Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Aus Sicherheitsgründen wurde ihr Windowssystem blockiert (https://www.trojaner-board.de/107754-sicherheitsgruenden-wurde-windowssystem-blockiert.html)

Monaa 08.01.2012 02:50
Aus Sicherheitsgründen wurde ihr Windowssystem blockiert
 
Hallo Leute,
ich habe ein riesiges Problem,
mein Laptop hat den bekannten 50€ Virus, dabei ist der Bildschirm gesperrt,verdunkelt und die Meldung wird angezeigt.
Ich habe leider überhaupt keine ahnung von PC's und verstehe auch nicht was diese ergebnisse von Malwarebytes, OTL usw bezwecken sollen?
Und wie kann ich überhaupt diese ergebnisse aufrufen?
Mein Desktop ist doch blockiert ... :confused:
Ich muss doch erst einmal diese meldung weg bekommen aber wie?
Bitte helft mir weiter!! :heulen:

cosinus 09.01.2012 12:15
Funktioniert noch der abgesicherte Modus mit Netzwerktreibern?




Abgesicherter Modus zur Bereinigung
  • Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
  • Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

    Windows im abgesicherten Modusstarten

Monaa 15.01.2012 13:03
Ja das funktioniert :) Und was soll ich jetzt machen?

Monaa 15.01.2012 13:28
Ahh ich habe gerade diesen Malwarebytes Scann gemacht ich poste mal den Log ..

Monaa 15.01.2012 13:31
[code] Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.15.01

Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7600.16385
Labe :: LABE-PC [Administrator]

15.01.2012 13:14:48
mbam-log-2012-01-15 (13-25-21).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 167508
Laufzeit: 6 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{FD5A97AF-98ED-11DF-8EB8-806E6F6E6963} (Malware.Packer) -> Daten: C:\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe (Malware.Packer) -> Keine Aktion durchgeführt.
C:\Users\Labe\AppData\Local\Temp\0.5988603661861407.exe (Malware.Packer) -> Keine Aktion durchgeführt.
C:\Users\Labe\AppData\Local\Temp\ICReinstall_PDFCreatorSetup[1].exe (Adware.Agent) -> Keine Aktion durchgeführt.
C:\Users\Labe\AppData\Local\Temp\ICReinstall\Facemoods.exe (Adware.InstallCore) -> Keine Aktion durchgeführt.
C:\Users\Labe\Downloads\SoftonicDownloader_for_java-runtime-environment.exe (PUP.BundleOffer.Downloader.S) -> Keine Aktion durchgeführt.

(Ende) [code/]

Monaa 15.01.2012 13:32
Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.15.01

Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7600.16385
Labe :: LABE-PC [Administrator]

15.01.2012 13:14:48
mbam-log-2012-01-15 (13-25-21).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 167508
Laufzeit: 6 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{FD5A97AF-98ED-11DF-8EB8-806E6F6E6963} (Malware.Packer) -> Daten: C:\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe (Malware.Packer) -> Keine Aktion durchgeführt.
C:\Users\Labe\AppData\Local\Temp\0.5988603661861407.exe (Malware.Packer) -> Keine Aktion durchgeführt.
C:\Users\Labe\AppData\Local\Temp\ICReinstall_PDFCreatorSetup[1].exe (Adware.Agent) -> Keine Aktion durchgeführt.
C:\Users\Labe\AppData\Local\Temp\ICReinstall\Facemoods.exe (Adware.InstallCore) -> Keine Aktion durchgeführt.
C:\Users\Labe\Downloads\SoftonicDownloader_for_java-runtime-environment.exe (PUP.BundleOffer.Downloader.S) -> Keine Aktion durchgeführt

Monaa 15.01.2012 13:33
Ich tue das jetzt noch mit diesem ESET Scann :D

Monaa 15.01.2012 14:57
So hier jetzt die Ergebnisse von ESET
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=12fe5e923790b643b446158f33c84a31
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-15 01:23:00
# local_time=2012-01-15 02:23:00 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=5893 16776574 66 85 33090612 78260016 0 0
# compatibility_mode=8192 67108863 100 0 3690 3690 0 0
# scanned=166465
# found=24
# cleaned=0
# scan_time=3614
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarApp.dll        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe        probably a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe        probably a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I
C:\Users\All Users\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Babylon\Setup\Setup.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00005e        Win32/SoftonicDownloader application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\0.5988603661861407.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\ICReinstall_PDFCreatorSetup[1].exe        a variant of Win32/InstallCore.E application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\jar_cache6226467159486333906.tmp        Java/Exploit.CVE-2011-3544.B trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\MyBabylonTB.exe        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\YontooSetup-Silent.exe        probably a variant of Win32/Adware.DCVNUWP application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\B821691F-BAB0-7891-A38B-3AB4B9574EDD\MyBabylonTB.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\B821691F-BAB0-7891-A38B-3AB4B9574EDD\Setup.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\ICReinstall\Facemoods.exe        a variant of Win32/InstallCore.D application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\10065f9d-242178b9        Java/TrojanDownloader.OpenStream.NBV trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\58ec35a7-24041eb8        a variant of Java/Exploit.CVE-2010-4452.A trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\Downloads\SoftonicDownloader_for_java-runtime-environment.exe        Win32/SoftonicDownloader application (unable to clean)        00000000000000000000000000000000        I
esets_scanner_update returned -1 esets_gle=53251

cosinus 15.01.2012 18:21
Mach bitte bei mir immer einen Vollscan mit Malwarebytes. Und die Funde müssen entfernt werden!

Monaa 15.01.2012 18:35
Voll scann? Kann man das irgendwo da ankreuzen? Und wie entferne ich die Funde? :)
Dankeschön :)

cosinus 15.01.2012 18:53
Ist das so schwierig die Anleitung von Malwarebytes zu finden und durchzulesen? Warum muss man immer alles nochmal erklären wenn man die Anleitungen schon alle hat? :confused:

Monaa 15.01.2012 18:55
Hahah entschuldigung :D
So ich habe jetzt diesen Vollscan am laufen ..

Monaa 15.01.2012 19:20
Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.15.01

Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7600.16385
Labe :: LABE-PC [Administrator]

15.01.2012 18:38:22
ja

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 322420
Laufzeit: 39 Minute(n), 40 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{FD5A97AF-98ED-11DF-8EB8-806E6F6E6963} (Malware.Packer) -> Daten: C:\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 6
C:\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe (Malware.Packer) -> Keine Aktion durchgeführt.
C:\Users\Labe\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00005e (PUP.BundleOffer.Downloader.S) -> Keine Aktion durchgeführt.
C:\Users\Labe\AppData\Local\Temp\0.5988603661861407.exe (Malware.Packer) -> Keine Aktion durchgeführt.
C:\Users\Labe\AppData\Local\Temp\ICReinstall_PDFCreatorSetup[1].exe (Adware.Agent) -> Keine Aktion durchgeführt.
C:\Users\Labe\AppData\Local\Temp\ICReinstall\Facemoods.exe (Adware.InstallCore) -> Keine Aktion durchgeführt.
C:\Users\Labe\Downloads\SoftonicDownloader_for_java-runtime-environment.exe (PUP.BundleOffer.Downloader.S) -> Keine Aktion durchgeführt.

(Ende)

Monaa 15.01.2012 19:21
Ist das so richtig? :D

cosinus 16.01.2012 09:53
Finger weg von Softonic!!

Softonic ist eine Toolbar- und Adwareschleuder! Finger weg! Software lädt man sich mit oberster Priorität direkt vom Hersteller und nicht von solchen Toolbarklitschen wie Softonic! Im Notfall würde natürlich chip.de gehen


Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Monaa 16.01.2012 17:12
Code:
OTL logfile created on: 16.01.2012 16:07:37 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Labe\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,50 Gb Available Physical Memory | 87,53% Memory free
7,99 Gb Paging File | 7,51 Gb Available in Paging File | 93,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 74,52 Gb Total Space | 12,00 Gb Free Space | 16,10% Space Free | Partition Type: NTFS
Drive D: | 204,03 Gb Total Space | 203,91 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
 
Computer Name: LABE-PC | User Name: Labe | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.15 14:15:22 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Labe\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.03.30 15:12:23 | 000,202,752 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.12.08 00:16:34 | 000,379,520 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Stopped] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent)
SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2010.10.12 09:49:16 | 000,131,552 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\JME.sys -- (JME) JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits)
DRV:64bit: - [2010.07.26 21:40:20 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.04.28 08:57:50 | 000,061,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2010.03.30 15:46:01 | 006,657,536 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.03.30 14:23:33 | 000,195,584 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.03.02 09:45:23 | 001,594,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.10.07 08:13:33 | 000,070,200 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009.10.07 08:13:33 | 000,028,728 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009.10.01 02:22:08 | 000,035,840 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BVRPMPR5a64.SYS -- (BVRPMPR5a64)
DRV:64bit: - [2009.08.20 03:41:37 | 001,800,192 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV:64bit: - [2009.08.18 09:23:31 | 000,143,472 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:64bit: - [2009.07.23 16:48:59 | 000,119,312 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.07.20 10:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.18 20:18:10 | 000,015,928 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\lullaby.sys -- (lullaby)
DRV:64bit: - [2009.06.10 21:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.13 17:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2009.05.05 03:00:27 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2008.11.11 13:42:00 | 000,033,792 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem)
DRV:64bit: - [2008.11.11 13:42:00 | 000,027,136 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag)
DRV:64bit: - [2008.11.11 13:42:00 | 000,017,920 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus)
DRV:64bit: - [2008.05.24 01:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=wbst&s={searchTerms}&f=4
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://asus.de.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F0 05 21 39 55 87 CB 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook: {32b29df0-2237-4370-9a29-37cebb730e9b} - No CLSID value found
IE - HKCU\..\URLSearchHook: {76aeea42-e04a-4b62-83ab-df4b2be2541e} - No CLSID value found
IE - HKCU\..\URLSearchHook: {77f8c945-4b74-4bd6-a073-e0d1997edce8} - No CLSID value found
IE - HKCU\..\URLSearchHook: {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"
FF - prefs.js..browser.search.defaultthis.engineName: "midicair Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2795622&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-sunm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-sunm"
FF - prefs.js..browser.search.selectedEngine: "midicair Customized Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2795622&SearchSource=13"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.7.0.6
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: ffxtlbr@babylon.com:1.1.3
FF - prefs.js..extensions.enabledItems: engine@plasmoo.com:1.0.0.32
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.4.1
FF - prefs.js..extensions.enabledItems: plugin@yontoo.com:1.20.00
FF - prefs.js..extensions.enabledItems: {32b29df0-2237-4370-9a29-37cebb730e9b}:3.8.0.8
FF - prefs.js..extensions.enabledItems: support@predictad.com:1.11
FF - prefs.js..extensions.enabledItems: {77f8c945-4b74-4bd6-a073-e0d1997edce8}:3.8.1.0
FF - prefs.js..keyword.URL: "hxxp://plasmoo.com/index.htm?SearchMashine=true&q="
FF - prefs.js..browser.search.defaultenginename: "Google"
 
 
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\support@predictad.com: C:\Program Files (x86)\AutocompletePro\support@predictad.com
 
[2010.11.20 15:10:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Labe\AppData\Roaming\mozilla\Extensions
[2011.11.29 17:04:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions
[2011.11.11 10:05:40 | 000,000,000 | ---D | M] (FreeSoundRecorder Community Toolbar) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{32b29df0-2237-4370-9a29-37cebb730e9b}
[2010.12.18 14:03:25 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.11.27 13:36:31 | 000,000,000 | ---D | M] (midicair Community Toolbar) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{77f8c945-4b74-4bd6-a073-e0d1997edce8}
[2011.09.28 07:44:15 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011.01.22 20:55:33 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.05.01 20:38:35 | 000,000,000 | ---D | M] (Plasmoo Search Engine) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\engine@plasmoo.com
[2011.04.30 22:18:05 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com
[2011.11.20 16:35:42 | 000,000,919 | ---- | M] () -- C:\Users\Labe\AppData\Roaming\Mozilla\Firefox\Profiles\0f95rqjg.default\searchplugins\conduit.xml
[2011.04.28 18:42:58 | 000,001,975 | ---- | M] () -- C:\Users\Labe\AppData\Roaming\Mozilla\Firefox\Profiles\0f95rqjg.default\searchplugins\plasmoo.xml
File not found (No name found) -- C:\PROGRAM FILES (X86)\AUTOCOMPLETEPRO\SUPPORT@PREDICTAD.COM
File not found (No name found) -- C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\FFXTLBR@FACEMOODS.COM
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\PLUGIN@YONTOO.COM
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.2.183.13\npGoogleOneClick8.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll File not found
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll File not found
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll File not found
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (TBSB01620 Class) - {58124A0B-DC32-4180-9BFF-E0E21AE34026} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found.
O2 - BHO: (IMinent WebBooster (BHO)) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\IMBooster4Web\Iminent.WebBooster.dll (Iminent)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll File not found
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll File not found
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll File not found
O3 - HKLM\..\Toolbar: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32B29DF0-2237-4370-9A29-37CEBB730E9B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {76AEEA42-E04A-4B62-83AB-DF4B2BE2541E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {77F8C945-4B74-4BD6-A073-E0D1997EDCE8} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O4:64bit: - HKLM..\Run: [ASUS WebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe ()
O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found
O4 - HKLM..\Run: [BabylonToolbar] C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe (Babylon Ltd.)
O4 - HKLM..\Run: [IMBooster] C:\Program Files (x86)\Iminent\IMBooster\imbooster.exe (Iminent)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [{FD5A97AF-98ED-11DF-8EB8-806E6F6E6963}] C:\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe (Bitsum Technologies)
O4 - HKCU..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKCU..\Run: [EADM] "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart File not found
O4 - HKCU..\Run: [Syncables] C:\Program Files (x86)\syncables\syncables desktop\Syncables.exe File not found
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10w_ActiveX.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Labe\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Labe\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.7.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9F87DD79-8D1C-4050-A835-17E4BA3B5934}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
 
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)
MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= -  File not found
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.VP60 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.15 14:15:20 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Labe\Desktop\OTL.exe
[2012.01.15 13:21:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.01.15 13:20:39 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Program Files
[2012.01.15 13:14:19 | 000,000,000 | ---D | C] -- C:\Users\Labe\AppData\Roaming\Malwarebytes
[2012.01.15 13:14:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.01.15 13:13:26 | 010,847,608 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Labe\Desktop\mbam-setup-1.60.0.1800.exe
[2008.08.12 05:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.16 16:04:17 | 3219,513,344 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.15 15:09:49 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.01.15 14:15:22 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Labe\Desktop\OTL.exe
[2012.01.15 13:13:37 | 010,847,608 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Labe\Desktop\mbam-setup-1.60.0.1800.exe
[2012.01.08 15:48:05 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.01.08 15:06:08 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.08 15:06:08 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.08 12:56:36 | 000,289,296 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.01.08 00:51:02 | 000,002,342 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
 
========== Files Created - No Company Name ==========
 
[2011.11.29 19:03:06 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.11.11 09:52:09 | 000,001,467 | ---- | C] () -- C:\Users\Labe\AppData\Local\RecConfig.xml
[2011.10.13 21:36:17 | 001,527,912 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.06.05 17:13:52 | 000,000,000 | ---- | C] () -- C:\Users\Labe\AppData\Local\{55881D0F-8D90-4390-B120-153AE12E83A0}
[2011.05.22 14:02:47 | 000,007,680 | ---- | C] () -- C:\Users\Labe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.11.18 23:24:57 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.07.26 21:20:26 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2010.07.26 21:09:56 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2009.07.29 06:20:40 | 000,000,010 | ---- | C] () -- C:\Windows\SysWow64\ABLKSR.ini
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2009.04.08 18:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll
[2008.05.22 16:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg
 
========== LOP Check ==========
 
[2010.11.15 20:41:28 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Asus WebStorage
[2011.11.29 19:38:31 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Babylon
[2011.01.22 20:55:33 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.11.11 10:06:01 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Free Sound Recorder
[2011.10.14 22:48:25 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\gtk-2.0
[2011.07.28 15:56:17 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Jens Lorek
[2010.11.20 15:14:47 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\LG Electronics
[2011.11.11 09:32:25 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Music Editor Free
[2011.11.27 13:51:11 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\OpenCandy
[2010.11.18 21:48:30 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\OpenOffice.org
[2011.11.11 10:15:54 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Origin
[2011.09.16 23:10:27 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\PhotoScape
[2011.11.29 18:19:11 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\SoftGrid Client
[2011.10.13 21:37:23 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\TP
[2010.11.19 22:47:22 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\TubeBox
[2012.01.15 12:58:28 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.11.17 21:36:59 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Adobe
[2010.11.15 20:41:28 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Asus WebStorage
[2010.11.15 18:06:14 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\ATI
[2011.11.29 19:38:31 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Babylon
[2011.06.18 19:33:50 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\CyberLink
[2011.01.22 20:55:33 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.11.11 10:06:01 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Free Sound Recorder
[2011.10.14 22:48:25 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\gtk-2.0
[2010.11.15 18:05:04 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Identities
[2011.07.28 15:56:17 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Jens Lorek
[2010.11.20 15:14:47 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\LG Electronics
[2010.11.17 21:37:02 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Macromedia
[2012.01.15 13:14:19 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Malwarebytes
[2009.07.14 08:44:38 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Media Center Programs
[2011.02.26 07:23:14 | 000,000,000 | --SD | M] -- C:\Users\Labe\AppData\Roaming\Microsoft
[2010.11.20 15:10:41 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Mozilla
[2011.11.11 09:32:25 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Music Editor Free
[2011.11.01 01:21:18 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\NCH Software
[2011.11.27 13:51:11 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\OpenCandy
[2010.11.18 21:48:30 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\OpenOffice.org
[2011.11.11 10:15:54 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Origin
[2011.09.16 23:10:27 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\PhotoScape
[2011.09.07 23:46:56 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Skype
[2011.09.07 23:09:19 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\skypePM
[2011.11.29 18:19:11 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\SoftGrid Client
[2011.10.13 21:37:23 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\TP
[2010.11.19 22:47:22 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\TubeBox
 
