuzzle Deluxe
Cinema Tycoon
Contrôle ActiveX Windows Live Mesh pour connexions à distance
Cooking Dash
D3DX10
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Delicious: Emily's True Love Premium Edition
Diner Dash
Diner Dash - Flo on the Go
Diner Dash - Flo Through Time
Diner Dash - Seasonal Snack Pack
Diner Dash 2 Restaurant Rescue
Diner Dash 5 - Boom! The Collector's Edition
Diner Dash Hometown Hero
Everything Nice
Fashion Dash
FATE
Final Drive: Nitro
Galerie de photos Windows Live
Google Chrome
Google Update Helper
High-Definition Video Playback
Hotel Dash - Suite Success
Hotel Dash 2: Lost Luxuries
Hotel Mogul
Ice Cream Mania
Insaniquarium Deluxe
Intel(R) Management Engine Components
Intel(R) Rapid Storage Technology
Java Auto Updater
Java(TM) 6 Update 34
Junk Mail filter update
Lemonade Tycoon 2
Mesh Runtime
Microsoft Office 2010
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010
Microsoft Office Excel MUI (German) 2010
Microsoft Office Groove MUI (German) 2010
Microsoft Office InfoPath MUI (German) 2010
Microsoft Office Klick-und-Los 2010
Microsoft Office OneNote MUI (German) 2010
Microsoft Office Outlook MUI (German) 2010
Microsoft Office PowerPoint MUI (German) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (German) 2010
Microsoft Office Proof (Italian) 2010
Microsoft Office Proofing (German) 2010
Microsoft Office Publisher MUI (German) 2010
Microsoft Office Shared MUI (German) 2010
Microsoft Office Starter 2010 - Deutsch
Microsoft Office Word MUI (German) 2010
Microsoft Primary Interoperability Assemblies 2005
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Mozilla Firefox 12.0 (x86 de)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
My Life Story
Nero 10 Movie ThemePack Basic
Nero BackItUp 10
Nero BackItUp 10 Help (CHM)
Nero BurnRights 10
Nero BurnRights 10 Help (CHM)
Nero Control Center 10
Nero ControlCenter 10 Help (CHM)
Nero Core Components 10
Nero Express 10
Nero Express 10 Help (CHM)
Nero InfoTool 10
Nero InfoTool 10 Help (CHM)
Nero Kwik Media
Nero Multimedia Suite 10 Essentials
Nero RescueAgent 10
Nero RescueAgent 10 Help (CHM)
Nero StartSmart 10
Nero StartSmart 10 Help (CHM)
Nero Update
NeroKwikMedia Help (CHM)
Notepad++
NVIDIA PhysX
Parking Dash
Party Planner
Penguins!
Pizza Frenzy
Plants vs. Zombies - Game of the Year
Polar Bowler
Raccolta foto di Windows Live
Realtek Ethernet Controller Driver
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
Realtek WLAN Driver
Roller Rush
Sally's Studio Premium Edition
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2553322) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2553431) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553260) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589322) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2597986) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)
Security Update for Microsoft Visio Viewer 2010 (KB2598287) 32-Bit Edition
Shopmania
Skype™ 5.8
Slingo Deluxe
Snowy - Lunch Rush
Soap Opera Dash
Sony Ericsson Update Engine
Sony Ericsson Update Service
Sony PC Companion 2.10.094
Spooky Mall
Supermarket Management 2
swMSM
TOSHIBA Assist
TOSHIBA Bulletin Board
TOSHIBA ConfigFree
TOSHIBA Face Recognition
TOSHIBA Flash Cards Support Utility
TOSHIBA Hardware Setup
TOSHIBA HDD/SSD Alert
Toshiba Manuals
TOSHIBA Media Controller
TOSHIBA Media Controller Plug-in
TOSHIBA Online Product Information
TOSHIBA Places Icon Utility
TOSHIBA Recovery Media Creator
TOSHIBA Recovery Media Creator Reminder
TOSHIBA ReelTime
TOSHIBA Resolution+ Plug-in for Windows Media Player
TOSHIBA Service Station
TOSHIBA Supervisor Password
TOSHIBA TEMPRO
TOSHIBA Value Added Package
TOSHIBA Web Camera Application
TOSHIBA Wireless LAN Indicator
TRORMCLauncher
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553272) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598289) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update Installer for WildTangent Games App
Utility Common Driver
Wedding Dash
Wedding Dash - Ready, Aim, Love!
Wedding Dash (R) 4-Ever
Wedding Dash 2 - Rings Around the World
Wedding Salon
WildTangent-Spiele
WildTangent Games App (Toshiba Games)
Windows Live
Windows Live Communications Platform
Windows Live Essentials
Windows Live Fotogalerie
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Zuma Deluxe
[\code]

Lasse SuperAntiSpyware laufen: http://www.trojaner-board.de/51871-a...tispyware.html

dann:

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.*

%APPDATA%\*AcroIEH*.*

%APPDATA%\*.exe

%APPDATA%\*.tmp

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Ich stell jetzt mal den Log von SuperAntiSpyware rein:

Code:

 SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 09/03/2012 at 10:05 AM
 

Application Version : 5.5.1012
 

Core Rules Database Version : 9166

Trace Rules Database Version: 6978
 

Scan type       : Complete Scan

Total Scan Time : 01:46:38
 

Operating System Information

Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Limited User
 

Memory items scanned      : 690

Memory threats detected   : 0

Registry items scanned    : 66605

Registry threats detected : 0

File items scanned        : 118291

File threats detected     : 535
 

Adware.Tracking Cookie

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@ad.zanox[1].txt [ /ad.zanox ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@ad2.adfarm1.adition[1].txt [ /ad2.adfarm1.adition ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@adfarm1.adition[2].txt [ /adfarm1.adition ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@advertising[1].txt [ /advertising ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@adx.chip[1].txt [ /adx.chip ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@amazon-adsystem[1].txt [ /amazon-adsystem ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@apmebf[1].txt [ /apmebf ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@invitemedia[1].txt [ /invitemedia ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@tracking.mlsat02[1].txt [ /tracking.mlsat02 ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@zanox[1].txt [ /zanox ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\4W3H5WBU.txt [ /traffictrack.de ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\4J1U0TMN.txt [ /www.usenext.de ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\BER056PU.txt [ /apmebf.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\22U38YB2.txt [ /snapfish.112.2o7.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\Z0CPNDMN.txt [ /adxpose.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\457VNKVY.txt [ /adbrite.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\9I4N1O69.txt [ /ad2.adfarm1.adition.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\DD5QFWBE.txt [ /adtech.de ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\OQCKVKTJ.txt [ /revsci.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\E2TDUUYD.txt [ /mediaplex.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\DNF79ONT.txt [ /zanox.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\WSXFI2M3.txt [ /webmasterplan.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\NW2FRS2V.txt [ /tracking.mindshare.de ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\IFRHFGWD.txt [ /imrworldwide.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\RHCTDRGT.txt [ /statse.webtrendslive.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\UD116XVE.txt [ /ad4.adfarm1.adition.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\6DB3LVW8.txt [ /tradedoubler.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\IF9L8VY2.txt [ /2o7.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\57S4FPZN.txt [ /www.googleadservices.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\QK1Y279X.txt [ /serving-sys.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\0KWOXAYS.txt [ /statse.webtrendslive.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\5NESLH2I.txt [ /media6degrees.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\WSNY7RVH.txt [ /ad.movad.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\CN39IDSK.txt [ /c.atdmt.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\TBT86ZEV.txt [ /advertising.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\5RKBY074.txt [ /adfarm1.adition.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\5EBA4LIQ.txt [ /ru4.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\VR5I2GVO.txt [ /lucidmedia.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\4MT1NEOE.txt [ /track.adform.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\SGZTBPC4.txt [ /adform.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\ZN36OALQ.txt [ /ad.360yield.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\OERJT8GS.txt [ /questionmarket.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\EH5Y6DV2.txt [ /eas.apm.emediate.eu ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\VNLNWBJ3.txt [ /bs.serving-sys.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\E5AP4ZHE.txt [ /casalemedia.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\140WP8C9.txt [ /yieldmanager.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\TRPM83XE.txt [ /tracking.quisma.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\6QDMIMRL.txt [ /zanox-affiliate.de ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\RLTAI5O6.txt [ /invitemedia.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\3BUWYIQ5.txt [ /ad.adc-serv.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\EUVXZ0YU.txt [ /ad.yieldmanager.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\B38DBS26.txt [ /doubleclick.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\G5F7LOQM.txt [ /ad3.adfarm1.adition.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\475V7S37.txt [ /fastclick.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\Q2XTM1Q2.txt [ /ad1.adfarm1.adition.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\Y57H7BE8.txt [ /kontera.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\6L657L1T.txt [ /atdmt.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\42KZ0ZI3.txt [ /zedo.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\T1VABRX1.txt [ /pro-market.net ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\BQEWGHID.txt [ /ad.zanox.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\T78XJDY4.txt [ /at.atwola.com ]

        C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\KE8CBR1Z.txt [ /ads.creative-serving.com ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@adx.chip[1].txt [ Cookie:julia@adx.chip.de/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@apmebf[1].txt [ Cookie:julia@apmebf.com/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@ad2.adfarm1.adition[1].txt [ Cookie:julia@ad2.adfarm1.adition.com/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@mediaplex[2].txt [ Cookie:julia@mediaplex.com/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@zanox[1].txt [ Cookie:julia@zanox.com/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@amazon-adsystem[1].txt [ Cookie:julia@amazon-adsystem.com/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@advertising[1].txt [ Cookie:julia@advertising.com/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@invitemedia[1].txt [ Cookie:julia@invitemedia.com/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@atdmt[2].txt [ Cookie:julia@atdmt.com/ ]

        C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@ad.zanox[1].txt [ Cookie:julia@ad.zanox.com/ ]

        C:\USERS\JULIA\Cookies\4W3H5WBU.txt [ Cookie:julia@traffictrack.de/ ]

        C:\USERS\JULIA\Cookies\4J1U0TMN.txt [ Cookie:julia@www.usenext.de/ ]

        C:\USERS\JULIA\Cookies\BER056PU.txt [ Cookie:julia@apmebf.com/ ]

        C:\USERS\JULIA\Cookies\22U38YB2.txt [ Cookie:julia@snapfish.112.2o7.net/ ]

        C:\USERS\JULIA\Cookies\julia@zanox[1].txt [ Cookie:Julia@zanox.com/ ]

        C:\USERS\JULIA\Cookies\Z0CPNDMN.txt [ Cookie:julia@adxpose.com/ ]

        C:\USERS\JULIA\Cookies\457VNKVY.txt [ Cookie:julia@adbrite.com/ ]