< %APPDATA%\*.exe /s >
[2011.09.19 23:18:02 | 003,127,456 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Labe\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2011.09.18 22:52:33 | 003,088,032 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Labe\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2011.02.26 07:23:14 | 000,110,592 | ---- | M] (Bitsum Technologies) -- C:\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe
[2011.07.28 15:55:59 | 000,034,494 | R--- | M] () -- C:\Users\Labe\AppData\Roaming\Microsoft\Installer\{15C82F5E-6EA9-44FE-A0FC-B6D08A684037}\_6FEFF9B68218417F98F549.exe
[2011.06.13 14:38:08 | 000,034,494 | R--- | M] () -- C:\Users\Labe\AppData\Roaming\Microsoft\Installer\{7223945A-F037-4AE1-92F9-BA8304F0E21A}\_6FEFF9B68218417F98F549.exe
[2010.11.19 22:46:45 | 000,034,494 | R--- | M] () -- C:\Users\Labe\AppData\Roaming\Microsoft\Installer\{8DB77BE4-629D-458D-BD68-9F36667C2177}\_6FEFF9B68218417F98F549.exe
[2011.05.01 19:44:24 | 000,034,494 | R--- | M] () -- C:\Users\Labe\AppData\Roaming\Microsoft\Installer\{EAE8F6AB-68E8-4AA9-9518-F677090690B2}\_6FEFF9B68218417F98F549.exe
[2011.11.18 05:30:06 | 002,081,208 | ---- | M] (Speedchecker Limited                                        ) -- C:\Users\Labe\AppData\Roaming\OpenCandy\448BBAFED7DA4EFEA2429BE071C719ED\pcspeedup_oc.exe
[2011.11.27 10:55:40 | 000,197,128 | ---- | M] () -- C:\Users\Labe\AppData\Roaming\OpenCandy\89BA276EFFAB46298AF602BB4B827460\SymentecRegMech_Gr_p1v1.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\drivers\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2010.07.26 21:28:36 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010.07.26 21:28:36 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe
[2010.07.26 21:28:36 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2011.11.29 19:39:19 | 000,544,656 | ---- | M] (Oracle Corporation) Unable to obtain MD5 -- C:\Windows\system32\deployJava1.dll
[2009.07.14 02:15:13 | 000,346,112 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll
[2009.07.14 02:15:13 | 000,215,552 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll
[2010.09.01 05:29:28 | 011,406,848 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\wmp.dll
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:D1B5B4F1

< End of report >

Monaa 16.01.2012 17:14
Code:
OTL Extras logfile created on: 16.01.2012 16:07:37 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Labe\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,50 Gb Available Physical Memory | 87,53% Memory free
7,99 Gb Paging File | 7,51 Gb Available in Paging File | 93,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 74,52 Gb Total Space | 12,00 Gb Free Space | 16,10% Space Free | Partition Type: NTFS
Drive D: | 204,03 Gb Total Space | 203,91 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
 
Computer Name: LABE-PC | User Name: Labe | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"AutoUpdateDisableNotify" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot
"{17B77355-3934-4D0E-8FAC-C420482C8E7D}" = Windows Live Family Safety
"{266058E0-8FB1-8487-C833-3697A3484E01}" = ccc-utility64
"{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}" = ASUS Power4Gear Hybrid
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{C42CA929-C55C-4435-F6B2-160C10FD301E}" = ATI Catalyst Install Manager
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{136E842A-87AC-4CFA-99A0-4D5BF9114566}" = Iminent
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1BAAF2F6-C688-ACB4-89C3-3D0D074CE59F}" = CCC Help Russian
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 29
"{26A24AE4-039D-4CA4-87B4-2F83217000FF}" = Java(TM) 7
"{2B81872B-A054-48DA-BE3B-FA5C164C303A}" = ASUS FancyStart
"{2CA575D0-4A39-13B7-C3F6-C12DCECB5BE4}" = CCC Help Finnish
"{2D12DFC6-4C5E-2734-5979-2D94798738F1}" = CCC Help Italian
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{33A51566-5216-B590-472F-D626C407E332}" = CCC Help Hungarian
"{38E5F2CE-F3B8-95C8-E2D2-E668ECF12FB3}" = CCC Help Greek
"{41B4578A-520D-375F-0702-51608CFDDA0F}" = CCC Help Norwegian
"{43233BDA-5837-0AA5-1624-4746516BCB01}" = CCC Help Dutch
"{44FAF589-DA07-039F-A7BF-09A846640A43}" = Catalyst Control Center Graphics Full Existing
"{47CB9C66-D023-34D2-98EB-541D05F89968}" = CCC Help Chinese Standard
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D409740-7A1C-52B4-D7E6-BB6C4F343140}" = CCC Help Spanish
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5EFDCD2E-1218-5101-747C-C9AA9443CB85}" = CCC Help Japanese
"{619D83DC-710E-203E-29EA-8318FB27C5E4}" = CCC Help Thai
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{6703F18D-12B3-7936-2DCA-5D50FD0E3235}" = CCC Help Polish
"{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}" = ASUS CopyProtect
"{6E08F573-FCF7-C933-5BC5-7B14FD5564E3}" = CCC Help Korean
"{7AC9FA44-609F-8D70-5CC3-9C6A1E59CA4D}" = Catalyst Control Center Graphics Light
"{840E2658-DBA1-9A75-7C36-6C6E3F67FAC0}" = ccc-core-static
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9BDD86A7-B184-BB3F-222C-BD24871C0021}" = CCC Help Turkish
"{A1ABB2D1-3A6C-8598-CCCC-684625F4D451}" = CCC Help Swedish
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A76AA284-E52D-47E6-9E4F-B85DBF8E35C3}" = IMinent Toolbar
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B30B1C24-863A-B8D3-DB04-7037EE242486}" = CCC Help French
"{B89F53E2-4461-16D4-66B5-285593D1BE07}" = CCC Help Chinese Traditional
"{BC3F09E3-E113-1856-855D-E90B073190D1}" = CCC Help Danish
"{BE79D33C-6C74-2F72-2160-F0DB4C897B3D}" = Catalyst Control Center InstallProxy
"{C0A0FA0B-9C4C-1653-0A8D-5F1D92F38D16}" = CCC Help English
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C9A00809-0A5A-39DD-C70F-B2CBDD4EA35A}" = Catalyst Control Center Graphics Previews Vista
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D21D5B3B-0BCB-1809-5701-E59EFB4358E8}" = Catalyst Control Center Core Implementation
"{D619679A-64A9-4677-F2D9-BF2EB2746D61}" = CCC Help Portuguese
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{EEC9A274-AD86-3A16-4F17-22490EF597B4}" = CCC Help German
"{EF6ADCD6-C463-24C9-EEE0-6E07F5CC5182}" = CCC Help Czech
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F99BB4A4-5C73-0E3B-59E4-41960860A26E}" = Catalyst Control Center Localization All
"{FF783F26-3A11-FD83-4B2E-7A7C423323C7}" = Catalyst Control Center Graphics Full New
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"ASUS WebStorage" = ASUS WebStorage
"BabylonToolbar" = Babylon toolbar on IE
"ESET Online Scanner" = ESET Online Scanner v3
"Google Chrome" = Google Chrome
"IMBoosterARP" = Iminent
"Messenger Plus! Live" = Messenger Plus! Live
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"WinLiveSuite_Wave3" = Windows Live Essentials
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 27.11.2011 08:51:29 | Computer Name = Labe-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7600.16869,
 Zeitstempel: 0x4e4f21db  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0674c858  ID des fehlerhaften
 Prozesses: 0x1ad4  Startzeit der fehlerhaften Anwendung: 0x01ccacfacb0da222  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe  Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: 862d957c-18f6-11e1-b0d9-20cf301a651a
 
Error - 27.11.2011 11:31:57 | Computer Name = Labe-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7600.16869,
 Zeitstempel: 0x4e4f21db  Name des fehlerhaften Moduls: USER32.dll, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bdb3c  Ausnahmecode: 0xc0000409  Fehleroffset: 0x00030195  ID des fehlerhaften
 Prozesses: 0x2238  Startzeit der fehlerhaften Anwendung: 0x01ccad19488f6e8c  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe  Pfad
 des fehlerhaften Moduls: C:\Windows\syswow64\USER32.dll  Berichtskennung: f099066b-190c-11e1-b0d9-20cf301a651a
 
Error - 28.11.2011 05:33:02 | Computer Name = Labe-PC | Source = Application Hang | ID = 1002
Description = Programm sllauncher.exe, Version 4.0.60831.0 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: fc4    Startzeit: 01ccadb08df08489    Endzeit: 16    Anwendungspfad:
C:\Program Files (x86)\Microsoft Silverlight\sllauncher.exe    Berichts-ID: df3ba6e8-19a3-11e1-a248-20cf301a651a

 
Error - 28.11.2011 14:22:44 | Computer Name = Labe-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 8.0.7600.16869 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 880    Startzeit: 01ccade2491d7e4e    Endzeit: 16    Anwendungspfad:
C:\Program Files (x86)\Internet Explorer\iexplore.exe    Berichts-ID: f1a3de1a-19ed-11e1-bb07-20cf301a651a

 
Error - 28.11.2011 14:45:39 | Computer Name = Labe-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7600.16869,
 Zeitstempel: 0x4e4f21db  Name des fehlerhaften Moduls: YontooIEClient.dll_unloaded,
 Version: 0.0.0.0, Zeitstempel: 0x4e67b93f  Ausnahmecode: 0xc0000005  Fehleroffset:
0x73f3e37b  ID des fehlerhaften Prozesses: 0xf70  Startzeit der fehlerhaften Anwendung:
 0x01ccadfdea1de82f  Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Internet
 Explorer\iexplore.exe  Pfad des fehlerhaften Moduls: YontooIEClient.dll  Berichtskennung:
 2a419e38-19f1-11e1-bb07-20cf301a651a
 
Error - 29.11.2011 13:19:10 | Computer Name = Labe-PC | Source = MsiInstaller | ID = 11706
Description =
 
Error - 29.11.2011 13:19:59 | Computer Name = Labe-PC | Source = VSS | ID = 8193
Description =
 
Error - 29.11.2011 13:28:50 | Computer Name = Labe-PC | Source = MsiInstaller | ID = 11721
Description =
 
Error - 29.11.2011 13:31:48 | Computer Name = Labe-PC | Source = Application Hang | ID = 1002
Description = Programm Setup.exe, Version 10.0.30319.1 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: b48    Startzeit:
01ccaebc8fa277f9    Endzeit: 15    Anwendungspfad: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\Setup.exe

Berichts-ID:
 00ae9599-1ab0-11e1-bdda-20cf301a651a 
 
Error - 29.11.2011 13:48:28 | Computer Name = Labe-PC | Source = MsiInstaller | ID = 11905
Description =
 
[ Media Center Events ]
Error - 18.11.2011 10:48:18 | Computer Name = Labe-PC | Source = MCUpdate | ID = 0
Description = 15:48:02 - Broadband.enc konnte nicht abgerufen werden (Fehler: BITS
 0x80070070) 
 
[ System Events ]
Error - 16.01.2012 11:54:41 | Computer Name = Labe-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 16.01.2012 11:56:47 | Computer Name = Labe-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 16.01.2012 11:56:47 | Computer Name = Labe-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 16.01.2012 11:56:47 | Computer Name = Labe-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 16.01.2012 12:01:47 | Computer Name = Labe-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 16.01.2012 12:01:47 | Computer Name = Labe-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 16.01.2012 12:01:47 | Computer Name = Labe-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 16.01.2012 12:03:55 | Computer Name = Labe-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 16.01.2012 12:03:55 | Computer Name = Labe-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 16.01.2012 12:03:55 | Computer Name = Labe-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068

cosinus 16.01.2012 20:38
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=wbst&s={searchTerms}&f=4
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://asus.de.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F0 05 21 39 55 87 CB 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {32b29df0-2237-4370-9a29-37cebb730e9b} - No CLSID value found
IE - HKCU\..\URLSearchHook: {76aeea42-e04a-4b62-83ab-df4b2be2541e} - No CLSID value found
IE - HKCU\..\URLSearchHook: {77f8c945-4b74-4bd6-a073-e0d1997edce8} - No CLSID value found
IE - HKCU\..\URLSearchHook: {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found
FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"
FF - prefs.js..browser.search.defaultthis.engineName: "midicair Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2795622&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-sunm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-sunm"
FF - prefs.js..browser.search.selectedEngine: "midicair Customized Web Search"
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT2795622&SearchSource=13"
FF - prefs.js..extensions.enabledItems: ffxtlbr@babylon.com:1.1.3
FF - prefs.js..extensions.enabledItems: engine@plasmoo.com:1.0.0.32
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.4.1
FF - prefs.js..extensions.enabledItems: plugin@yontoo.com:1.20.00
FF - prefs.js..extensions.enabledItems: support@predictad.com:1.11
FF - prefs.js..keyword.URL: "http://plasmoo.com/index.htm?SearchMashine=true&q="
[2010.12.18 14:03:25 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.11.27 13:36:31 | 000,000,000 | ---D | M] (midicair Community Toolbar) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{77f8c945-4b74-4bd6-a073-e0d1997edce8}
[2011.09.28 07:44:15 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011.01.22 20:55:33 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.05.01 20:38:35 | 000,000,000 | ---D | M] (Plasmoo Search Engine) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\engine@plasmoo.com
[2011.04.30 22:18:05 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com
[2011.11.20 16:35:42 | 000,000,919 | ---- | M] () -- C:\Users\Labe\AppData\Roaming\Mozilla\Firefox\Profiles\0f95rqjg.default\searchplugins\conduit.xml
[2011.04.28 18:42:58 | 000,001,975 | ---- | M] () -- C:\Users\Labe\AppData\Roaming\Mozilla\Firefox\Profiles\0f95rqjg.default\searchplugins\plasmoo.xml
File not found (No name found) -- C:\PROGRAM FILES (X86)\AUTOCOMPLETEPRO\SUPPORT@PREDICTAD.COM
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll File not found
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll File not found
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll File not found
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (TBSB01620 Class) - {58124A0B-DC32-4180-9BFF-E0E21AE34026} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found.
O2 - BHO: (IMinent WebBooster (BHO)) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\IMBooster4Web\Iminent.WebBooster.dll (Iminent)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll File not found
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll File not found
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll File not found
O3 - HKLM\..\Toolbar: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32B29DF0-2237-4370-9A29-37CEBB730E9B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {76AEEA42-E04A-4B62-83AB-DF4B2BE2541E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {77F8C945-4B74-4BD6-A073-E0D1997EDCE8} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found
O4 - HKLM..\Run: [BabylonToolbar] C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe (Babylon Ltd.)
O4 - HKCU..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKCU..\Run: [EADM] "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart File not found
O4 - HKCU..\Run: [Syncables] C:\Program Files (x86)\syncables\syncables desktop\Syncables.exe File not found
[2011.11.29 19:38:31 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Babylon
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:D1B5B4F1
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Monaa 17.01.2012 21:28
Code:
ll processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Search_URL| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search\\Default_Search_URL| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{32b29df0-2237-4370-9a29-37cebb730e9b} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32b29df0-2237-4370-9a29-37cebb730e9b}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{76aeea42-e04a-4b62-83ab-df4b2be2541e} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76aeea42-e04a-4b62-83ab-df4b2be2541e}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{77f8c945-4b74-4bd6-a073-e0d1997edce8} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{77f8c945-4b74-4bd6-a073-e0d1997edce8}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{84FF7BD6-B47F-46F8-9130-01B2696B36CB} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
Prefs.js: "Facemoods Search" removed from browser.search.defaultenginename
Prefs.js: "midicair Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2795622&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "moz2-ytff-sunm" removed from browser.search.param.yahoo-fr
Prefs.js: "moz2-ytff-sunm" removed from browser.search.param.yahoo-fr-cjkt
Prefs.js: "midicair Customized Web Search" removed from browser.search.selectedEngine
Prefs.js: "hxxp://search.conduit.com/?ctid=CT2795622&SearchSource=13" removed from browser.startup.homepage
Prefs.js: ffxtlbr@babylon.com:1.1.3 removed from extensions.enabledItems
Prefs.js: engine@plasmoo.com:1.0.0.32 removed from extensions.enabledItems
Prefs.js: ffxtlbr@Facemoods.com:1.4.1 removed from extensions.enabledItems
Prefs.js: plugin@yontoo.com:1.20.00 removed from extensions.enabledItems
Prefs.js: support@predictad.com:1.11 removed from extensions.enabledItems
Prefs.js: "hxxp://plasmoo.com/index.htm?SearchMashine=true&q=" removed from keyword.URL
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\META-INF folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults\preferences folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\chrome folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{77f8c945-4b74-4bd6-a073-e0d1997edce8}\searchplugin folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{77f8c945-4b74-4bd6-a073-e0d1997edce8}\modules folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{77f8c945-4b74-4bd6-a073-e0d1997edce8}\META-INF folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{77f8c945-4b74-4bd6-a073-e0d1997edce8}\defaults folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{77f8c945-4b74-4bd6-a073-e0d1997edce8}\components folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{77f8c945-4b74-4bd6-a073-e0d1997edce8}\chrome folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{77f8c945-4b74-4bd6-a073-e0d1997edce8} folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\modules folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\META-INF folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\defaults folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\chrome folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}\chrome folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\engine@plasmoo.com\skin folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\engine@plasmoo.com\searchplugin folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\engine@plasmoo.com\chrome\content folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\engine@plasmoo.com\chrome folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\engine@plasmoo.com folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\tmp\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\tmp\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\tmp\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\tmp folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\preferences folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\.svn\tmp\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\.svn\tmp\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\.svn\tmp\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\.svn\tmp folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\.svn\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\.svn\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\.svn\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\.svn folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\tmp\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\tmp\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\tmp\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\tmp folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\tmp\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\tmp\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\tmp\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\tmp folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\tmp\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\tmp\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\tmp\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\tmp folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\.svn\tmp\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\.svn\tmp\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\.svn\tmp\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\.svn\tmp folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\.svn\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\.svn\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\.svn\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\.svn folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\components folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\.svn\tmp\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\.svn\tmp\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\.svn\tmp\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\.svn\tmp folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\.svn\text-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\.svn\props folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\.svn\prop-base folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\.svn folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com folder moved successfully.
C:\Users\Labe\AppData\Roaming\Mozilla\Firefox\Profiles\0f95rqjg.default\searchplugins\conduit.xml moved successfully.
C:\Users\Labe\AppData\Roaming\Mozilla\Firefox\Profiles\0f95rqjg.default\searchplugins\plasmoo.xml moved successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{58124A0B-DC32-4180-9BFF-E0E21AE34026}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58124A0B-DC32-4180-9BFF-E0E21AE34026}\ deleted successfully.
C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}\ deleted successfully.
C:\Program Files (x86)\Iminent\IMBooster4Web\Iminent.WebBooster.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}\ deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\ deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{977AE9CC-AF83-45E8-9E03-E2798216E2D5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\ deleted successfully.
File C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32B29DF0-2237-4370-9A29-37CEBB730E9B} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32B29DF0-2237-4370-9A29-37CEBB730E9B}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{76AEEA42-E04A-4B62-83AB-DF4B2BE2541E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76AEEA42-E04A-4B62-83AB-DF4B2BE2541E}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{77F8C945-4B74-4BD6-A073-E0D1997EDCE8} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{77F8C945-4B74-4BD6-A073-E0D1997EDCE8}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{977AE9CC-AF83-45E8-9E03-E2798216E2D5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\ not found.
File C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Setwallpaper deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\BabylonToolbar deleted successfully.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\EA Core deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\EADM deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Syncables deleted successfully.
C:\Users\Labe\AppData\Roaming\Babylon folder moved successfully.
ADS C:\ProgramData\Temp:D1B5B4F1 deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: AppData
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Labe
->Temp folder emptied: 24259401649 bytes
->Temporary Internet Files folder emptied: 327359410 bytes
->Java cache emptied: 91886304 bytes
->FireFox cache emptied: 106178654 bytes
->Google Chrome cache emptied: 180655109 bytes
->Flash cache emptied: 6328837 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 25720548 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67832 bytes
RecycleBin emptied: 4619584 bytes
 