        C:\USERS\JULIA\Cookies\9I4N1O69.txt [ Cookie:julia@ad2.adfarm1.adition.com/ ]

        C:\USERS\JULIA\Cookies\DD5QFWBE.txt [ Cookie:julia@adtech.de/ ]

        C:\USERS\JULIA\Cookies\OQCKVKTJ.txt [ Cookie:julia@revsci.net/ ]

        C:\USERS\JULIA\Cookies\julia@advertising[1].txt [ Cookie:Julia@advertising.com/ ]

        C:\USERS\JULIA\Cookies\E2TDUUYD.txt [ Cookie:julia@mediaplex.com/ ]

        C:\USERS\JULIA\Cookies\DNF79ONT.txt [ Cookie:julia@zanox.com/ ]

        C:\USERS\JULIA\Cookies\NW2FRS2V.txt [ Cookie:julia@tracking.mindshare.de/ ]

        C:\USERS\JULIA\Cookies\IFRHFGWD.txt [ Cookie:julia@imrworldwide.com/cgi-bin ]

        C:\USERS\JULIA\Cookies\RHCTDRGT.txt [ Cookie:julia@statse.webtrendslive.com/ ]

        C:\USERS\JULIA\Cookies\UD116XVE.txt [ Cookie:julia@ad4.adfarm1.adition.com/ ]

        C:\USERS\JULIA\Cookies\6DB3LVW8.txt [ Cookie:julia@tradedoubler.com/ ]

        C:\USERS\JULIA\Cookies\IF9L8VY2.txt [ Cookie:julia@2o7.net/ ]

        C:\USERS\JULIA\Cookies\57S4FPZN.txt [ Cookie:julia@www.googleadservices.com/pagead/conversion/1007206354/ ]

        C:\USERS\JULIA\Cookies\QK1Y279X.txt [ Cookie:julia@serving-sys.com/ ]

        C:\USERS\JULIA\Cookies\julia@ad2.adfarm1.adition[1].txt [ Cookie:Julia@ad2.adfarm1.adition.com/ ]

        C:\USERS\JULIA\Cookies\0KWOXAYS.txt [ Cookie:julia@statse.webtrendslive.com/S152688 ]

        C:\USERS\JULIA\Cookies\julia@apmebf[1].txt [ Cookie:Julia@apmebf.com/ ]

        C:\USERS\JULIA\Cookies\CN39IDSK.txt [ Cookie:julia@c.atdmt.com/ ]

        C:\USERS\JULIA\Cookies\TBT86ZEV.txt [ Cookie:julia@advertising.com/ ]

        C:\USERS\JULIA\Cookies\5EBA4LIQ.txt [ Cookie:julia@ru4.com/ ]

        C:\USERS\JULIA\Cookies\4MT1NEOE.txt [ Cookie:julia@track.adform.net/ ]

        C:\USERS\JULIA\Cookies\SGZTBPC4.txt [ Cookie:julia@adform.net/ ]

        C:\USERS\JULIA\Cookies\OERJT8GS.txt [ Cookie:julia@questionmarket.com/ ]

        C:\USERS\JULIA\Cookies\VNLNWBJ3.txt [ Cookie:julia@bs.serving-sys.com/ ]

        C:\USERS\JULIA\Cookies\E5AP4ZHE.txt [ Cookie:julia@casalemedia.com/ ]

        C:\USERS\JULIA\Cookies\TRPM83XE.txt [ Cookie:julia@tracking.quisma.com/ ]

        C:\USERS\JULIA\Cookies\6QDMIMRL.txt [ Cookie:julia@zanox-affiliate.de/ ]

        C:\USERS\JULIA\Cookies\julia@adx.chip[1].txt [ Cookie:Julia@adx.chip.de/ ]

        C:\USERS\JULIA\Cookies\RLTAI5O6.txt [ Cookie:julia@invitemedia.com/ ]

        C:\USERS\JULIA\Cookies\B38DBS26.txt [ Cookie:julia@doubleclick.net/ ]

        C:\USERS\JULIA\Cookies\julia@adfarm1.adition[2].txt [ Cookie:Julia@adfarm1.adition.com/ ]

        C:\USERS\JULIA\Cookies\G5F7LOQM.txt [ Cookie:julia@ad3.adfarm1.adition.com/ ]

        C:\USERS\JULIA\Cookies\julia@ad.zanox[1].txt [ Cookie:Julia@ad.zanox.com/ ]

        C:\USERS\JULIA\Cookies\Q2XTM1Q2.txt [ Cookie:julia@ad1.adfarm1.adition.com/ ]

        C:\USERS\JULIA\Cookies\Y57H7BE8.txt [ Cookie:julia@kontera.com/ ]

        C:\USERS\JULIA\Cookies\6L657L1T.txt [ Cookie:julia@atdmt.com/ ]

        C:\USERS\JULIA\Cookies\42KZ0ZI3.txt [ Cookie:julia@zedo.com/ ]

        C:\USERS\JULIA\Cookies\T1VABRX1.txt [ Cookie:julia@pro-market.net/ ]

        C:\USERS\JULIA\Cookies\BQEWGHID.txt [ Cookie:julia@ad.zanox.com/ ]

        C:\USERS\JULIA\Cookies\T78XJDY4.txt [ Cookie:julia@at.atwola.com/ ]

        C:\USERS\JULIA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JULIA@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]

        C:\USERS\JULIA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JULIA@ADFARM1.ADITION[2].TXT [ /ADFARM1.ADITION ]

        .advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adx.chip.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .a.revenuemax.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .specificclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .getclicky.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .static.getclicky.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        in.getclicky.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .deutschepostag.112.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .paypal.112.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .liveperson.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .112.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .guj.122.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .kkeu.122.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .blau.122.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        tracking.klicktel.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        tracking.sim-technik.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .stats.ebay.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .googleads.g.doubleclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ru4.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        openx1.overadmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .autoscout24.112.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        dk-adserver.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        dc.tremormedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        zbox.zanox.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        counter.hitslink.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.discountdance.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .discountdance.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .image.discountdance.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.discountdance.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        adserver.gb4.motorpresse.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .4stats.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .4stats.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .questionmarket.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .goldmansachs.122.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .youporn.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .youporn.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .porno.youporn.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .porno.youporn.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .handyerotik.youporn.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .handyerotik.youporn.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.deutsch-porno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.deutsch-porno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .stepstone.112.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .monstercom.112.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        s1.trafficmaxx.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ru4.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .yieldmanager.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .hightraffic.hugoboss.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .deutschxxx.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .deutschxxx.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.deutsch-porno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.deutsch-porno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.deutsch-porno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.deutsch-porno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.deutsch-porno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.deutsch-porno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.deutsch-porno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .deutsch-porno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .deutsch-porno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .enoratraffic.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        bdsmpornmovies.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .bdsm-paysite-reviews.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .bdsm-paysite-reviews.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6wjliqkc5cho.stats.esomniture.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ads.tgramedia.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .aok.122.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .webresint.122.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .clickandbuy.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .clickandbuy.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        banner.testberichte.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .apodiscounter.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .apodiscounter.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .apodiscounter.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .apodiscounter.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .eu.clickandbuy.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .eu.clickandbuy.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .bizrate.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www9.addfreestats.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adultadworld.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        hellporno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .hellporno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .hellporno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.xxxkinky.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .xxxkinky.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .xxxkinky.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        af.2.cqcounter.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ad-emea.doubleclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .urbia.wwe-media.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        delivery.trafficbroker.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        partners.webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .bwr-media.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .bwr-media.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ads.bwr-media.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ads.bwr-media.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ads.bwr-media.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .bwr-media.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .giftscom.122.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ads20.wwe-media.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .bikediscount.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .bikediscount.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .questionmarket.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.pornerbros.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adxpansion.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .sexybass.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .sexybass.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .estat.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        statse.webtrendslive.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        adserver1.mokono.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        traffic.brokerbabe.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        traffic.brokerbabe.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .hdpornmobile.xxx [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .hdpornmobile.xxx [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .aka-cdn-ns.adtech.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .sexytube.me [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .sexytube.me [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .mofosex.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .mofosex.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.sexoncube.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .sexoncube.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .sexoncube.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .at.atwola.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .googleads.g.doubleclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        stats.vertriebsassistent.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        adserver.fachschriften.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ads.discountdance.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .discountdance.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .discountdance.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.adition.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.adition.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.porn.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .porn.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .porn.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.pornhub.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .pornhub.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .pornhub.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .sunporno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .sunporno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.zanox-affiliate.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .comvelgmbh.112.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .tribalfusion.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ads20.wwe-media.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .quartermedia.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .alphaporno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .alphaporno.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .unister-adservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        partners.webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.adserver01.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.adserver01.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.xxxlmoebelhaeuser.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.xxxlmoebelhaeuser.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .xxxlmoebelhaeuser.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .xxxlmoebelhaeuser.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .lucidmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.office-discount.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.office-discount.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.office-discount.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .freshpornstube.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .freshpornstube.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        aimfar.solution.weborama.fr [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .aimfar.solution.weborama.fr [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .weborama.fr [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .weborama.fr [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .weboramapublishertrackinguk2.solution.weborama.fr [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .weboramapublishertrackinguk2.solution.weborama.fr [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .libri.112.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .microsoftsto.112.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .xxxymovies.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .xxxymovies.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        go.trafficshop.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adultadworld.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adultadworld.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .unrulymedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .lfstmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        banner.babys-flasche.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        banner.babys-flasche.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .conrad.122.2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        partners.webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .stats.paypal.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adviva.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .urbia.wwe-media.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ads.crakmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .statcounter.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .syndication.traffichaus.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .syndication.traffichaus.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.pornerbros.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .pornerbros.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .pornerbros.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ads.pornerbros.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.pornerbros.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adxpansion.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ads1.jurawelt.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .accounts.google.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .accounts.google.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ww251.smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .pornoadler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .pornoadler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .sexad.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        tags.toolbarsmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        tags.toolbarsmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ad.yieldmanager.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .ad.yieldmanager.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        tags.toolbarsmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        server.adformdsp.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adformdsp.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adform.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .tracker.vinsight.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .clickbank.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .clickbank.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .de.at.atwola.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        tomtailor.dyntracker.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad1.adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adform.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .kontera.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad3.adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .zanox-affiliate.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .zanox-affiliate.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad4.adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LYFQZ9VC.DEFAULT\COOKIES.SQLITE ]

Und hier das Log von OTL:

OTL Logfile:

Code:

OTL logfile created on: 03.09.2012 10:19:31 - Run 2

OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Julia\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