Total Files Cleaned = 23.844,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 01172012_181715

Files\Folders moved on Reboot...
File move failed. C:\Users\Labe\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.
File\Folder C:\Users\Labe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\23FIXZ1R\ADSAdClient31[2].txt not found!
C:\Users\Labe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\23FIXZ1R\messengerscripttracking[1].aspx moved successfully.

Registry entries deleted on Reboot...

cosinus 17.01.2012 23:00
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Monaa 18.01.2012 17:30
Ich versteh das nicht ganz mit dem Normalen Modus?
Als wenn ich meinen Laptop normal starte dann erscheint ja die Meldung auf dem Desktop wie soll ich dann das ausführen?

cosinus 18.01.2012 18:53
Das ist nur ein Hinweis, falls man vorher alles im abgesicherten Modus in Windows gemacht hat

Monaa 19.01.2012 11:44
Bei mir kam jetzt das hier raus

Code:
END USER LICENSE AGREEMENT

Kaspersky Lab ZAO (the “Rightholder”) is an owner of all rights, whether exclusive or otherwise to the Software.

By using the Software You consent to be bound by the terms and conditions of this agreement.

The Rightholder hereby grants You a non-exclusive perpetual license to store, load, install, execute, and display (to “use”) the free of charge Software that will substantially perform within the scope of functionality set forth on hxxp://support.kaspersky.com/viruses. The Software should be used as an auxiliary tool for removing threats from Your computer as described on hxxp://support.kaspersky.com/viruses. The Rightholder doesn’t guarantee complete removal of threats and fixing issues caused by these threats.

No technical support for the Software is available.

You shall not emulate, modify, decompile, or reverse engineer the Software or disassemble or create derivative works based on the Software or any portion thereof with the sole exception of a non-waivable right granted to You by applicable legislation.

THE SOFTWARE IS PROVIDED "AS IS" AND THE RIGHTHOLDER MAKES NO REPRESENTATION AND GIVES NO WARRANTY AS TO ITS USE OR PERFORMANCE. EXCEPT FOR ANY WARRANTY, CONDITION, REPRESENTATION OR TERM THE EXTENT TO WHICH CANNOT BE EXCLUDED OR LIMITED BY APPLICABLE LAW THE RIGHTHOLDER AND ITS PARTNERS MAKE NO WARRANTY, CONDITION, REPRESENTATION, OR TERM (EXPRESS OR IMPLIED, WHETHER BY STATUTE, COMMON LAW, CUSTOM, USAGE OR OTHERWISE) AS TO ANY MATTER INCLUDING, WITHOUT LIMITATION, NONINFRINGEMENT OF THIRD PARTY RIGHTS, MERCHANTABILITY, SATISFACTORY QUALITY, INTEGRATION, OR APPLICABILITY FOR A PARTICULAR PURPOSE. YOU ASSUME ALL FAULTS, AND THE ENTIRE RISK AS TO PERFORMANCE AND RESPONSIBILITY FOR SELECTING THE SOFTWARE TO ACHIEVE YOUR INTENDED RESULTS, AND FOR THE INSTALLATION OF, USE OF, AND RESULTS OBTAINED FROM THE SOFTWARE. WITHOUT LIMITING THE FOREGOING PROVISIONS, THE RIGHTHOLDER MAKES NO REPRESENTATION AND GIVES NO WARRANTY THAT THE SOFTWARE WILL BE ERROR-FREE OR FREE FROM INTERRUPTIONS OR OTHER FAILURES OR THAT THE SOFTWARE WILL MEET ANY OR ALL YOUR REQUIREMENTS WHETHER OR NOT DICLOSED TO THE RIGHTHOLDER.

© 1997-2011 Kaspersky Lab ZAO. All Rights Reserved.

Monaa 19.01.2012 11:48
Nein sorry das kam raus .