5,98 Gb Total Physical Memory | 4,31 Gb Available Physical Memory | 72,07% Memory free

11,95 Gb Paging File | 9,84 Gb Available in Paging File | 82,29% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 232,88 Gb Total Space | 166,99 Gb Free Space | 71,71% Space Free | Partition Type: NTFS

Drive D: | 232,49 Gb Total Space | 220,78 Gb Free Space | 94,97% Space Free | Partition Type: NTFS

 

Computer Name: JULIA-TOSH | User Name: Julia | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.09.03 10:17:00 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe

PRC - [2012.07.27 13:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2012.05.31 15:00:22 | 000,445,624 | ---- | M] (Sony) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe

PRC - [2012.04.30 11:57:42 | 000,067,072 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe

PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

PRC - [2011.03.29 15:33:08 | 000,598,312 | ---- | M] (Nero AG) -- c:\Program Files (x86)\Nero\Update\NASvc.exe

PRC - [2011.02.01 13:24:42 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

PRC - [2011.02.01 13:24:40 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

PRC - [2010.12.03 14:57:16 | 000,304,560 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

PRC - [2010.08.16 10:54:50 | 000,034,160 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe

PRC - [2010.08.04 17:11:34 | 001,809,920 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe

PRC - [2009.07.28 20:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe

PRC - [2009.03.10 18:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.05.24 11:50:32 | 000,203,776 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll

MOD - [2012.04.30 11:57:42 | 000,067,072 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe

MOD - [2012.04.30 11:57:42 | 000,039,936 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll

MOD - [2012.03.20 15:17:16 | 000,585,728 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\PhoneUpdate.dll

MOD - [2011.11.01 19:32:48 | 000,573,100 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\sqlite3.dll

MOD - [2011.07.07 14:54:36 | 000,233,984 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\Report.dll

MOD - [2010.01.11 16:44:54 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\VObject.dll

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2011.12.09 20:47:40 | 000,334,720 | ---- | M] (FileOpen Systems Inc.) [Auto | Running] -- C:\Program Files\FileOpen\Services\FileOpenManagerSvc64.exe -- (FileOpenManagerSvc)

SRV:64bit: - [2011.08.12 01:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)

SRV:64bit: - [2010.12.09 17:45:26 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)

SRV:64bit: - [2010.12.08 15:42:54 | 000,137,632 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)

SRV:64bit: - [2010.10.20 14:41:00 | 000,138,656 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)

SRV:64bit: - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2012.07.27 13:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012.05.15 09:44:54 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.01.18 14:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)

SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)

SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)

SRV - [2011.03.29 15:33:08 | 000,598,312 | ---- | M] (Nero AG) [Auto | Running] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)

SRV - [2011.02.10 09:25:36 | 000,112,080 | ---- | M] (Toshiba Europe GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)

SRV - [2011.02.01 13:24:42 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)

SRV - [2011.02.01 13:24:40 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)

SRV - [2010.11.29 14:58:30 | 000,054,136 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)

SRV - [2010.10.12 19:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)

SRV - [2010.08.04 17:11:34 | 001,809,920 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.01.28 16:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.03.10 18:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.04.27 09:15:06 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)

DRV:64bit: - [2012.04.27 09:15:06 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.10.04 08:51:48 | 000,020,592 | ---- | M] (Compal Electronics, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CeKbFilter.sys -- (CeKbFilter)

DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)

DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)

DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)

DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)

DRV:64bit: - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS -- (SASDIFSV)

DRV:64bit: - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS -- (SASKUTIL)

DRV:64bit: - [2011.05.10 02:41:28 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.02.08 19:07:00 | 000,038,096 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)

DRV:64bit: - [2011.02.03 19:59:06 | 001,413,680 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2011.01.13 20:58:30 | 000,413,800 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.01.12 17:51:44 | 000,439,320 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2011.01.05 01:08:58 | 001,109,096 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)

DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2010.10.19 16:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)

DRV:64bit: - [2010.07.20 17:43:22 | 000,247,400 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV:64bit: - [2010.03.22 10:55:20 | 000,046,192 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)

DRV:64bit: - [2009.07.30 20:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)

DRV:64bit: - [2009.07.14 16:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = 

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA

IE - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: ""

FF - prefs.js..browser.startup.homepage: "hxxp://www.juraexamen.com/forum"

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_34: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\9\NP_wtapp.dll ()

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.05.15 09:44:54 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2011.12.27 15:20:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julia\AppData\Roaming\mozilla\Extensions

[2012.08.24 08:08:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julia\AppData\Roaming\mozilla\Firefox\Profiles\lyfqz9vc.default\extensions

[2012.07.19 14:03:56 | 000,002,057 | ---- | M] () -- C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\lyfqz9vc.default\searchplugins\youtube-videosuche.xml

[2012.08.30 17:03:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.08.30 17:03:42 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}

[2012.05.15 09:44:54 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.02.20 10:42:09 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.20 10:42:09 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.02.20 10:42:09 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.20 10:42:09 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.20 10:42:09 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.02.20 10:42:09 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2012.09.01 13:27:09 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)

O4:64bit: - HKLM..\Run: [FileOpenBroker] C:\Program Files\FileOpen\Services\FileOpenBroker64.exe (FileOpen Systems Inc.)

O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [Toshiba Registration] C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe (Toshiba Europe GmbH)

O4:64bit: - HKLM..\Run: [Toshiba TEMPRO] C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)

O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)

O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE (TOSHIBA Corporation)

O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)

O4 - HKLM..\Run: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)

O4 - HKLM..\Run: [NBAgent] c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)

O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA)

O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)

O4 - HKU\.DEFAULT..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)

O4 - HKU\S-1-5-18..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)

O4 - HKU\S-1-5-21-2632050956-65084648-1620196704-1000..\Run: [Sony PC Companion] C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Sony)

O4 - HKU\S-1-5-21-2632050956-65084648-1620196704-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O4 - HKU\S-1-5-21-2632050956-65084648-1620196704-1000..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)

O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8:64bit: - Extra context menu item: Zu TOSHIBA Bulletin Board hinzufügen - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)

O8 - Extra context menu item: Zu TOSHIBA Bulletin Board hinzufügen - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)

O9:64bit: - Extra Button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-229 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom64.dll (TODO: <会社名>)

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom64.dll (TODO: <会社名>)

O9 - Extra Button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-229 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)

O9 - Extra 'Tools' menuitem : @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34)

O16 - DPF: {CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.4

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{81C079F3-6C8E-4AD9-96FB-933E495C684D}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{920896DE-8F8D-4229-BC80-EEDF677AB83F}: DhcpNameServer = 192.168.1.4

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

 

 

SafeBootMin:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: MCODS - Reg Error: Value error.

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: MCODS - Reg Error: Value error.

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: MCODS - Reg Error: Value error.

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: MCODS - Reg Error: Value error.

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.09.03 10:17:00 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe

[2012.09.03 08:15:41 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com

[2012.09.03 08:15:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012.09.03 08:14:55 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012.09.03 08:14:55 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012.09.01 13:40:37 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012.09.01 13:27:11 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN

[2012.09.01 13:11:07 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.09.01 13:11:07 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.09.01 13:11:07 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.09.01 13:10:59 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.09.01 13:07:49 | 004,742,651 | R--- | C] (Swearware) -- C:\Users\Julia\Desktop\ComboFix.exe

[2012.09.01 12:51:57 | 000,000,000 | ---D | C] -- C:\Config.Msi

[2012.08.31 11:25:55 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\Apps

[2012.08.30 17:03:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java

[2012.08.30 09:17:41 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2012.08.29 10:49:17 | 000,000,000 | ---D | C] -- C:\Users\Julia\Documents\Anti-Malware

[2012.08.29 10:49:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft Anti-Malware

[2012.08.27 07:51:05 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.08.23 17:59:09 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\Malwarebytes

[2012.08.23 17:58:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.08.23 15:47:57 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\YoudaGames

[2012.08.23 15:45:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Perion

[2012.08.14 09:02:37 | 000,000,000 | ---D | C] -- C:\Windows\de

[2012.08.14 09:01:34 | 000,000,000 | ---D | C] -- C:\Windows\fr

[2012.08.14 09:01:28 | 000,000,000 | ---D | C] -- C:\Windows\en

[2012.08.14 09:01:21 | 000,000,000 | ---D | C] -- C:\Windows\it

[2012.08.14 09:01:14 | 000,000,000 | ---D | C] -- C:\Windows\nl

[2012.08.14 08:44:12 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\Windows Live

[2012.08.14 08:43:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony Media Go Install

[2012.08.14 08:43:12 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\Sony

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.09.03 10:18:23 | 000,024,912 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.09.03 10:18:23 | 000,024,912 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.09.03 10:17:00 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe

[2012.09.03 10:13:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.09.03 10:11:24 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.09.03 10:10:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.09.03 10:10:57 | 519,380,991 | -HS- | M] () -- C:\hiberfil.sys

[2012.09.03 08:15:02 | 000,001,815 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.09.01 13:27:09 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2012.09.01 13:07:54 | 004,742,651 | R--- | M] (Swearware) -- C:\Users\Julia\Desktop\ComboFix.exe

[2012.09.01 12:52:27 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012.09.01 12:52:02 | 000,654,844 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.09.01 12:52:02 | 000,616,686 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.09.01 12:52:02 | 000,130,426 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.09.01 12:52:02 | 000,106,808 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.08.31 11:20:11 | 001,506,902 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.08.30 16:53:02 | 000,002,026 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2012.08.24 07:58:06 | 000,414,968 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

 
 ========== Files Created - No Company Name ==========

 

[2012.09.03 08:15:02 | 000,001,815 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

[2012.09.01 13:11:07 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.09.01 13:11:07 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.09.01 13:11:07 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.09.01 13:11:07 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.09.01 13:11:07 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.08.30 16:53:02 | 000,002,026 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2011.12.28 16:39:04 | 001,529,424 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011.10.04 09:13:57 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI

[2011.10.04 09:00:37 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe

[2011.02.03 19:56:58 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll

[2010.11.09 12:09:58 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\SPCtl.dll

 
 ========== LOP Check ==========

 

[2012.04.13 10:08:03 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Amazon

[2012.05.10 15:46:25 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\CasualForge

[2012.01.09 15:32:37 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\DAEMON Tools Lite

[2012.03.05 08:53:08 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\FileOpen

[2012.04.27 23:51:34 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\GamesCafe

[2012.04.13 23:09:02 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\iWin

[2012.05.23 13:34:32 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Legacy

[2012.04.27 23:40:51 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Mean Hamster

[2012.05.15 14:36:31 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Notepad++