Code:
11:45:17.0801 1724        TDSS rootkit removing tool 2.7.5.0 Jan 18 2012 09:26:24
11:45:17.0879 1724        ============================================================
11:45:17.0879 1724        Current date / time: 2012/01/19 11:45:17.0879
11:45:17.0879 1724        SystemInfo:
11:45:17.0879 1724       
11:45:17.0879 1724        OS Version: 6.1.7600 ServicePack: 0.0
11:45:17.0879 1724        Product type: Workstation
11:45:17.0879 1724        ComputerName: LABE-PC
11:45:17.0879 1724        UserName: Labe
11:45:17.0879 1724        Windows directory: C:\Windows
11:45:17.0879 1724        System windows directory: C:\Windows
11:45:17.0879 1724        Running under WOW64
11:45:17.0879 1724        Processor architecture: Intel x64
11:45:17.0879 1724        Number of processors: 2
11:45:17.0879 1724        Page size: 0x1000
11:45:17.0879 1724        Boot type: Safe boot with network
11:45:17.0879 1724        ============================================================
11:45:19.0049 1724        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
11:45:19.0158 1724        Initialize success
11:45:29.0735 1180        ============================================================
11:45:29.0735 1180        Scan started
11:45:29.0735 1180        Mode: Manual; SigCheck; TDLFS;
11:45:29.0735 1180        ============================================================
11:45:30.0702 1180        1394ohci        (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
11:45:30.0842 1180        1394ohci - ok
11:45:30.0998 1180        ACPI            (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
11:45:30.0998 1180        ACPI - ok
11:45:31.0045 1180        AcpiPmi        (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
11:45:31.0123 1180        AcpiPmi - ok
11:45:31.0279 1180        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
11:45:31.0295 1180        adp94xx - ok
11:45:31.0341 1180        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
11:45:31.0341 1180        adpahci - ok
11:45:31.0373 1180        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
11:45:31.0373 1180        adpu320 - ok
11:45:31.0560 1180        AFD            (6ef20ddf3172e97d69f596fb90602f29) C:\Windows\system32\drivers\afd.sys
11:45:31.0622 1180        AFD - ok
11:45:31.0763 1180        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
11:45:31.0778 1180        agp440 - ok
11:45:31.0841 1180        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
11:45:31.0856 1180        aliide - ok
11:45:32.0012 1180        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
11:45:32.0012 1180        amdide - ok
11:45:32.0075 1180        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
11:45:32.0106 1180        AmdK8 - ok
11:45:32.0293 1180        amdkmdag        (09fbe3b09f9a8b5eea6a10d3c1d55888) C:\Windows\system32\DRIVERS\atikmdag.sys
11:45:32.0418 1180        amdkmdag - ok
11:45:32.0574 1180        amdkmdap        (63b54a51e9bf3645063a1a0709f0e52a) C:\Windows\system32\DRIVERS\atikmpag.sys
11:45:32.0605 1180        amdkmdap - ok
11:45:32.0761 1180        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
11:45:32.0808 1180        AmdPPM - ok
11:45:32.0839 1180        amdsata        (53d8d46d51d390abdb54eca623165cb7) C:\Windows\system32\DRIVERS\amdsata.sys
11:45:32.0870 1180        amdsata - ok
11:45:33.0026 1180        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
11:45:33.0026 1180        amdsbs - ok
11:45:33.0089 1180        amdxata        (75c51148154e34eb3d7bb84749a758d5) C:\Windows\system32\DRIVERS\amdxata.sys
11:45:33.0089 1180        amdxata - ok
11:45:33.0151 1180        AppID          (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
11:45:33.0245 1180        AppID - ok
11:45:33.0385 1180        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
11:45:33.0385 1180        arc - ok
11:45:33.0416 1180        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
11:45:33.0432 1180        arcsas - ok
11:45:33.0557 1180        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
11:45:33.0697 1180        AsyncMac - ok
11:45:33.0853 1180        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
11:45:33.0853 1180        atapi - ok
11:45:33.0962 1180        athr            (f8633cdd09647a64ee8db550630427ff) C:\Windows\system32\DRIVERS\athrx.sys
11:45:34.0040 1180        athr - ok
11:45:34.0227 1180        AtiHdmiService  (3b9014fb7ce9e20fd726321c7db7d8b0) C:\Windows\system32\drivers\AtiHdmi.sys
11:45:34.0227 1180        AtiHdmiService - ok
11:45:34.0290 1180        AtiPcie        (7c5d273e29dcc5505469b299c6f29163) C:\Windows\system32\DRIVERS\AtiPcie.sys
11:45:34.0290 1180        AtiPcie - ok
11:45:34.0383 1180        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
11:45:34.0446 1180        b06bdrv - ok
11:45:34.0602 1180        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
11:45:34.0633 1180        b57nd60a - ok
11:45:34.0789 1180        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
11:45:34.0836 1180        Beep - ok
11:45:35.0007 1180        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
11:45:35.0054 1180        blbdrive - ok
11:45:35.0101 1180        bowser          (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys
11:45:35.0148 1180        bowser - ok
11:45:35.0288 1180        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
11:45:35.0319 1180        BrFiltLo - ok
11:45:35.0366 1180        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
11:45:35.0397 1180        BrFiltUp - ok
11:45:35.0678 1180        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
11:45:35.0741 1180        Brserid - ok
11:45:35.0850 1180        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
11:45:35.0897 1180        BrSerWdm - ok
11:45:35.0912 1180        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
11:45:35.0943 1180        BrUsbMdm - ok
11:45:36.0084 1180        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
11:45:36.0099 1180        BrUsbSer - ok
11:45:36.0146 1180        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
11:45:36.0177 1180        BTHMODEM - ok
11:45:36.0349 1180        BVRPMPR5a64    (9887ca12f407d7fbc7f48f3678f5f0b6) C:\Windows\system32\drivers\BVRPMPR5a64.SYS
11:45:36.0365 1180        BVRPMPR5a64 - ok
11:45:36.0396 1180        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
11:45:36.0458 1180        cdfs - ok
11:45:36.0599 1180        cdrom          (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
11:45:36.0630 1180        cdrom - ok
11:45:36.0677 1180        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
11:45:36.0723 1180        circlass - ok
11:45:36.0755 1180        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
11:45:36.0770 1180        CLFS - ok
11:45:36.0926 1180        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
11:45:36.0957 1180        CmBatt - ok
11:45:36.0973 1180        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
11:45:36.0989 1180        cmdide - ok
11:45:37.0020 1180        CNG            (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
11:45:37.0051 1180        CNG - ok
11:45:37.0191 1180        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
11:45:37.0191 1180        Compbatt - ok
11:45:37.0254 1180        CompositeBus    (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
11:45:37.0285 1180        CompositeBus - ok
11:45:37.0379 1180        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
11:45:37.0394 1180        crcdisk - ok
11:45:37.0550 1180        DfsC            (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys
11:45:37.0597 1180        DfsC - ok
11:45:37.0628 1180        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
11:45:37.0691 1180        discache - ok
11:45:37.0847 1180        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
11:45:37.0862 1180        Disk - ok
11:45:37.0925 1180        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
11:45:37.0956 1180        drmkaud - ok
11:45:38.0003 1180        DXGKrnl        (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys
11:45:38.0018 1180        DXGKrnl - ok
11:45:38.0143 1180        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
11:45:38.0205 1180        ebdrv - ok
11:45:38.0346 1180        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
11:45:38.0361 1180        elxstor - ok
11:45:38.0408 1180        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
11:45:38.0439 1180        ErrDev - ok
11:45:38.0486 1180        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
11:45:38.0533 1180        exfat - ok
11:45:38.0564 1180        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
11:45:38.0611 1180        fastfat - ok
11:45:38.0736 1180        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
11:45:38.0767 1180        fdc - ok
11:45:38.0814 1180        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
11:45:38.0829 1180        FileInfo - ok
11:45:38.0845 1180        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
11:45:38.0907 1180        Filetrace - ok
11:45:39.0032 1180        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
11:45:39.0048 1180        flpydisk - ok
11:45:39.0095 1180        FltMgr          (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
11:45:39.0110 1180        FltMgr - ok
11:45:39.0141 1180        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
11:45:39.0141 1180        FsDepends - ok
11:45:39.0204 1180        fssfltr        (2bf3b36b96d015af666b6aa63ae2e38f) C:\Windows\system32\DRIVERS\fssfltr.sys
11:45:39.0219 1180        fssfltr - ok
11:45:39.0251 1180        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
11:45:39.0251 1180        Fs_Rec - ok
11:45:39.0391 1180        fvevol          (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
11:45:39.0407 1180        fvevol - ok
11:45:39.0469 1180        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
11:45:39.0469 1180        gagp30kx - ok
11:45:39.0656 1180        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
11:45:39.0703 1180        hcw85cir - ok
11:45:39.0843 1180        HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
11:45:39.0890 1180        HdAudAddService - ok
11:45:40.0015 1180        HDAudBus        (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
11:45:40.0046 1180        HDAudBus - ok
11:45:40.0093 1180        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
11:45:40.0124 1180        HidBatt - ok
11:45:40.0171 1180        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
11:45:40.0202 1180        HidBth - ok
11:45:40.0233 1180        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
11:45:40.0265 1180        HidIr - ok
11:45:40.0452 1180        HidUsb          (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
11:45:40.0499 1180        HidUsb - ok
11:45:40.0608 1180        HpSAMD          (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
11:45:40.0623 1180        HpSAMD - ok
11:45:40.0670 1180        HTTP            (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
11:45:40.0733 1180        HTTP - ok
11:45:40.0873 1180        hwpolicy        (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
11:45:40.0889 1180        hwpolicy - ok
11:45:40.0982 1180        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
11:45:40.0982 1180        i8042prt - ok
11:45:41.0045 1180        iaStorV        (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys
11:45:41.0060 1180        iaStorV - ok
11:45:41.0076 1180        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
11:45:41.0091 1180        iirsp - ok
11:45:41.0138 1180        IntcAzAudAddService - ok
11:45:41.0185 1180        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
11:45:41.0185 1180        intelide - ok
11:45:41.0232 1180        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
11:45:41.0263 1180        intelppm - ok
11:45:41.0294 1180        IpFilterDriver  (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:45:41.0341 1180        IpFilterDriver - ok
11:45:41.0372 1180        IPMIDRV        (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
11:45:41.0403 1180        IPMIDRV - ok
11:45:41.0419 1180        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
11:45:41.0481 1180        IPNAT - ok
11:45:41.0575 1180        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
11:45:41.0653 1180        IRENUM - ok
11:45:41.0684 1180        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
11:45:41.0684 1180        isapnp - ok
11:45:41.0715 1180        iScsiPrt        (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
11:45:41.0715 1180        iScsiPrt - ok
11:45:41.0856 1180        JMCR            (db917b998cbc15a153c00dd6efc34c13) C:\Windows\system32\DRIVERS\jmcr.sys
11:45:41.0856 1180        JMCR - ok
11:45:41.0934 1180        JME            (8adaafcd2b8c259debf6c8dfd9727889) C:\Windows\system32\DRIVERS\JME.sys
11:45:41.0934 1180        JME - ok
11:45:41.0981 1180        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
11:45:41.0996 1180        kbdclass - ok
11:45:42.0043 1180        kbdhid          (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
11:45:42.0074 1180        kbdhid - ok
11:45:42.0215 1180        kbfiltr        (e63ef8c3271d014f14e2469ce75fecb4) C:\Windows\system32\DRIVERS\kbfiltr.sys
11:45:42.0230 1180        kbfiltr - ok
11:45:42.0261 1180        KSecDD          (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
11:45:42.0277 1180        KSecDD - ok
11:45:42.0293 1180        KSecPkg        (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
11:45:42.0308 1180        KSecPkg - ok
11:45:42.0433 1180        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
11:45:42.0480 1180        ksthunk - ok
11:45:42.0636 1180        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
11:45:42.0683 1180        lltdio - ok
11:45:42.0807 1180        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
11:45:42.0823 1180        LSI_FC - ok
11:45:42.0839 1180        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
11:45:42.0854 1180        LSI_SAS - ok
11:45:42.0963 1180        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
11:45:42.0963 1180        LSI_SAS2 - ok
11:45:42.0995 1180        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
11:45:43.0010 1180        LSI_SCSI - ok
11:45:43.0135 1180        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
11:45:43.0197 1180        luafv - ok
11:45:43.0307 1180        lullaby        (085435ae1a124361304044029b5cc644) C:\Windows\system32\DRIVERS\lullaby.sys
11:45:43.0322 1180        lullaby - ok
11:45:43.0494 1180        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
11:45:43.0509 1180        megasas - ok
11:45:43.0556 1180        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
11:45:43.0572 1180        MegaSR - ok
11:45:43.0603 1180        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
11:45:43.0665 1180        Modem - ok
11:45:43.0712 1180        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
11:45:43.0743 1180        monitor - ok
11:45:43.0775 1180        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
11:45:43.0790 1180        mouclass - ok
11:45:43.0837 1180        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
11:45:43.0853 1180        mouhid - ok
11:45:43.0884 1180        mountmgr        (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
11:45:43.0899 1180        mountmgr - ok
11:45:43.0931 1180        mpio            (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
11:45:43.0931 1180        mpio - ok
11:45:43.0962 1180        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
11:45:44.0009 1180        mpsdrv - ok
11:45:44.0040 1180        MRxDAV          (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
11:45:44.0071 1180        MRxDAV - ok
11:45:44.0118 1180        mrxsmb          (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys
11:45:44.0149 1180        mrxsmb - ok
11:45:44.0211 1180        mrxsmb10        (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:45:44.0227 1180        mrxsmb10 - ok
11:45:44.0352 1180        mrxsmb20        (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:45:44.0383 1180        mrxsmb20 - ok
11:45:44.0430 1180        msahci          (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys
11:45:44.0430 1180        msahci - ok
11:45:44.0477 1180        msdsm          (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
11:45:44.0477 1180        msdsm - ok
11:45:44.0523 1180        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
11:45:44.0570 1180        Msfs - ok
11:45:44.0617 1180        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
11:45:44.0664 1180        mshidkmdf - ok
11:45:44.0695 1180        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
11:45:44.0695 1180        msisadrv - ok
11:45:44.0742 1180        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
11:45:44.0773 1180        MSKSSRV - ok
11:45:44.0820 1180        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
11:45:44.0867 1180        MSPCLOCK - ok
11:45:44.0898 1180        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
11:45:44.0945 1180        MSPQM - ok
11:45:44.0976 1180        MsRPC          (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
11:45:44.0991 1180        MsRPC - ok
11:45:45.0023 1180        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
11:45:45.0023 1180        mssmbios - ok
11:45:45.0085 1180        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
11:45:45.0132 1180        MSTEE - ok
11:45:45.0163 1180        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
11:45:45.0179 1180        MTConfig - ok
11:45:45.0225 1180        MTsensor        (032d35c996f21d19a205a7c8f0b76f3c) C:\Windows\system32\DRIVERS\ATK64AMD.sys
11:45:45.0225 1180        MTsensor - ok
11:45:45.0288 1180        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
11:45:45.0303 1180        Mup - ok
11:45:45.0350 1180        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
11:45:45.0397 1180        NativeWifiP - ok
11:45:45.0459 1180        NDIS            (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
11:45:45.0475 1180        NDIS - ok
11:45:45.0537 1180        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
11:45:45.0600 1180        NdisCap - ok
11:45:45.0647 1180        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
11:45:45.0693 1180        NdisTapi - ok
11:45:45.0756 1180        Ndisuio        (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
11:45:45.0803 1180        Ndisuio - ok
11:45:45.0834 1180        NdisWan        (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
11:45:45.0881 1180        NdisWan - ok
11:45:45.0912 1180        NDProxy        (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
11:45:45.0959 1180        NDProxy - ok
11:45:46.0005 1180        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
11:45:46.0052 1180        NetBIOS - ok
11:45:46.0083 1180        NetBT          (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
11:45:46.0146 1180        NetBT - ok
11:45:46.0286 1180        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
11:45:46.0302 1180        nfrd960 - ok
11:45:46.0333 1180        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
11:45:46.0380 1180        Npfs - ok
11:45:46.0427 1180        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
11:45:46.0473 1180        nsiproxy - ok
11:45:46.0551 1180        Ntfs            (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys
11:45:46.0583 1180        Ntfs - ok
11:45:46.0614 1180        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
11:45:46.0676 1180        Null - ok
11:45:46.0707 1180        nvraid          (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys
11:45:46.0723 1180        nvraid - ok
11:45:46.0739 1180        nvstor          (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys
11:45:46.0754 1180        nvstor - ok
11:45:46.0863 1180        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
11:45:46.0879 1180        nv_agp - ok
11:45:46.0910 1180        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
11:45:46.0941 1180        ohci1394 - ok
11:45:46.0973 1180        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
11:45:47.0004 1180        Parport - ok
11:45:47.0019 1180        partmgr        (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
11:45:47.0035 1180        partmgr - ok
11:45:47.0066 1180        pci            (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
11:45:47.0082 1180        pci - ok
11:45:47.0097 1180        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
11:45:47.0097 1180        pciide - ok
11:45:47.0144 1180        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
11:45:47.0144 1180        pcmcia - ok
11:45:47.0175 1180        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
11:45:47.0175 1180        pcw - ok
11:45:47.0207 1180        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
11:45:47.0269 1180        PEAUTH - ok
11:45:47.0425 1180        PptpMiniport    (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
11:45:47.0503 1180        PptpMiniport - ok
11:45:47.0534 1180        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
11:45:47.0565 1180        Processor - ok
11:45:47.0597 1180        Psched          (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
11:45:47.0659 1180        Psched - ok
11:45:47.0721 1180        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
11:45:47.0753 1180        ql2300 - ok
11:45:47.0784 1180        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
11:45:47.0799 1180        ql40xx - ok
11:45:47.0831 1180        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
11:45:47.0862 1180        QWAVEdrv - ok
11:45:47.0877 1180        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
11:45:47.0924 1180        RasAcd - ok
11:45:47.0987 1180        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
11:45:48.0033 1180        RasAgileVpn - ok
11:45:48.0080 1180        Rasl2tp        (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
11:45:48.0127 1180        Rasl2tp - ok
11:45:48.0158 1180        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
11:45:48.0221 1180        RasPppoe - ok
11:45:48.0252 1180        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
11:45:48.0314 1180        RasSstp - ok
11:45:48.0345 1180        rdbss          (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
11:45:48.0392 1180        rdbss - ok
11:45:48.0423 1180        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
11:45:48.0455 1180        rdpbus - ok
11:45:48.0486 1180        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
11:45:48.0533 1180        RDPCDD - ok
11:45:48.0564 1180        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
11:45:48.0626 1180        RDPENCDD - ok
11:45:48.0657 1180        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
11:45:48.0720 1180        RDPREFMP - ok
11:45:48.0735 1180        RDPWD          (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
11:45:48.0798 1180        RDPWD - ok
11:45:48.0829 1180        rdyboost        (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
11:45:48.0845 1180        rdyboost - ok
11:45:48.0876 1180        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
11:45:48.0938 1180        rspndr - ok
11:45:48.0969 1180        sbp2port        (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
11:45:48.0969 1180        sbp2port - ok
11:45:49.0001 1180        scfilter        (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
11:45:49.0063 1180        scfilter - ok
11:45:49.0110 1180        sdbus          (2c8d162efaf73abd36d8bcbb6340cae7) C:\Windows\system32\DRIVERS\sdbus.sys
11:45:49.0157 1180        sdbus - ok
11:45:49.0203 1180        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
11:45:49.0266 1180        secdrv - ok
11:45:49.0313 1180        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
11:45:49.0344 1180        Serenum - ok
11:45:49.0375 1180        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
11:45:49.0406 1180        Serial - ok
11:45:49.0422 1180        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
11:45:49.0453 1180        sermouse - ok
11:45:49.0500 1180        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
11:45:49.0531 1180        sffdisk - ok
11:45:49.0547 1180        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys
11:45:49.0562 1180        sffp_mmc - ok
11:45:49.0593 1180        sffp_sd        (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys
11:45:49.0625 1180        sffp_sd - ok
11:45:49.0734 1180        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
11:45:49.0765 1180        sfloppy - ok
11:45:49.0827 1180        SiSGbeLH        (1bc348cf6baa90ec8e533ef6e6a69933) C:\Windows\system32\DRIVERS\SiSG664.sys
11:45:49.0859 1180        SiSGbeLH - ok
11:45:49.0905 1180        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
11:45:49.0905 1180        SiSRaid2 - ok
11:45:49.0921 1180        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
11:45:49.0937 1180        SiSRaid4 - ok
11:45:49.0968 1180        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
11:45:50.0015 1180        Smb - ok
11:45:50.0217 1180        SNP2UVC        (2114518e55b380a3acc28b2c27fd499a) C:\Windows\system32\DRIVERS\snp2uvc.sys
11:45:50.0264 1180        SNP2UVC - ok
11:45:50.0295 1180        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
11:45:50.0311 1180        spldr - ok
11:45:50.0373 1180        srv            (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys
11:45:50.0420 1180        srv - ok
11:45:50.0451 1180        srv2            (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys
11:45:50.0483 1180        srv2 - ok
11:45:50.0514 1180        srvnet          (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys
11:45:50.0529 1180        srvnet - ok
11:45:50.0654 1180        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
11:45:50.0670 1180        stexstor - ok
11:45:50.0717 1180        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
11:45:50.0717 1180        swenum - ok
11:45:50.0810 1180        Tcpip          (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\drivers\tcpip.sys
11:45:50.0857 1180        Tcpip - ok
11:45:50.0935 1180        TCPIP6          (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\DRIVERS\tcpip.sys
11:45:50.0966 1180        TCPIP6 - ok
11:45:51.0029 1180        tcpipreg        (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
11:45:51.0075 1180        tcpipreg - ok
11:45:51.0107 1180        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
11:45:51.0153 1180        TDPIPE - ok
11:45:51.0185 1180        TDTCP          (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
11:45:51.0231 1180        TDTCP - ok
11:45:51.0263 1180        tdx            (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
11:45:51.0309 1180        tdx - ok
11:45:51.0341 1180        TermDD          (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
11:45:51.0341 1180        TermDD - ok
11:45:51.0403 1180        tssecsrv        (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
11:45:51.0450 1180        tssecsrv - ok
11:45:51.0575 1180        tunnel          (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
11:45:51.0606 1180        tunnel - ok
11:45:51.0637 1180        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
11:45:51.0653 1180        uagp35 - ok
11:45:51.0684 1180        udfs            (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
11:45:51.0731 1180        udfs - ok
11:45:51.0918 1180        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
11:45:51.0933 1180        uliagpkx - ok
11:45:51.0996 1180        umbus          (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
11:45:52.0011 1180        umbus - ok
11:45:52.0058 1180        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
11:45:52.0089 1180        UmPass - ok
11:45:52.0214 1180        usbaudio        (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys
11:45:52.0245 1180        usbaudio - ok
11:45:52.0339 1180        usbbus          (5fcc71487888589a9244af54cfefab29) C:\Windows\system32\DRIVERS\lgx64bus.sys
11:45:52.0355 1180        usbbus - ok
11:45:52.0417 1180        usbccgp        (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys
11:45:52.0448 1180        usbccgp - ok
11:45:52.0511 1180        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
11:45:52.0542 1180        usbcir - ok
11:45:52.0604 1180        UsbDiag        (3fb6e423f7567c92c32ea786f5fd0c69) C:\Windows\system32\DRIVERS\lgx64diag.sys
11:45:52.0635 1180        UsbDiag - ok
11:45:52.0667 1180        usbehci        (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\DRIVERS\usbehci.sys
11:45:52.0698 1180        usbehci - ok
11:45:52.0745 1180        usbhub          (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys
11:45:52.0776 1180        usbhub - ok
11:45:52.0823 1180        USBModem        (78d551f5b93488b4666f5fc8dd4815f3) C:\Windows\system32\DRIVERS\lgx64modem.sys
11:45:52.0823 1180        USBModem - ok
11:45:52.0854 1180        usbohci        (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\DRIVERS\usbohci.sys
11:45:52.0869 1180        usbohci - ok
11:45:52.0916 1180        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
11:45:52.0932 1180        usbprint - ok
11:45:52.0979 1180        USBSTOR        (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:45:53.0010 1180        USBSTOR - ok
11:45:53.0041 1180        usbuhci        (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\drivers\usbuhci.sys
11:45:53.0072 1180        usbuhci - ok
11:45:53.0213 1180        usbvideo        (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\System32\Drivers\usbvideo.sys
11:45:53.0259 1180        usbvideo - ok
11:45:53.0306 1180        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
11:45:53.0322 1180        vdrvroot - ok
11:45:53.0353 1180        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
11:45:53.0353 1180        vga - ok
11:45:53.0400 1180        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
11:45:53.0462 1180        VgaSave - ok
11:45:53.0493 1180        vhdmp          (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
11:45:53.0509 1180        vhdmp - ok
11:45:53.0556 1180        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
11:45:53.0556 1180        viaide - ok
11:45:53.0587 1180        volmgr          (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
11:45:53.0587 1180        volmgr - ok
11:45:53.0634 1180        volmgrx        (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
11:45:53.0649 1180        volmgrx - ok
11:45:53.0696 1180        volsnap        (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
11:45:53.0712 1180        volsnap - ok
11:45:53.0759 1180        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
11:45:53.0774 1180        vsmraid - ok
11:45:53.0790 1180        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
11:45:53.0821 1180        vwifibus - ok
11:45:53.0852 1180        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
11:45:53.0883 1180        vwififlt - ok
11:45:53.0899 1180        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
11:45:53.0930 1180        WacomPen - ok
11:45:53.0977 1180        WANARP          (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
11:45:54.0008 1180        WANARP - ok
11:45:54.0039 1180        Wanarpv6        (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
11:45:54.0071 1180        Wanarpv6 - ok
11:45:54.0102 1180        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
11:45:54.0102 1180        Wd - ok
11:45:54.0133 1180        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
11:45:54.0149 1180        Wdf01000 - ok
11:45:54.0273 1180        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
11:45:54.0305 1180        WfpLwf - ok
11:45:54.0336 1180        WimFltr        (52ded146e4797e6ccf94799e8e22bb2a) C:\Windows\system32\DRIVERS\wimfltr.sys
11:45:54.0336 1180        WimFltr - ok
11:45:54.0351 1180        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
11:45:54.0367 1180        WIMMount - ok
11:45:54.0539 1180        WinUsb          (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys
11:45:54.0554 1180        WinUsb - ok
11:45:54.0601 1180        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
11:45:54.0632 1180        WmiAcpi - ok
11:45:54.0788 1180        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
11:45:54.0835 1180        ws2ifsl - ok
11:45:54.0897 1180        WudfPf          (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
11:45:54.0960 1180        WudfPf - ok
11:45:55.0007 1180        WUDFRd          (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
11:45:55.0053 1180        WUDFRd - ok
11:45:55.0116 1180        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
11:45:55.0334 1180        \Device\Harddisk0\DR0 - ok
11:45:55.0334 1180        Boot (0x1200)  (ce5ef8718aceb2d58b23d21b59452421) \Device\Harddisk0\DR0\Partition0
11:45:55.0334 1180        \Device\Harddisk0\DR0\Partition0 - ok
11:45:55.0365 1180        Boot (0x1200)  (0b50251a44195165d7dee4e8932f453a) \Device\Harddisk0\DR0\Partition1
11:45:55.0365 1180        \Device\Harddisk0\DR0\Partition1 - ok
11:45:55.0365 1180        ============================================================
11:45:55.0365 1180        Scan finished
11:45:55.0365 1180        ============================================================
11:45:55.0381 1756        Detected object count: 0
11:45:55.0381 1756        Actual detected object count: 0