[2012.07.29 09:31:58 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\PlayFirst

[2012.04.05 08:56:31 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Sandlot Games

[2012.08.23 17:35:07 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\SoftGrid Client

[2012.08.14 08:43:12 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Sony

[2011.12.29 11:59:24 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Toshiba

[2011.12.27 15:24:22 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TOSHIBA Online Product Information

[2012.08.23 17:38:05 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\WildTangent

[2012.03.11 15:44:15 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\WildTangent All My Gods

[2012.08.23 15:47:57 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\YoudaGames

[2012.08.31 14:34:39 | 000,032,554 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.01.10 09:42:17 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Adobe

[2012.04.13 10:08:03 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Amazon

[2012.05.10 15:46:25 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\CasualForge

[2012.01.09 15:32:37 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\DAEMON Tools Lite

[2012.03.05 08:53:08 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\FileOpen

[2012.04.27 23:51:34 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\GamesCafe

[2011.12.27 14:50:29 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Identities

[2012.04.13 23:09:02 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\iWin

[2012.05.23 13:34:32 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Legacy

[2012.03.30 16:10:47 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Macromedia

[2012.08.23 17:59:09 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Malwarebytes

[2012.04.27 23:40:51 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Mean Hamster

[2010.11.21 09:16:41 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Media Center Programs

[2012.08.30 09:00:23 | 000,000,000 | --SD | M] -- C:\Users\Julia\AppData\Roaming\Microsoft

[2011.12.27 15:20:48 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Mozilla

[2012.04.13 21:22:02 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Nero

[2012.05.15 14:36:31 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Notepad++

[2012.07.29 09:31:58 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\PlayFirst

[2012.04.05 08:56:31 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Sandlot Games

[2012.07.14 12:40:11 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Skype

[2012.08.23 17:35:07 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\SoftGrid Client

[2012.08.14 08:43:12 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Sony

[2012.09.03 08:15:41 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com

[2011.12.29 11:59:24 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Toshiba

[2011.12.27 15:24:22 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TOSHIBA Online Product Information

[2012.08.23 17:38:05 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\WildTangent

[2012.03.11 15:44:15 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\WildTangent All My Gods

[2012.08.23 15:47:57 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\YoudaGames

 
 < %APPDATA%\*.exe /s >

[2012.03.05 08:52:24 | 000,014,846 | R--- | M] () -- C:\Users\Julia\AppData\Roaming\Microsoft\Installer\{8D8B35B1-4F80-412C-8F96-0BEE6AF1C57D}\FileOpenNew.exe

[2012.08.01 09:10:14 | 001,008,000 | ---- | M] (WildTangent) -- C:\Users\Julia\AppData\Roaming\WildTangent\WildTangent Games\App\DPConfig\InstallTouchpoints-wildgames.exe

[2012.05.22 03:34:34 | 000,571,040 | ---- | M] (WildTangent, Inc.) -- C:\Users\Julia\AppData\Roaming\WildTangent\WildTangent Games\App\Update\Updater.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\erdnt\cache64\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\erdnt\cache86\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\erdnt\cache64\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2011.01.12 17:51:44 | 000,439,320 | ---- | M] (Intel Corporation) MD5=D469B77687E12FE43E344806740B624D -- C:\Windows\SysNative\drivers\iaStor.sys

[2011.01.12 17:51:44 | 000,439,320 | ---- | M] (Intel Corporation) MD5=D469B77687E12FE43E344806740B624D -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_a36325196df56f7d\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\erdnt\cache64\netlogon.dll

[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\erdnt\cache86\netlogon.dll

[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\erdnt\cache86\scecli.dll

[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\erdnt\cache64\scecli.dll

[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\erdnt\cache86\user32.dll

[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\erdnt\cache64\user32.dll

[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\erdnt\cache86\userinit.exe

[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\erdnt\cache64\userinit.exe

[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\erdnt\cache64\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\erdnt\cache86\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\erdnt\cache64\winlogon.exe

[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.* >

[2012.07.12 07:57:42 | 000,000,174 | -HS- | M] () -- C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

[2012.01.09 16:22:12 | 000,001,347 | ---- | M] () -- C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

 
 < %APPDATA%\*AcroIEH*.* >

 
 < %APPDATA%\*.exe >

 
 < %APPDATA%\*.tmp >

 
 <           >
 

< End of report >

--- --- ---

Hatte es aus Versehen zweimal gesendet!

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.

Code:

:OTL

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

IE - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

FF - prefs.js..browser.search.useDBForOrder: "" 

FF - prefs.js..browser.startup.homepage: "http://www.juraexamen.com/forum" 

FF - user.js - File not found 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 

O7 - HKU\S-1-5-21-2632050956-65084648-1620196704-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34) 

O16 - DPF: {CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34) 

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab (Java Plug-in 1.6.0_34) 

O32 - HKLM CDRom: AutoRun - 1 

 

[2012.08.01 09:10:14 | 001,008,000 | ---- | M] (WildTangent) -- C:\Users\Julia\AppData\Roaming\WildTangent\WildTangent Games\App\DPConfig\InstallTouchpoints-wildgames.exe 

 

[2012.02.20 10:42:09 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml 

[2012.02.20 10:42:09 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml 

[2012.02.20 10:42:09 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml 

[2012.02.20 10:42:09 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml 

[2012.02.20 10:42:09 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml 

[2012.02.20 10:42:09 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml 

[2012.09.03 08:15:41 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com 

[2012.08.23 15:45:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Perion 

[2012.08.23 15:47:57 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\YoudaGames 
 