cosinus 19.01.2012 12:14
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Monaa 19.01.2012 13:01
Code:
ComboFix 12-01-18.04 - Labe 19.01.2012  12:20:57.1.2 - x64 NETWORK
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.4094.3477 [GMT 1:00]
ausgeführt von:: c:\users\Labe\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\ASPG_icon.ico
c:\program files (x86)\facemoods.com
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.crx
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.png
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsApp.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsEng.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe
c:\program files (x86)\facemoods.com\sqlite3.dll
c:\programdata\FullRemove.exe
c:\programdata\Tarma Installer
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setup.dll
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.dat
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.exe
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.ico
c:\users\Labe\AppData\Roaming\Microsoft\svhcost.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-19 bis 2012-01-19  ))))))))))))))))))))))))))))))
.
.
2012-01-19 10:53 . 2012-01-19 10:53        --------        d-----w-        c:\program files (x86)\Electronic Arts
2012-01-18 15:24 . 2012-01-18 15:24        --------        d-----w-        c:\program files (x86)\BrowserCompanion
2012-01-18 15:24 . 2012-01-18 15:24        --------        d-----w-        c:\users\Labe\AppData\Roaming\Babylon
2012-01-16 19:50 . 2012-01-16 19:50        --------        d-----w-        C:\_OTL
2012-01-15 12:21 . 2012-01-15 12:21        --------        d-----w-        c:\program files (x86)\ESET
2012-01-15 12:20 . 2012-01-15 12:21        --------        d-----w-        c:\windows\Downloaded Program Files
2012-01-15 12:14 . 2012-01-15 12:14        --------        d-----w-        c:\users\Labe\AppData\Roaming\Malwarebytes
2012-01-15 12:14 . 2012-01-15 12:14        --------        d-----w-        c:\programdata\Malwarebytes
2012-01-07 23:58 . 2011-10-26 05:19        43520        ----a-w-        c:\windows\system32\csrsrv.dll
2012-01-07 23:58 . 2011-11-05 05:26        1197568        ----a-w-        c:\windows\system32\wininet.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-29 18:39 . 2010-11-25 21:54        544656        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2011-11-29 16:38 . 2010-12-09 19:08        45056        ----a-w-        c:\windows\system32\acovcnt.exe
2009-04-08 17:31 . 2009-04-08 17:31        106496        ----a-w-        c:\program files (x86)\Common Files\CPInstallAction.dll
2008-08-12 04:45 . 2008-08-12 04:45        155648        ----a-w-        c:\program files (x86)\Common Files\MSIactionall.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{00cbb66b-1d3b-46d3-9577-323a336acb50}]
2011-10-27 09:25        225584        ----a-w-        c:\program files (x86)\BrowserCompanion\jsloader.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{963B125B-8B21-49A2-A3A8-E37092276531}]
2011-10-27 09:25        141104        ----a-w-        c:\program files (x86)\BrowserCompanion\updatebhoWin32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-31 102400]
"IMBooster"="c:\program files (x86)\Iminent\IMBooster\imbooster.exe" [2011-03-30 1324008]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-05-04 252136]
"Browser companion helper"="c:\program files (x86)\BrowserCompanion\BCHelper.exe" [2011-12-16 187696]
.
c:\users\Labe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 135664]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 135664]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S3 JME;JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits);c:\windows\system32\DRIVERS\JME.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 18:28]
.
2012-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 18:28]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL =
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube to MP3 Converter - c:\users\Labe\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.178.1
Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll
Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll
Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-{FD5A97AF-98ED-11DF-8EB8-806E6F6E6963} - c:\users\Labe\AppData\Roaming\Microsoft\svhcost.exe
Wow6432Node-HKLM-Run-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe
WebBrowser-{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - (no file)
AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe
AddRemove-{2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_E582EA556D8DE101.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10w_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10w_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-01-19  12:53:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-01-19 11:53
.
Vor Suchlauf: 6 Verzeichnis(se), 30.934.016.000 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 30.836.871.168 Bytes frei
.
- - End Of File - - BC03FFC0C2A10DA27FD3F5184674792A

Monaa 19.01.2012 13:03
Code:
ComboFix 12-01-18.04 - Labe 19.01.2012  12:20:57.1.2 - x64 NETWORK
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.4094.3477 [GMT 1:00]
ausgeführt von:: c:\users\Labe\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.

       
Code:

       
ComboFix 12-01-18.04 - Labe 19.01.2012  12:20:57.1.2 - x64 NETWORK
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.4094.3477 [GMT 1:00]
ausgeführt von:: c:\users\Labe\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\ASPG_icon.ico
c:\program files (x86)\facemoods.com
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.crx
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.png
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsApp.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsEng.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe
c:\program files (x86)\facemoods.com\sqlite3.dll
c:\programdata\FullRemove.exe
c:\programdata\Tarma Installer
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setup.dll
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.dat
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.exe
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.ico
c:\users\Labe\AppData\Roaming\Microsoft\svhcost.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-12-19 bis 2012-01-19  ))))))))))))))))))))))))))))))
.
.
2012-01-19 10:53 . 2012-01-19 10:53        --------        d-----w-        c:\program files (x86)\Electronic Arts
2012-01-18 15:24 . 2012-01-18 15:24        --------        d-----w-        c:\program files (x86)\BrowserCompanion
2012-01-18 15:24 . 2012-01-18 15:24        --------        d-----w-        c:\users\Labe\AppData\Roaming\Babylon
2012-01-16 19:50 . 2012-01-16 19:50        --------        d-----w-        C:\_OTL
2012-01-15 12:21 . 2012-01-15 12:21        --------        d-----w-        c:\program files (x86)\ESET
2012-01-15 12:20 . 2012-01-15 12:21        --------        d-----w-        c:\windows\Downloaded Program Files
2012-01-15 12:14 . 2012-01-15 12:14        --------        d-----w-        c:\users\Labe\AppData\Roaming\Malwarebytes
2012-01-15 12:14 . 2012-01-15 12:14        --------        d-----w-        c:\programdata\Malwarebytes
2012-01-07 23:58 . 2011-10-26 05:19        43520        ----a-w-        c:\windows\system32\csrsrv.dll
2012-01-07 23:58 . 2011-11-05 05:26        1197568        ----a-w-        c:\windows\system32\wininet.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-29 18:39 . 2010-11-25 21:54        544656        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2011-11-29 16:38 . 2010-12-09 19:08        45056        ----a-w-        c:\windows\system32\acovcnt.exe
2009-04-08 17:31 . 2009-04-08 17:31        106496        ----a-w-        c:\program files (x86)\Common Files\CPInstallAction.dll
2008-08-12 04:45 . 2008-08-12 04:45        155648        ----a-w-        c:\program files (x86)\Common Files\MSIactionall.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{00cbb66b-1d3b-46d3-9577-323a336acb50}]
2011-10-27 09:25        225584        ----a-w-        c:\program files (x86)\BrowserCompanion\jsloader.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{963B125B-8B21-49A2-A3A8-E37092276531}]
2011-10-27 09:25        141104        ----a-w-        c:\program files (x86)\BrowserCompanion\updatebhoWin32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-31 102400]
"IMBooster"="c:\program files (x86)\Iminent\IMBooster\imbooster.exe" [2011-03-30 1324008]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-05-04 252136]
"Browser companion helper"="c:\program files (x86)\BrowserCompanion\BCHelper.exe" [2011-12-16 187696]
.
c:\users\Labe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 135664]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 135664]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S3 JME;JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits);c:\windows\system32\DRIVERS\JME.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 18:28]
.
2012-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 18:28]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL =
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube to MP3 Converter - c:\users\Labe\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.178.1
Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll
Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll
Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-{FD5A97AF-98ED-11DF-8EB8-806E6F6E6963} - c:\users\Labe\AppData\Roaming\Microsoft\svhcost.exe
Wow6432Node-HKLM-Run-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe
WebBrowser-{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - (no file)
AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe
AddRemove-{2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_E582EA556D8DE101.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10w_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10w_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-01-19  12:53:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-01-19 11:53
.
Vor Suchlauf: 6 Verzeichnis(se), 30.934.016.000 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 30.836.871.168 Bytes frei
.
- - End Of File - - BC03FFC0C2A10DA27FD3F5184674792A

.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\ASPG_icon.ico
c:\program files (x86)\facemoods.com
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.crx
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.png
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsApp.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsEng.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe
c:\program files (x86)\facemoods.com\sqlite3.dll
c:\programdata\FullRemove.exe
c:\programdata\Tarma Installer
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setup.dll
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.dat
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.exe
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.ico
c:\users\Labe\AppData\Roaming\Microsoft\svhcost.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-19 bis 2012-01-19  ))))))))))))))))))))))))))))))
.
.
2012-01-19 10:53 . 2012-01-19 10:53        --------        d-----w-        c:\program files (x86)\Electronic Arts
2012-01-18 15:24 . 2012-01-18 15:24        --------        d-----w-        c:\program files (x86)\BrowserCompanion
2012-01-18 15:24 . 2012-01-18 15:24        --------        d-----w-        c:\users\Labe\AppData\Roaming\Babylon
2012-01-16 19:50 . 2012-01-16 19:50        --------        d-----w-        C:\_OTL
2012-01-15 12:21 . 2012-01-15 12:21        --------        d-----w-        c:\program files (x86)\ESET
2012-01-15 12:20 . 2012-01-15 12:21        --------        d-----w-        c:\windows\Downloaded Program Files
2012-01-15 12:14 . 2012-01-15 12:14        --------        d-----w-        c:\users\Labe\AppData\Roaming\Malwarebytes
2012-01-15 12:14 . 2012-01-15 12:14        --------        d-----w-        c:\programdata\Malwarebytes
2012-01-07 23:58 . 2011-10-26 05:19        43520        ----a-w-        c:\windows\system32\csrsrv.dll
2012-01-07 23:58 . 2011-11-05 05:26        1197568        ----a-w-        c:\windows\system32\wininet.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-29 18:39 . 2010-11-25 21:54        544656        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2011-11-29 16:38 . 2010-12-09 19:08        45056        ----a-w-        c:\windows\system32\acovcnt.exe
2009-04-08 17:31 . 2009-04-08 17:31        106496        ----a-w-        c:\program files (x86)\Common Files\CPInstallAction.dll
2008-08-12 04:45 . 2008-08-12 04:45        155648        ----a-w-        c:\program files (x86)\Common Files\MSIactionall.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{00cbb66b-1d3b-46d3-9577-323a336acb50}]
2011-10-27 09:25        225584        ----a-w-        c:\program files (x86)\BrowserCompanion\jsloader.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{963B125B-8B21-49A2-A3A8-E37092276531}]
2011-10-27 09:25        141104        ----a-w-        c:\program files (x86)\BrowserCompanion\updatebhoWin32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-31 102400]
"IMBooster"="c:\program files (x86)\Iminent\IMBooster\imbooster.exe" [2011-03-30 1324008]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-05-04 252136]
"Browser companion helper"="c:\program files (x86)\BrowserCompanion\BCHelper.exe" [2011-12-16 187696]
.
c:\users\Labe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 135664]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 135664]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S3 JME;JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits);c:\windows\system32\DRIVERS\JME.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 18:28]
.
2012-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-29 18:28]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL =
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube to MP3 Converter - c:\users\Labe\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.178.1
Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll
Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll
Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - c:\program files (x86)\BrowserCompanion\tdataprotocol.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-{FD5A97AF-98ED-11DF-8EB8-806E6F6E6963} - c:\users\Labe\AppData\Roaming\Microsoft\svhcost.exe
Wow6432Node-HKLM-Run-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe
WebBrowser-{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - (no file)
AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe
AddRemove-{2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_E582EA556D8DE101.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10w_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10w_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10w.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-01-19  12:53:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-01-19 11:53
.
Vor Suchlauf: 6 Verzeichnis(se), 30.934.016.000 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 30.836.871.168 Bytes frei
.
- - End Of File - - BC03FFC0C2A10DA27FD3F5184674792A

cosinus 19.01.2012 16:31
Zitat:
Boot type: Safe boot with network
Wiesoeigentlich immer noch der Modus? Geht der abgesicherte Modus immer noch nicht?

Monaa 19.01.2012 16:47
Doch doch der funktioniert und übrigens der Normal Modus funktioniert jetzt auch wieder. :D Dankeschöööööööön :D

cosinus 19.01.2012 16:50
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Monaa 19.01.2012 16:58
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-19 16:52:29
-----------------------------
16:52:29.340    OS Version: Windows x64 6.1.7600
16:52:29.340    Number of processors: 2 586 0x603
16:52:29.340    ComputerName: LABE-PC  UserName: Labe
16:52:30.603    Initialize success
16:53:13.785    AVAST engine defs: 12011901
16:54:50.661    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005d
16:54:50.677    Disk 0 Vendor: WDC_WD32 01.0 Size: 305245MB BusType: 11
16:54:50.692    Disk 0 MBR read successfully
16:54:50.692    Disk 0 MBR scan
16:54:50.708    Disk 0 Windows 7 default MBR code
16:54:50.708    Disk 0 Partition 1 00    1C Hidd FAT32 LBA MSDOS5.0    20002 MB offset 63
16:54:50.739    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        76308 MB offset 40965750
16:54:50.739    Disk 0 Partition - 00    0F Extended LBA            208932 MB offset 197246976
16:54:50.770    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      208931 MB offset 197249024
16:54:50.786    Service scanning
16:54:52.284    Modules scanning
16:54:52.315    Disk 0 trace - called modules:
16:54:52.346    ntoskrnl.exe CLASSPNP.SYS disk.sys amdxata.sys storport.sys hal.dll amdsata.sys
16:54:52.362    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004b0e060]
16:54:52.377    3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8004a8e4e0]
16:54:52.377    5 amdxata.sys[fffff880010867a8] -> nt!IofCallDriver -> \Device\0000005d[0xfffffa8004a86580]
16:54:53.001    AVAST engine scan C:\Windows
16:54:55.872    AVAST engine scan C:\Windows\system32
16:56:16.383    AVAST engine scan C:\Windows\system32\drivers
16:56:25.728    AVAST engine scan C:\Users\Labe
16:56:51.717    Disk 0 MBR has been saved successfully to "C:\Users\Labe\Documents\MBR.dat"
16:56:51.733    The log file has been saved successfully to "C:\Users\Labe\Documents\aswMBR.txt"
16:57:30.184    Disk 0 MBR has been saved successfully to "C:\Users\Labe\Desktop\MBR.dat"
16:57:30.184    The log file has been saved successfully to "C:\Users\Labe\Desktop\aswMBR.txt"

cosinus 19.01.2012 21:21
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Monaa 20.01.2012 19:34
Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.20.02

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Labe :: LABE-PC [Administrator]

20.01.2012 18:58:20
mbam-log-2012-01-20 (19-34-02).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 310262
Laufzeit: 35 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Qoobox\Quarantine\C\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe.vir (Malware.Packer) -> Keine Aktion durchgeführt.
C:\Users\Labe\Desktop\SoftonicDownloader_fuer_kaspersky-tdsskiller.exe (PUP.BundleOffer.Downloader.S) -> Keine Aktion durchgeführt.
C:\Users\Labe\Downloads\SoftonicDownloader_for_java-runtime-environment.exe (PUP.BundleOffer.Downloader.S) -> Keine Aktion durchgeführt.