:Files
 

C:\Users\Julia\AppData\Local\{*}

C:\ProgramData\*.exe

C:\ProgramData\TEMP

C:\Users\Julia\AppData\Local\Temp\*.exe

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

%SystemRoot%\System32\*.tmp

%SystemRoot%\SysWOW64\*.tmp

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Code:

 All processes killed

========== OTL ==========

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKEY_USERS\S-1-5-21-2632050956-65084648-1620196704-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

HKU\S-1-5-21-2632050956-65084648-1620196704-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

Prefs.js: "" removed from browser.search.useDBForOrder

Prefs.js: "hxxp://www.juraexamen.com/forum" removed from browser.startup.homepage

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2632050956-65084648-1620196704-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.

Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Starting removal of ActiveX control {CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}\ not found.

Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\Users\Julia\AppData\Roaming\WildTangent\WildTangent Games\App\DPConfig\InstallTouchpoints-wildgames.exe moved successfully.

C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml moved successfully.

C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml moved successfully.

C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml moved successfully.

C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml moved successfully.

C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml moved successfully.

C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml moved successfully.

C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS folder moved successfully.

C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\Quarantine folder moved successfully.

C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs folder moved successfully.

Folder move failed. C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs scheduled to be moved on reboot.

Folder move failed. C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware scheduled to be moved on reboot.

Folder move failed. C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com scheduled to be moved on reboot.

C:\Program Files (x86)\Perion\NewTab folder moved successfully.

C:\Program Files (x86)\Perion folder moved successfully.

C:\Users\Julia\AppData\Roaming\YoudaGames\YoudaJewelshop_104_full\save folder moved successfully.

C:\Users\Julia\AppData\Roaming\YoudaGames\YoudaJewelshop_104_full folder moved successfully.

C:\Users\Julia\AppData\Roaming\YoudaGames folder moved successfully.

========== FILES ==========

File\Folder C:\Users\Julia\AppData\Local\{*} not found.

File\Folder C:\ProgramData\*.exe not found.

File\Folder C:\ProgramData\TEMP not found.

C:\Users\Julia\AppData\Local\Temp\SkypeSetup.exe moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.

C:\Users\Julia\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.

File/Folder C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.

File/Folder C:\Windows\System32\*.tmp not found.

File/Folder C:\Windows\SysWOW64\*.tmp not found.
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\Julia\Desktop\cmd.bat deleted successfully.

C:\Users\Julia\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Julia

->Temp folder emptied: 331591 bytes

->Temporary Internet Files folder emptied: 4385506 bytes

->FireFox cache emptied: 97817731 bytes

->Flash cache emptied: 1616 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 20702 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 98,00 mb

 

 

OTL by OldTimer - Version 3.2.59.1 log created on 09042012_095757
 

Files\Folders moved on Reboot...

C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs folder moved successfully.

C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware folder moved successfully.

C:\Users\Julia\AppData\Roaming\SUPERAntiSpyware.com folder moved successfully.

C:\Users\Julia\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Code:

 # AdwCleaner v2.000 - Datei am 09/05/2012 um 09:06:17 erstellt

# Aktualisiert am 30/08/2012 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Julia - JULIA-TOSH

# Normaler Modus : Normal

# Ausgeführt unter : C:\Users\Julia\Downloads\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 
 

***** [Registrierungsdatenbank] *****
 
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

Wiederhergestellt : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Wiederhergestellt : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
 

-\\ Mozilla Firefox v12.0 (de)
 

Profilname : default 

Datei : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\lyfqz9vc.default\prefs.js
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[R1].txt - [1514 octets] - [23/08/2012 18:48:25]

AdwCleaner[S1].txt - [1473 octets] - [24/08/2012 08:08:37]

AdwCleaner[R2].txt - [979 octets] - [28/08/2012 11:20:42]

AdwCleaner[S2].txt - [1039 octets] - [29/08/2012 10:33:48]

AdwCleaner[S3].txt - [1651 octets] - [05/09/2012 09:06:17]
 

########## EOF - C:\AdwCleaner[S3].txt - [1711 octets] ##########

Incredi jetzt futsch? :)

Soweit ich das beurteilen kann ja :)

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die jxpiinstall.exe
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 7 ) herunter laden.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck

Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck

PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

Firefox 15.0.1 ist aktuell

Flash (11,4,402,265) ist aktuell.

Java (1,7,0,7) ist aktuell.

Adobe Reader 10,1,4,38 ist aktuell.

Zurück

Nach der Deaktivierung:

PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

Firefox 15.0.1 ist aktuell

Flash (11,4,402,265) ist aktuell.

Java ist Installiert aber nicht aktiviert.

Adobe Reader 10,1,4,38 ist aktuell

Hast du auch deaktiviert?

Sehr gut! :daumenhoc

damit bist Du sauber und entlassen! :)

adwCleaner entfernen

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Uninstall.
Bestätige mit Ja.

Tool-Bereinigung mit OTL

Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
Speichere es auf Deinem Desktop.
Doppelklick auf OTL.exe um das Programm auszuführen.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Klicke auf den Button "Bereinigung"
OTL fragt eventuell nach einem Neustart.
Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.

Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html

Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.

Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
temporäre Dateien löschen.

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
PC wird immer langsamer - was tun?