(Ende)

Monaa 20.01.2012 20:42
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/20/2012 at 08:37 PM

Application Version : 5.0.1142

Core Rules Database Version : 8150
Trace Rules Database Version: 5962

Scan type      : Complete Scan
Total Scan Time : 00:59:56

Operating System Information
Windows 7 Home Premium 64-bit (Build 6.01.7600)
UAC Off - Administrator

Memory items scanned      : 598
Memory threats detected  : 0
Registry items scanned    : 69480
Registry threats detected : 4
File items scanned        : 54696
File threats detected    : 563

Browser Hijacker.Deskbar
        (x86) HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
        (x86) HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\ProxyStubClsid32
        (x86) HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib
        (x86) HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib#Version

Adware.Tracking Cookie
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@ad2.adfarm1.adition[1].txt [ /ad2.adfarm1.adition ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@ad2.adfarm1.adition[2].txt [ /ad2.adfarm1.adition ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@ads.creative-serving[2].txt [ /ads.creative-serving ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@adserver[1].txt [ /adserver ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt.combing[2].txt [ /atdmt.combing ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt.combing[3].txt [ /atdmt.combing ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt.combing[4].txt [ /atdmt.combing ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt.combing[5].txt [ /atdmt.combing ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt[10].txt [ /atdmt ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt[2].txt [ /atdmt ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt[3].txt [ /atdmt ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt[4].txt [ /atdmt ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt[5].txt [ /atdmt ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt[6].txt [ /atdmt ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt[7].txt [ /atdmt ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt[8].txt [ /atdmt ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@atdmt[9].txt [ /atdmt ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@bs.serving-sys[1].txt [ /bs.serving-sys ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@collective-media[2].txt [ /collective-media ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@content.yieldmanager[1].txt [ /content.yieldmanager ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@content.yieldmanager[2].txt [ /content.yieldmanager ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@content.yieldmanager[4].txt [ /content.yieldmanager ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@eaeacom.112.2o7[1].txt [ /eaeacom.112.2o7 ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@imrworldwide[2].txt [ /imrworldwide ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@microsoftxbox.112.2o7[1].txt [ /microsoftxbox.112.2o7 ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@msnportal.112.2o7[1].txt [ /msnportal.112.2o7 ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@postadserver.anschlusstor[1].txt [ /postadserver.anschlusstor ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@revsci[1].txt [ /revsci ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@revsci[2].txt [ /revsci ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@revsci[4].txt [ /revsci ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@serving-sys[2].txt [ /serving-sys ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@vdwp.solution.weborama[2].txt [ /vdwp.solution.weborama ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@weborama[1].txt [ /weborama ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\labe@www.windowsmedia[2].txt [ /www.windowsmedia ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\YRC8QIKQ.txt [ /kaspersky.122.2o7.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\UO3XUQ37.txt [ /zanox.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\D2UJFPZD.txt [ /imrworldwide.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\205S7LXH.txt [ /ad.yieldmanager.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\S31LXWKZ.txt [ /apmebf.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\GPFU8ZJC.txt [ /traffictrack.de ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\DKVL6YGW.txt [ /adfarm1.adition.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\299RJ3C8.txt [ /questionmarket.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\OP9E1I7V.txt [ /fastclick.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\GQV1MXX9.txt [ /mediaplex.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\14EBAO4V.txt [ /webmasterplan.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\G8OKY69B.txt [ /studivz.adfarm1.adition.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\TD5JNEWQ.txt [ /yadro.ru ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\4ZEYHPGF.txt [ /invitemedia.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\6EDOM5Y0.txt [ /ad2.adfarm1.adition.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\SRCFRSW7.txt [ /doubleclick.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\D4749HP3.txt [ /tribalfusion.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\K0VLEKOP.txt [ /ad.zanox.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\WS5T0EBV.txt [ /content.yieldmanager.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\D746RFDG.txt [ /tradedoubler.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\Y758GCCM.txt [ /zanox-affiliate.de ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\MH5RS149.txt [ /ad12.bannerbank.ru ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\3NR0051F.txt [ /xiti.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\W2EHREX0.txt [ /ad3.adfarm1.adition.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\7D15HGZ7.txt [ /lucidmedia.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\8Q5LGO2L.txt [ /superrtl.122.2o7.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\9ACTY3FT.txt [ /serving-sys.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\81TY2M5R.txt [ /c.atdmt.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\QA6UAOXT.txt [ /atdmt.combing.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\PAS8SV1K.txt [ /bs.serving-sys.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\PHTH6P16.txt [ /smartadserver.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\1QDL5ROZ.txt [ /ru4.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\FOEDNE18.txt [ /content.yieldmanager.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\5Q6IXSG0.txt [ /specificclick.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\J3I0TKTY.txt [ /media6degrees.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\72H3WBWB.txt [ /ad4.adfarm1.adition.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\DBXF62FM.txt [ /ad.adnet.de ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\NOFWD4TU.txt [ /mediafire.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\A0XZ10G1.txt [ /www.googleadservices.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\55X4DSEY.txt [ /adxpose.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\FQ0JECHD.txt [ /rambler.ru ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\77MXSUY9.txt [ /tracking.quisma.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\3WDBBUDB.txt [ /atdmt.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\96HLEIH0.txt [ /h.atdmt.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\JOEZ2BPJ.txt [ /ad.ad-srv.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\QACN27PF.txt [ /ads.carocean.co.uk ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\LTXBQQEX.txt [ /unitymedia.de ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Q4NSM3TY.txt [ Cookie:labe@clkads.com/adServe/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\O3Z53657.txt [ Cookie:labe@clkads.com/adServe/banners ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@www.adsmediapro[2].txt [ Cookie:labe@www.adsmediapro.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@himedia.individuad[1].txt [ Cookie:labe@himedia.individuad.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@adserver.traffictrack[2].txt [ Cookie:labe@adserver.traffictrack.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\LIFT7F69.txt [ Cookie:labe@revsci.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\R7LEALPW.txt [ Cookie:labe@ad.adserver01.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\RI5HB4KX.txt [ Cookie:labe@weborama.fr/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@microsoftmachinetranslation.112.2o7[1].txt [ Cookie:labe@microsoftmachinetranslation.112.2o7.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@solarium-finder[1].txt [ Cookie:labe@solarium-finder.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@adsrv.admediate[2].txt [ Cookie:labe@adsrv.admediate.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@profilbanner[2].txt [ Cookie:labe@profilbanner.me/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@vodafonegroup.122.2o7[1].txt [ Cookie:labe@vodafonegroup.122.2o7.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@imrworldwide[2].txt [ Cookie:labe@imrworldwide.com/cgi-bin ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\14P3UKEX.txt [ Cookie:labe@ad.yieldmanager.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\U5KX2KRP.txt [ Cookie:labe@www.femaleaffairs.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\MPEM03PW.txt [ Cookie:labe@fl01.ct2.comclick.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\OWPTVN88.txt [ Cookie:labe@questionmarket.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\V641OFOA.txt [ Cookie:labe@ad1.adfarm1.adition.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@ads.quartermedia[2].txt [ Cookie:labe@ads.quartermedia.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@estat[1].txt [ Cookie:labe@estat.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@overture[1].txt [ Cookie:labe@overture.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\E7TXZJKR.txt [ Cookie:labe@studivz.adfarm1.adition.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\TFB2FTSV.txt [ Cookie:labe@casalemedia.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\W517JAOH.txt [ Cookie:labe@ad2.adfarm1.adition.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\TX5778B8.txt [ Cookie:labe@track.adform.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\11VI9Q3Y.txt [ Cookie:labe@doubleclick.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@yieldmanager[1].txt [ Cookie:labe@yieldmanager.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\VNW34PUE.txt [ Cookie:labe@tribalfusion.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\ES167FGE.txt [ Cookie:labe@ad.zanox.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@vinvest.122.2o7[1].txt [ Cookie:labe@vinvest.122.2o7.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\BJ2KMQIK.txt [ Cookie:labe@content.yieldmanager.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\QE4ON1FS.txt [ Cookie:labe@adtech.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\E75EOZE1.txt [ Cookie:labe@tradedoubler.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@insightexpressai[1].txt [ Cookie:labe@insightexpressai.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\0NWRUXIS.txt [ Cookie:labe@rts.pgmediaserve.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\N6GJA8T7.txt [ Cookie:labe@zanox-affiliate.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@tracking.kissmyads[1].txt [ Cookie:labe@tracking.kissmyads.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@xiti[1].txt [ Cookie:labe@xiti.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@superrtl.122.2o7[1].txt [ Cookie:labe@superrtl.122.2o7.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\74XAR5SS.txt [ Cookie:labe@serving-sys.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z0YHERQL.txt [ Cookie:labe@www.zanox-affiliate.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@de.sitestat[2].txt [ Cookie:labe@de.sitestat.com/sueddeutsche/sueddeutsche/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\HBDAN6L6.txt [ Cookie:labe@bs.serving-sys.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@clkads[2].txt [ Cookie:labe@clkads.com/adServe/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@rotator.adjuggler[1].txt [ Cookie:labe@rotator.adjuggler.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\4XUV4HLL.txt [ Cookie:labe@partypoker.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\7DHH8HB1.txt [ Cookie:labe@2o7.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@vdwp.solution.weborama[2].txt [ Cookie:labe@vdwp.solution.weborama.fr/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@de.sitestat[1].txt [ Cookie:labe@de.sitestat.com/idgcom-de/pcwelt/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\V8P6MFF8.txt [ Cookie:labe@tracking.quisma.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@www.mediamarkt[1].txt [ Cookie:labe@www.mediamarkt.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@myroitracking[1].txt [ Cookie:labe@myroitracking.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\PP4JWQQ0.txt [ Cookie:labe@tracking.mindshare.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\9LK7WHPR.txt [ Cookie:labe@adbrite.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\OHM5W4EP.txt [ Cookie:labe@clkads.com/adServe/banners ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@track.effiliation[1].txt [ Cookie:labe@track.effiliation.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\FUKLLEEU.txt [ Cookie:labe@advertising.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@skydeutschland.122.2o7[1].txt [ Cookie:labe@skydeutschland.122.2o7.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@adecn[1].txt [ Cookie:labe@adecn.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\PYWXCXMY.txt [ Cookie:labe@ad.adition.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\C5Y1H0LM.txt [ Cookie:labe@www.googleadservices.com/pagead/conversion/995553404/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@tags.trackinganalytics[4].txt [ Cookie:labe@tags.trackinganalytics.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@media.gan-online[3].txt [ Cookie:labe@media.gan-online.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\NVB7L3FE.txt [ Cookie:labe@clkads.com/adServe/static/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\IYQ1S7FJ.txt [ Cookie:labe@account.live.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@mediabrandsww[1].txt [ Cookie:labe@mediabrandsww.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\OVOKLK3E.txt [ Cookie:labe@im.banner.t-online.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@adserver2.clipkit[2].txt [ Cookie:labe@adserver2.clipkit.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@mmstat[1].txt [ Cookie:labe@mmstat.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\077W5KXD.txt [ Cookie:labe@leylines.solution.weborama.fr/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\VE2PK7RU.txt [ Cookie:labe@vagosex.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@stat.youku[1].txt [ Cookie:labe@stat.youku.com/player/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\ICEOJ07N.txt [ Cookie:labe@viewablemedia.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@track.effiliation[2].txt [ Cookie:labe@track.effiliation.com/servlet/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@tto2.traffictrack[1].txt [ Cookie:labe@tto2.traffictrack.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@beacons.hottraffic[1].txt [ Cookie:labe@beacons.hottraffic.nl/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\DVRU6EXH.txt [ Cookie:labe@stat.dealtime.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@microsoftwlsearchcrm.112.2o7[1].txt [ Cookie:labe@microsoftwlsearchcrm.112.2o7.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\6OEJ1JUM.txt [ Cookie:labe@eas.apm.emediate.eu/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@ad.dyntracker[1].txt [ Cookie:labe@ad.dyntracker.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\3VHC2CGI.txt [ Cookie:labe@adsby.aim4media.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\3E2DIJSE.txt [ Cookie:labe@zbox.zanox.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@a.revenuemax[1].txt [ Cookie:labe@a.revenuemax.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@mediamarkt[1].txt [ Cookie:labe@mediamarkt.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\BSZ3B2WX.txt [ Cookie:labe@de.sitestat.com/is24/is24/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\HF5LW934.txt [ Cookie:labe@lucidmedia.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\HXIEO94Z.txt [ Cookie:labe@ad.dyntracker.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@linksynergy[2].txt [ Cookie:labe@linksynergy.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\IVQRYMR7.txt [ Cookie:labe@atdmt.combing.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@my.brandwire[2].txt [ Cookie:labe@my.brandwire.tv/Brandwire/deliverAd/flashBannerXml/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\XL8ECNXP.txt [ Cookie:labe@smartadserver.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z47LJ32I.txt [ Cookie:labe@pro-market.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\4ULIMYV6.txt [ Cookie:labe@ru4.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@specificclick[1].txt [ Cookie:labe@specificclick.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@secmedia[1].txt [ Cookie:labe@secmedia.de/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\N712LFXW.txt [ Cookie:labe@adform.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\K8S0ECKZ.txt [ Cookie:labe@ad4.adfarm1.adition.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZAIMHAJ1.txt [ Cookie:labe@medialand.ru/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\63B3OE11.txt [ Cookie:labe@counter2.sexmoney.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\LLR2G8PU.txt [ Cookie:labe@www.googleadservices.com/pagead/conversion/1056156246/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\VRVASCS3.txt [ Cookie:labe@paypal.112.2o7.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@www.1nate[7].txt [ Cookie:labe@www.1nate.com/ladyxxxx/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\IQ3T3KQE.txt [ Cookie:labe@rambler.ru/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@tns-counter[1].txt [ Cookie:labe@tns-counter.ru/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y7095MK0.txt [ Cookie:labe@atdmt.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\09I5DMOD.txt [ Cookie:labe@h.atdmt.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\FPJAPAUR.txt [ Cookie:labe@deutschepostag.112.2o7.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\BPFAK32D.txt [ Cookie:labe@www.google.com/adsense/support/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\O4GOU0GA.txt [ Cookie:labe@zanox.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\T7AIYHGD.txt [ Cookie:labe@tracking.gameforge.de/track/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZT0Y4POF.txt [ Cookie:labe@trafficmp.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@adserver3.spele[1].txt [ Cookie:labe@adserver3.spele.nl/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\N02CMHFK.txt [ Cookie:labe@www.xxxphilxxx.de.tl/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@interclick[2].txt [ Cookie:labe@interclick.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\UCOEQIA8.txt [ Cookie:labe@count.rbc.ru/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\GNWT1HU9.txt [ Cookie:labe@ich.adscale.de/adserver-ich/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\O8NDIVH8.txt [ Cookie:labe@cmtrack.pkmgvps1.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\TROXTHDV.txt [ Cookie:labe@www.burstnet.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\0HEKMWT1.txt [ Cookie:labe@www.googleadservices.com/pagead/conversion/1069865252/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\B36OY38Z.txt [ Cookie:labe@xxxphilxxx.de.tl/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\1IBGWUD4.txt [ Cookie:labe@hightraffic.hugoboss.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\K4SHN9NQ.txt [ Cookie:labe@track.webtrekk.de/398813561196316/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\RDOGZ6B6.txt [ Cookie:labe@www.googleadservices.com/pagead/conversion/1054810973/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\YQ5NFZD2.txt [ Cookie:labe@histats.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\7Z4T13Z2.txt [ Cookie:labe@ero-advertising.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\JMSCC9V3.txt [ Cookie:labe@nestlecereals.solution.weborama.fr/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@youporn[1].txt [ Cookie:labe@youporn.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\RDZBRC3H.txt [ Cookie:labe@tracking.mlsat02.de/tmobile/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\P4B5AR9B.txt [ Cookie:labe@www.vagosex.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\5ESIN1P8.txt [ Cookie:labe@ads2.makemereach.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\7FQ0KEEX.txt [ Cookie:labe@procter.solution.weborama.fr/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\labe@www.google[4].txt [ Cookie:labe@www.google.com/accounts ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\KDQBRQMK.txt [ Cookie:labe@google.com/adsense/support/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\RYXG150Z.txt [ Cookie:labe@guj.122.2o7.net/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\1RWI6X0J.txt [ Cookie:labe@ipadde.mobiletraffic.trafficjmp.com/ ]
        C:\USERS\LABE\AppData\Roaming\Microsoft\Windows\Cookies\Low\MH87WR0O.txt [ Cookie:labe@advertising.superweb.de/ ]
        C:\USERS\LABE\Cookies\YRC8QIKQ.txt [ Cookie:labe@kaspersky.122.2o7.net/ ]
        C:\USERS\LABE\Cookies\UO3XUQ37.txt [ Cookie:labe@zanox.com/ ]
        C:\USERS\LABE\Cookies\D2UJFPZD.txt [ Cookie:labe@imrworldwide.com/cgi-bin ]
        C:\USERS\LABE\Cookies\205S7LXH.txt [ Cookie:labe@ad.yieldmanager.com/ ]
        C:\USERS\LABE\Cookies\299RJ3C8.txt [ Cookie:labe@questionmarket.com/ ]
        C:\USERS\LABE\Cookies\G8OKY69B.txt [ Cookie:labe@studivz.adfarm1.adition.com/ ]
        C:\USERS\LABE\Cookies\TD5JNEWQ.txt [ Cookie:labe@yadro.ru/ ]
        C:\USERS\LABE\Cookies\6EDOM5Y0.txt [ Cookie:labe@ad2.adfarm1.adition.com/ ]
        C:\USERS\LABE\Cookies\SRCFRSW7.txt [ Cookie:labe@doubleclick.net/ ]
        C:\USERS\LABE\Cookies\D4749HP3.txt [ Cookie:labe@tribalfusion.com/ ]
        C:\USERS\LABE\Cookies\K0VLEKOP.txt [ Cookie:labe@ad.zanox.com/ ]
        C:\USERS\LABE\Cookies\WS5T0EBV.txt [ Cookie:labe@content.yieldmanager.com/ ]
        C:\USERS\LABE\Cookies\D746RFDG.txt [ Cookie:labe@tradedoubler.com/ ]
        C:\USERS\LABE\Cookies\Y758GCCM.txt [ Cookie:labe@zanox-affiliate.de/ ]
        C:\USERS\LABE\Cookies\MH5RS149.txt [ Cookie:labe@ad12.bannerbank.ru/ ]
        C:\USERS\LABE\Cookies\3NR0051F.txt [ Cookie:labe@xiti.com/ ]
        C:\USERS\LABE\Cookies\7D15HGZ7.txt [ Cookie:labe@lucidmedia.com/ ]
        C:\USERS\LABE\Cookies\8Q5LGO2L.txt [ Cookie:labe@superrtl.122.2o7.net/ ]
        C:\USERS\LABE\Cookies\9ACTY3FT.txt [ Cookie:labe@serving-sys.com/ ]
        C:\USERS\LABE\Cookies\81TY2M5R.txt [ Cookie:labe@c.atdmt.com/ ]
        C:\USERS\LABE\Cookies\QA6UAOXT.txt [ Cookie:labe@atdmt.combing.com/ ]
        C:\USERS\LABE\Cookies\PAS8SV1K.txt [ Cookie:labe@bs.serving-sys.com/ ]
        C:\USERS\LABE\Cookies\Q4NSM3TY.txt [ Cookie:labe@clkads.com/adServe/ ]
        C:\USERS\LABE\Cookies\PHTH6P16.txt [ Cookie:labe@smartadserver.com/ ]
        C:\USERS\LABE\Cookies\1QDL5ROZ.txt [ Cookie:labe@ru4.com/ ]
        C:\USERS\LABE\Cookies\5Q6IXSG0.txt [ Cookie:labe@specificclick.net/ ]
        C:\USERS\LABE\Cookies\72H3WBWB.txt [ Cookie:labe@ad4.adfarm1.adition.com/ ]
        C:\USERS\LABE\Cookies\FQ0JECHD.txt [ Cookie:labe@rambler.ru/ ]
        C:\USERS\LABE\Cookies\77MXSUY9.txt [ Cookie:labe@tracking.quisma.com/ ]
        C:\USERS\LABE\Cookies\3WDBBUDB.txt [ Cookie:labe@atdmt.com/ ]
        C:\USERS\LABE\Cookies\96HLEIH0.txt [ Cookie:labe@h.atdmt.com/ ]
        C:\USERS\LABE\Cookies\O3Z53657.txt [ Cookie:labe@clkads.com/adServe/banners ]
        .specificclick.net [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .imrworldwide.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .imrworldwide.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .doubleclick.net [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .doubleclick.net [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adviva.net [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad1.adfarm1.adition.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .bs.serving-sys.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adtech.de [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adtech.de [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        eas.apm.emediate.eu [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        eas.apm.emediate.eu [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        eas.apm.emediate.eu [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adtech.de [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adtech.de [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adtech.de [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adtech.de [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@2O7[1].TXT [ /2O7 ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@2O7[3].TXT [ /2O7 ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@2O7[4].TXT [ /2O7 ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@AD.AD-SRV[2].TXT [ /AD.AD-SRV ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@AD.YIELDMANAGER[1].TXT [ /AD.YIELDMANAGER ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@AD.YIELDMANAGER[3].TXT [ /AD.YIELDMANAGER ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@ADCENTRICONLINE[2].TXT [ /ADCENTRICONLINE ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@ADS.PUBMATIC[1].TXT [ /ADS.PUBMATIC ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@ADS3.NET2DAY[2].TXT [ /ADS3.NET2DAY ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@ADXPOSE[1].TXT [ /ADXPOSE ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@CONTENT.YIELDMANAGER[3].TXT [ /CONTENT.YIELDMANAGER ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@DE.PARTYPOKER[1].TXT [ /DE.PARTYPOKER ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@LFSTMEDIA[2].TXT [ /LFSTMEDIA ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@MEDIA.GAN-ONLINE[1].TXT [ /MEDIA.GAN-ONLINE ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@MSNPORTAL.112.2O7[1].TXT [ /MSNPORTAL.112.2O7 ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@SMARTADSERVER[1].TXT [ /SMARTADSERVER ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@TAGS.TRACKINGANALYTICS[1].TXT [ /TAGS.TRACKINGANALYTICS ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@TAGS.TRACKINGANALYTICS[3].TXT [ /TAGS.TRACKINGANALYTICS ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@TRACKING.MINDSHARE[2].TXT [ /TRACKING.MINDSHARE ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@TRACKING.QUISMA[3].TXT [ /TRACKING.QUISMA ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@TRAFFICTRACK[2].TXT [ /TRAFFICTRACK ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@UNITYMEDIA[2].TXT [ /UNITYMEDIA ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@WEBMASTERPLAN[2].TXT [ /WEBMASTERPLAN ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@WWW.ACTIVE-TRACKING[2].TXT [ /WWW.ACTIVE-TRACKING ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@ZANOX-AFFILIATE[1].TXT [ /ZANOX-AFFILIATE ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@ZANOX[3].TXT [ /ZANOX ]
        C:\USERS\LABE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LABE@ZANOX[4].TXT [ /ZANOX ]
        openx.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ox-d.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        openx.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        pfatracking.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .yieldmanager.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ads.247activemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        adsrv1.admediate.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.adserver01.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.traffective-tracking.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.traffective-tracking.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .harrenmedianetwork.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .tracking.mindshare.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.usenext.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        studivz.adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        media.gan-online.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .estat.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .tto2.traffictrack.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .banners.victor.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .gostats.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        tomtailor.dyntracker.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .mediatraffic.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.mediatraffic.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .mediatraffic.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adxpose.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        media.gan-online.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        httptrack.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .clickbank.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .clickbank.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.traffective-tracking.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.traffective-tracking.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.traffective-tracking.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        www.traffective-tracking.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .deutschepostag.112.2o7.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]
        edge.jeetyetmedia.com [ C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\COOKIES.SQLITE ]

PotentiallyUnwanted.SoftonicDownloader
        C:\USERS\LABE\DESKTOP\SOFTONICDOWNLOADER_FUER_KASPERSKY-TDSSKILLER.EXE
        C:\USERS\LABE\DOWNLOADS\SOFTONICDOWNLOADER_FOR_JAVA-RUNTIME-ENVIRONMENT.EXE
        C:\Windows\Prefetch\SOFTONICDOWNLOADER_FOR_JAVA-R-631101DE.pf

Monaa 20.01.2012 21:09
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=12fe5e923790b643b446158f33c84a31
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-15 01:23:00
# local_time=2012-01-15 02:23:00 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=5893 16776574 66 85 33090612 78260016 0 0
# compatibility_mode=8192 67108863 100 0 3690 3690 0 0
# scanned=166465
# found=24
# cleaned=0
# scan_time=3614
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarApp.dll        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe        probably a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe        probably a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I
C:\Users\All Users\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Babylon\Setup\Setup.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00005e        Win32/SoftonicDownloader application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\0.5988603661861407.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\ICReinstall_PDFCreatorSetup[1].exe        a variant of Win32/InstallCore.E application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\jar_cache6226467159486333906.tmp        Java/Exploit.CVE-2011-3544.B trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\MyBabylonTB.exe        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\YontooSetup-Silent.exe        probably a variant of Win32/Adware.DCVNUWP application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\B821691F-BAB0-7891-A38B-3AB4B9574EDD\MyBabylonTB.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\B821691F-BAB0-7891-A38B-3AB4B9574EDD\Setup.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\ICReinstall\Facemoods.exe        a variant of Win32/InstallCore.D application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\10065f9d-242178b9        Java/TrojanDownloader.OpenStream.NBV trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\58ec35a7-24041eb8        a variant of Java/Exploit.CVE-2010-4452.A trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\Downloads\SoftonicDownloader_for_java-runtime-environment.exe        Win32/SoftonicDownloader application (unable to clean)        00000000000000000000000000000000        I
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=12fe5e923790b643b446158f33c84a31
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-15 01:57:46
# local_time=2012-01-15 02:57:46 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=5893 16776574 66 85 33095358 78264762 0 0
# compatibility_mode=8192 67108863 100 0 8436 8436 0 0
# scanned=30236
# found=12
# cleaned=0
# scan_time=954
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarApp.dll        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe        probably a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe        probably a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I
C:\Users\All Users\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Babylon\Setup\Setup.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00005e        Win32/SoftonicDownloader application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Temp\0.5988603661861407.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I
# version=7
# iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=12fe5e923790b643b446158f33c84a31
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-20 08:01:08
# local_time=2012-01-20 09:01:08 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=5893 16776574 66 85 33545534 78714938 0 0
# compatibility_mode=8192 67108863 100 0 458612 458612 0 0
# scanned=149122
# found=15
# cleaned=0
# scan_time=4580
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarApp.dll        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe        probably a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Qoobox\Quarantine\C\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll.vir        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I
C:\Qoobox\Quarantine\C\Users\Labe\AppData\Roaming\Microsoft\svhcost.exe.vir        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\AppData\Local\Babylon\Setup\Setup.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\Desktop\installer_kaspersky_tdsskiller.exe        Win32/Toggle application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\Desktop\SoftonicDownloader_fuer_kaspersky-tdsskiller.exe        Win32/SoftonicDownloader application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Labe\Downloads\SoftonicDownloader_for_java-runtime-environment.exe        Win32/SoftonicDownloader application (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01172012_181715\C_Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe        probably a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01172012_181715\C_Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles\01172012_181715\C_Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

cosinus 23.01.2012 12:49
Viel Babylon-Müll, ein paar Überreste und ein paar Cookies.
In C:\Qoobox bzw. C:\_OTL (Q-Ordner von CF und OTL) sind die Schädlinge isoliert und gut aufgehoben.
Der Rest ist nur Cookies, weg damit. Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Lass mal den letzten Müll mit OTL löschen.

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":Files" muss mitkopiert werden!!!)

Code:
:Files
C:\Program Files (x86)\BabylonToolbar
C:\Users\Labe\AppData\Local\Babylon
C:\Users\Labe\Desktop\SoftonicDownloader*
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Monaa 23.01.2012 16:40
Code:
All processes killed
========== FILES ==========
File\Folder C:\Program Files (x86)\BabylonToolbar not found.
C:\Users\Labe\AppData\Local\Babylon\Setup\HtmlScreens folder moved successfully.
C:\Users\Labe\AppData\Local\Babylon\Setup folder moved successfully.
C:\Users\Labe\AppData\Local\Babylon folder moved successfully.
C:\Users\Labe\Desktop\SoftonicDownloader_fuer_kaspersky-tdsskiller.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: AppData
->Temp folder emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Labe
->Temp folder emptied: 51607718 bytes
->Temporary Internet Files folder emptied: 71322400 bytes
->Java cache emptied: 8952406 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 335383927 bytes
->Flash cache emptied: 12331 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3219051 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1065506919 bytes
 
Total Files Cleaned = 1.465,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 01232012_163635

Files\Folders moved on Reboot...
C:\Users\Labe\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Monaa 23.01.2012 16:40
Ich werde jetzt die Cookies löschen :)

cosinus 23.01.2012 16:47
Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Monaa 23.01.2012 17:49
Ja es ist wieder in Ordnung dankeschöön :D
Könntest du mir vielleicht ein kostenloses Anti Viren Programm empfehlen?

cosinus 23.01.2012 21:24
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.



Zitat:
Könntest du mir vielleicht ein kostenloses Anti Viren Programm empfehlen?
Die Frage - welcher Virenscanner oder ob der installierte reicht - taucht ständig auf.
Der Virenscanner - egal welcher - kann und wird niemals 100% Schutz bieten können. Neue/unbekannte Schädlinge können immer durch die Lappen gehen. Geld ausgeben muss man nicht für einen Scanner, sowas wie Avast oder Microsoft Security Essentials sind für die privaten Gebrauch völlig ausreichend.
Abgesehen davon nutzen verschiedene Virenscanner unterschiedliche Signaturen und Techniken, das führt dazu, dass zB Scanner1 Schädling X entdeckt, aber Schädling Y übersieht. Scanner2 erkennt Schädling Y, dafür aber Schädling X nicht...
Wichtiger ist, dass du dich an Regeln hälst. Der beste Virenscanner bringt nichts, wenn du dich falsch verhälst und fahrlässig/unvorsichtig bist. Airbag und Sicherheitsgurt im Auto sind ja auch keine Gründe dafür auf die Verkehrsregeln zu pfeifen.

Halte Dich am besten grob an diese Regeln:
  1. Sei misstrauisch im Internet und v.a. bei unbekannten E-Mails, sei vorsichtig bei der Herausgabe persönlicher Daten!!
  2. Halte Windows und alle verwendeten Programme immer aktuell - unterstützen kann dich dabei Secunia PSI
  3. Führe regelmäßig Backups auf externe Medien durch
  4. Arbeite mit eingeschränkten Rechten
  5. Nutze sicherere Programme wie zB Opera oder Firefox zum Surfen statt den IE, zum Mailen Thunderbird statt Outlook Express - E-Mails nur als reinen text anzeigen lassen
  6. automatische Wiedergabe von allen Laufwerken komplett deaktivieren, denn das ist ein unnötiges Sicherheitsrisiko
  7. Bei der Installation von Software möglichst darauf achten, dass die Setups aus offiziellen Quellen stammen und du bei der Installation nach Möglichkeit die benutzerdefinierte Methode wählst - dann hast du die Möglichkeit etwaigen Schrott (wie Toolbars oder sowas wie RegistryBooster) abzuwählen, welcher sonst einfach mitinstalliert wird.
  8. Bösartige bzw. ungewollte Sites von vornherein blockieren lassen mit Hilfe der MVPS Hosts File => Blocking Unwanted Parasites with a Hosts File
  9. Finger weg von: TuneUp, Registry-Cleanern aller Art, Softonic sowie illegalen Cracks/Keygens oder anderen "Tools" um ein kommerzielles Programm ohne Lizenz nutzen zu können
  10. dubiose Seiten bzw. Kinofilm-Streaming-Portale ebenfalls sein lassen, erstens handelt man sich dort schnell Malware ein oder kann in Abofallen geraten und zweitens bewegen sich diese Seiten in einer rechtlichen Grauzone.

Monaa 23.01.2012 22:17
Okey danke nochmals ich werde alles beachten! :D

Monaa 11.02.2012 20:28
Hey cosinus, ich habe das gleich Problem wieder :( Die meldung ist wieder da .. :((((( Was nun?

cosinus 12.02.2012 14:24
Dann hast du deine Programme nicht konsequent aktualisiert :nixda:

Mach neue Durchgänge (Vollscans) mit Malwarebytes und SASW im abgesicherten Modus mit Netzwertreibern

Monaa 13.02.2012 16:58
Oh man ...

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 02/13/2012 at 04:55 PM

Application Version : 5.0.1144

Core Rules Database Version : 8231
Trace Rules Database Version: 6043

Scan type      : Complete Scan
Total Scan Time : 01:07:51

Operating System Information
Windows 7 Home Premium 64-bit (Build 6.01.7600)
UAC Off - Administrator

Memory items scanned      : 392
Memory threats detected  : 0
Registry items scanned    : 63340
Registry threats detected : 0
File items scanned        : 53762
File threats detected    : 80

Adware.Tracking Cookie
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\44LKYGAV.txt [ /zanox.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\QJGDJYDJ.txt [ /revsci.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\ICBQR1CZ.txt [ /statcounter.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\3WUAJ0W4.txt [ /mm.chitika.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\6ERQXI9F.txt [ /ad.360yield.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\2ZIH2LU1.txt [ /imrworldwide.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\AJT0RD05.txt [ /apmebf.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\DFS1LPS6.txt [ /ad.yieldmanager.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\AM4R1J00.txt [ /traffictrack.de ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\MJQG7S16.txt [ /im.banner.t-online.de ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\CRCRFZO8.txt [ /adfarm1.adition.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\I0QPUGZT.txt [ /mediaplex.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\326GL71G.txt [ /webmasterplan.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\NW7NO4D2.txt [ /yadro.ru ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\3MGNYK8F.txt [ /studivz.adfarm1.adition.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\T69X4M0Q.txt [ /invitemedia.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\5QGSU4FL.txt [ /ad2.adfarm1.adition.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\1EVXEK2D.txt [ /track.adform.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\NV1X60LL.txt [ /doubleclick.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\DINRVSMB.txt [ /ads.creative-serving.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\42CN3PD3.txt [ /ad.zanox.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\A6YULTVT.txt [ /adtech.de ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\RFEW2TSP.txt [ /microsoftsto.112.2o7.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\FEIUW3ZD.txt [ /accounts.google.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\BHTE75RB.txt [ /a.revenuemax.de ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\Q01L5Z3E.txt [ /tradedoubler.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\ZKXVCSHG.txt [ /adserver.adreactor.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\W07T6X60.txt [ /ad.adperium.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\UWPJRZBC.txt [ /zanox-affiliate.de ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\W1SNQ14I.txt [ /lucidmedia.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\MX44JQQN.txt [ /ad3.adfarm1.adition.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\V0O5V1EY.txt [ /serving-sys.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\RMYNU270.txt [ /c.atdmt.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\H51KUXIF.txt [ /atdmt.combing.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\QOI6QV42.txt [ /bs.serving-sys.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\C7I09OG3.txt [ /pfa.rotator.hadj7.adjuggler.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\DDTWN1ZR.txt [ /specificclick.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\YGE9EEWJ.txt [ /adform.net ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\42CAAIA5.txt [ /ad4.adfarm1.adition.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\J20FS1UT.txt [ /media6degrees.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\48UX0Z3Z.txt [ /zedo.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\SZ6MKZW8.txt [ /tracking.quisma.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\YDSAYEXK.txt [ /atdmt.com ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\FVA7XEMK.txt [ /adx.chip.de ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\ENTFO9TE.txt [ /unitymedia.de ]
        C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Cookies\NXULWQ6Z.txt [ /pvzstudivz.122.2o7.net ]
        C:\USERS\LABE\Cookies\44LKYGAV.txt [ Cookie:labe@zanox.com/ ]
        C:\USERS\LABE\Cookies\QJGDJYDJ.txt [ Cookie:labe@revsci.net/ ]
        C:\USERS\LABE\Cookies\2ZIH2LU1.txt [ Cookie:labe@imrworldwide.com/cgi-bin ]
        C:\USERS\LABE\Cookies\DFS1LPS6.txt [ Cookie:labe@ad.yieldmanager.com/ ]
        C:\USERS\LABE\Cookies\MJQG7S16.txt [ Cookie:labe@im.banner.t-online.de/ ]
        C:\USERS\LABE\Cookies\NW7NO4D2.txt [ Cookie:labe@yadro.ru/ ]
        C:\USERS\LABE\Cookies\3MGNYK8F.txt [ Cookie:labe@studivz.adfarm1.adition.com/ ]
        C:\USERS\LABE\Cookies\5QGSU4FL.txt [ Cookie:labe@ad2.adfarm1.adition.com/ ]
        C:\USERS\LABE\Cookies\1EVXEK2D.txt [ Cookie:labe@track.adform.net/ ]
        C:\USERS\LABE\Cookies\NV1X60LL.txt [ Cookie:labe@doubleclick.net/ ]
        C:\USERS\LABE\Cookies\42CN3PD3.txt [ Cookie:labe@ad.zanox.com/ ]
        C:\USERS\LABE\Cookies\A6YULTVT.txt [ Cookie:labe@adtech.de/ ]
        C:\USERS\LABE\Cookies\RFEW2TSP.txt [ Cookie:labe@microsoftsto.112.2o7.net/ ]
        C:\USERS\LABE\Cookies\FEIUW3ZD.txt [ Cookie:labe@accounts.google.com/ ]
        C:\USERS\LABE\Cookies\BHTE75RB.txt [ Cookie:labe@a.revenuemax.de/ ]
        C:\USERS\LABE\Cookies\Q01L5Z3E.txt [ Cookie:labe@tradedoubler.com/ ]
        C:\USERS\LABE\Cookies\UWPJRZBC.txt [ Cookie:labe@zanox-affiliate.de/ ]
        C:\USERS\LABE\Cookies\W1SNQ14I.txt [ Cookie:labe@lucidmedia.com/ ]
        C:\USERS\LABE\Cookies\V0O5V1EY.txt [ Cookie:labe@serving-sys.com/ ]
        C:\USERS\LABE\Cookies\RMYNU270.txt [ Cookie:labe@c.atdmt.com/ ]
        C:\USERS\LABE\Cookies\H51KUXIF.txt [ Cookie:labe@atdmt.combing.com/ ]
        C:\USERS\LABE\Cookies\QOI6QV42.txt [ Cookie:labe@bs.serving-sys.com/ ]
        C:\USERS\LABE\Cookies\C7I09OG3.txt [ Cookie:labe@pfa.rotator.hadj7.adjuggler.net/ ]
        C:\USERS\LABE\Cookies\DDTWN1ZR.txt [ Cookie:labe@specificclick.net/ ]
        C:\USERS\LABE\Cookies\YGE9EEWJ.txt [ Cookie:labe@adform.net/ ]
        C:\USERS\LABE\Cookies\42CAAIA5.txt [ Cookie:labe@ad4.adfarm1.adition.com/ ]
        C:\USERS\LABE\Cookies\SZ6MKZW8.txt [ Cookie:labe@tracking.quisma.com/ ]
        C:\USERS\LABE\Cookies\YDSAYEXK.txt [ Cookie:labe@atdmt.com/ ]
        .specificclick.net [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .bs.serving-sys.com [ C:\USERS\LABE\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

Monaa 13.02.2012 16:59
Malwarebytes läuft gerade noch .. :)

Monaa 13.02.2012 17:00
Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.13.03

Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7600.16385
Labe :: MONA-PC [Administrator]

13.02.2012 15:45:17
mbam-log-2012-02-13 (16-59-56).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 308675
Laufzeit: 1 Stunde(n), 14 Minute(n), 28 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ffdwnd (Trojan.VUPX.MTS1) -> Daten: C:\Users\Labe\AppData\Local\Mozilla\Firefox\firefox.exe -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Labe\AppData\Local\Mozilla\Firefox\firefox.exe (Trojan.VUPX.MTS1) -> Keine Aktion durchgeführt.
C:\Users\Labe\AppData\Local\Temp\ms0cfg32.exe (Trojan.VUPX.MTS1) -> Keine Aktion durchgeführt.

(Ende)

cosinus 13.02.2012 22:38
Zitat:
Keine Aktion durchgeführt.
-> No action taken.
Die Funde müssen mit Malwarebytes entfernt waren! Bitte nachholen falls noch nicht getan!

Monaa 14.02.2012 16:36
So?

Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.13.03

Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7600.16385
Labe :: MONA-PC [Administrator]

14.02.2012 16:01:38
mbam-log-2012-02-14 (16-01-38).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 311317
Laufzeit: 33 Minute(n), 5 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus 14.02.2012 17:08
Blockkierung wieder weg?

Monaa 14.02.2012 18:48
Ja sie ist wieder weg danke :)
Aber eine Frage noch es funktionieren sämtliche Programme nicht mehr?
Was kann ich dagegen tun?

cosinus 14.02.2012 20:17
Funktioniert nicht mehr ist eine Fehlerbeschreibung, mit der Helfer aus der Ferne nichts anfangen können. Einfach mal genauer beschreiben

Monaa 14.02.2012 22:49
Ja also wenn ich den Laoptop starte erscheint direkt ein Fenster und dort steht
"Asus WSService.exe funktioniert nicht mehr" und desselbe ist auch mit andern Programmen. . :(

cosinus 15.02.2012 10:44
Mit anderen? Oder mit allen Programmen? Was ist im abgesicherten Modus? Lass dir bitte nicht alles aus der Nase ziehen!

Monaa 15.02.2012 16:38
Mit diesen Programmen:
Asus WSService.exe
Asus LifeFrame
Windows Media Center
Windows PowerShell

Und wenn ich PC Spiele installieren möchte und dann starten will taucht die Meldung (...funktioniert nicht mehr) auf.
Im abgesicherten Modus funktionieren die Programme aber im Normalen leider nicht.

cosinus 15.02.2012 17:02
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Monaa 19.02.2012 14:33
Code:
OTL logfile created on: 19.02.2012 13:33:26 - Run 2
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Labe\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,84 Gb Available Physical Memory | 71,13% Memory free
7,99 Gb Paging File | 6,76 Gb Available in Paging File | 84,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 74,52 Gb Total Space | 30,13 Gb Free Space | 40,43% Space Free | Partition Type: NTFS
Drive D: | 204,03 Gb Total Space | 203,91 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
 
Computer Name: MONA-PC | User Name: Labe | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.02.15 21:45:52 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Labe\Desktop\OTL.exe
PRC - [2012.02.07 12:21:25 | 000,801,792 | ---- | M] (Yuna Software) -- C:\Program Files (x86)\Yuna Software\Messenger Plus!\PlusService.exe
PRC - [2010.07.26 21:42:19 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe
PRC - [2010.05.20 23:59:30 | 011,312,128 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010.05.20 23:59:28 | 011,318,784 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2009.07.31 18:38:26 | 000,428,600 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe
PRC - [2009.07.31 18:38:24 | 000,305,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
PRC - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.08.07 14:54:16 | 000,004,096 | ---- | M] () -- C:\Program Files (x86)\Yuna Software\Messenger Plus!\detour32.dll
MOD - [2010.05.04 15:36:28 | 000,970,752 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.08.12 00:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
SRV:64bit: - [2010.03.30 15:12:23 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.12.08 00:16:34 | 000,379,520 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent)
SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.07.22 17:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS -- (SASDIFSV)
DRV:64bit: - [2011.07.12 22:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS -- (SASKUTIL)
DRV:64bit: - [2010.10.12 09:49:16 | 000,131,552 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\JME.sys -- (JME) JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits)
DRV:64bit: - [2010.07.26 21:40:20 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.04.28 08:57:50 | 000,061,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2010.03.30 15:46:01 | 006,657,536 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.03.30 14:23:33 | 000,195,584 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.03.02 09:45:23 | 001,594,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.10.07 08:13:33 | 000,070,200 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009.10.07 08:13:33 | 000,028,728 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009.10.01 02:22:08 | 000,035,840 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BVRPMPR5a64.SYS -- (BVRPMPR5a64)
DRV:64bit: - [2009.08.20 03:41:37 | 001,800,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV:64bit: - [2009.08.18 09:23:31 | 000,143,472 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:64bit: - [2009.07.23 16:48:59 | 000,119,312 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.07.20 10:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.13 17:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2009.05.05 03:00:27 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2008.11.11 13:42:00 | 000,033,792 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem)
DRV:64bit: - [2008.11.11 13:42:00 | 000,027,136 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag)
DRV:64bit: - [2008.11.11 13:42:00 | 000,017,920 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus)
DRV:64bit: - [2008.05.24 01:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL =
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E4 1C 8D 38 56 D5 CC 01  [binary data]
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.param.yahoo-fr: ""
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.7.0.6
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems:
FF - prefs.js..extensions.enabledItems:
FF - prefs.js..extensions.enabledItems:
FF - prefs.js..extensions.enabledItems:
FF - prefs.js..extensions.enabledItems: {32b29df0-2237-4370-9a29-37cebb730e9b}:3.8.0.8
FF - prefs.js..extensions.enabledItems:
FF - prefs.js..extensions.enabledItems: {77f8c945-4b74-4bd6-a073-e0d1997edce8}:3.8.1.0
FF - prefs.js..browser.search.defaultenginename: "Google"
 
 
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin:  File not found
 
 
[2010.11.20 15:10:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Labe\AppData\Roaming\mozilla\Extensions
[2012.01.18 16:24:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions
[2011.11.11 10:05:40 | 000,000,000 | ---D | M] (FreeSoundRecorder Community Toolbar) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\{32b29df0-2237-4370-9a29-37cebb730e9b}
[2012.01.18 16:24:36 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com
[2012.01.18 16:22:17 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@Facemoods.com
File not found (No name found) -- C:\PROGRAM FILES (X86)\AUTOCOMPLETEPRO\SUPPORT@PREDICTAD.COM
File not found (No name found) -- C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\{635ABD67-4FE9-1B23-4F01-E679FA7484C1}
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\{77F8C945-4B74-4BD6-A073-E0D1997EDCE8}
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\ENGINE@PLASMOO.COM
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\PLUGIN@YONTOO.COM
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.77\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.77\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.77\pdf.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.2.183.13\npGoogleOneClick8.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
 
O1 HOSTS File: ([2012.01.23 16:36:58 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1      localhost
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\..\Toolbar\WebBrowser: (no name) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No CLSID value found.
O4:64bit: - HKLM..\Run: [ASUS WebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe ()
O4 - HKLM..\Run: [PlusService] C:\Program Files (x86)\Yuna Software\Messenger Plus!\PlusService.exe (Yuna Software)
O4 - HKU\S-1-5-21-2454271692-3331149861-715777547-1000..\Run: [Facebook Update] C:\Users\Labe\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-2454271692-3331149861-715777547-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Users\Labe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Labe\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Labe\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9F87DD79-8D1C-4050-A835-17E4BA3B5934}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
 
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)
MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= -  File not found
 
SafeBootMin:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PEVSystemStart - Service
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: procexp90.Sys - Driver
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PEVSystemStart - Service
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: procexp90.Sys - Driver
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PEVSystemStart - Service
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: procexp90.Sys - Driver
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PEVSystemStart - Service
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: procexp90.Sys - Driver
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.VP60 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.18 20:20:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Electronic Arts
[2012.02.15 21:45:52 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Labe\Desktop\OTL.exe
[2012.02.15 21:43:19 | 000,000,000 | R--D | C] -- C:\Users\Labe\Saved Games
[2012.02.15 16:34:46 | 000,000,000 | R--D | C] -- C:\Users\Labe\Documents\Notes
[2012.02.14 20:18:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSBuild
[2012.02.14 20:18:48 | 000,000,000 | ---D | C] -- C:\Program Files\MSBuild
[2012.02.14 19:46:35 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx
[2012.02.14 19:24:03 | 000,000,000 | ---D | C] -- C:\Users\Labe\AppData\Roaming\TuneUp Software
[2012.02.14 19:23:21 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2012.02.14 19:23:11 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012.02.14 18:52:27 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.02.13 15:46:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012.02.13 15:46:23 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012.02.13 15:46:23 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012.02.13 15:44:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.02.13 15:44:26 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.02.13 15:44:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.02.11 17:41:03 | 000,000,000 | ---D | C] -- C:\Users\Labe\AppData\Roaming\BlueSprig
[2012.02.11 17:40:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BlueSprig
[2012.02.11 17:32:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.02.11 17:32:47 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.02.10 19:24:46 | 000,000,000 | ---D | C] -- C:\Users\Labe\Documents\Messenger Plus
[2012.02.10 06:17:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Yuna Software
[2012.02.09 17:32:53 | 000,000,000 | ---D | C] -- C:\Users\Labe\Documents\Verlauf
[2012.02.07 20:12:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Cleaner Pro
[2012.01.29 15:12:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Inspector File Recovery
[2012.01.25 17:26:03 | 000,000,000 | ---D | C] -- C:\Windows\Security
[2012.01.25 17:26:02 | 000,000,000 | ---D | C] -- C:\Program Files\Lexmark
[2012.01.23 22:13:47 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2012.01.23 22:12:00 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2012.01.22 16:28:37 | 000,000,000 | ---D | C] -- C:\Users\Labe\Documents\MAGIX Downloads
[2012.01.22 16:28:36 | 000,000,000 | ---D | C] -- C:\Users\Labe\AppData\Roaming\MAGIX
[2012.01.22 16:27:33 | 000,487,424 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLAV32.dll
[2012.01.22 16:27:33 | 000,430,080 | ---- | C] (MAGIX AG) -- C:\Windows\SysWow64\MXRestore.exe
[2012.01.22 16:27:33 | 000,188,416 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLRES32.dll
[2012.01.22 16:27:33 | 000,163,840 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLDEV32.dll
[2012.01.22 16:27:33 | 000,151,552 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLDRV32.dll
[2012.01.22 16:27:33 | 000,114,688 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLCDA32.dll
[2012.01.22 16:27:33 | 000,094,208 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLCPY32.dll
[2012.01.22 16:27:33 | 000,065,536 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLPTL32.dll
[2012.01.22 16:27:33 | 000,061,440 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLCDF32.dll
[2012.01.22 16:27:33 | 000,057,344 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLTPO32.dll
[2012.01.22 16:27:33 | 000,053,248 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLPRJ32.dll
[2012.01.22 16:27:33 | 000,053,248 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLIO32.dll
[2012.01.22 16:27:33 | 000,049,152 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLPRF32.dll
[2012.01.22 16:27:33 | 000,045,056 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLIMG32.dll
[2012.01.22 16:27:33 | 000,040,960 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLRD32.dll
[2012.01.22 16:27:33 | 000,036,864 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLPNT32.dll
[2012.01.22 16:27:33 | 000,032,768 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\STRING32.dll
[2012.01.22 16:27:33 | 000,032,768 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLMSC32.dll
[2012.01.22 16:27:33 | 000,032,768 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLISO32.dll
[2012.01.22 16:27:33 | 000,032,768 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLDIR32.dll
[2012.01.22 16:27:33 | 000,024,576 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\TTIC32.dll
[2012.01.22 16:27:33 | 000,024,576 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\TTI32.dll
[2012.01.22 16:27:33 | 000,024,576 | ---- | C] (PoINT Software & Systems GmbH) -- C:\Windows\SysWow64\DLLIX.dll
[2012.01.22 16:27:16 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX
[2012.01.22 16:26:19 | 000,700,416 | ---- | C] (MAGIX AG) -- C:\Windows\SysWow64\mgxoschk.dll
[2012.01.22 16:26:19 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\MAGIX
[2012.01.20 19:36:28 | 000,000,000 | ---D | C] -- C:\Users\Labe\AppData\Roaming\SUPERAntiSpyware.com
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.19 13:52:21 | 001,473,006 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.02.19 13:52:21 | 000,644,284 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.02.19 13:52:21 | 000,607,608 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.02.19 13:52:21 | 000,126,812 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.02.19 13:52:21 | 000,103,986 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.02.19 13:45:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.19 13:37:17 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.19 13:37:17 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.19 13:30:20 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.19 13:30:01 | 000,067,584 | --S- | M] () -- C:\Windows\BootStat.dat
[2012.02.19 13:29:53 | 3219,513,344 | -HS- | M] () -- C:\hiberfil.sys
[2012.02.18 20:36:47 | 000,002,086 | ---- | M] () -- C:\Users\Public\Desktop\Die*Sims™*3.lnk
[2012.02.18 20:08:34 | 000,002,342 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.02.18 20:06:20 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2454271692-3331149861-715777547-1000UA.job
[2012.02.18 20:06:18 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2454271692-3331149861-715777547-1000Core.job
[2012.02.15 21:45:52 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Labe\Desktop\OTL.exe
[2012.02.15 21:42:32 | 000,318,040 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.02.14 19:32:24 | 000,001,175 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2012.02.14 18:51:11 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.02.14 18:51:10 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2012.02.13 15:46:27 | 000,001,810 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.02.13 15:44:27 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.11 17:38:36 | 000,154,286 | ---- | M] () -- C:\Users\Labe\Documents\cc_20120211_173816.reg
[2012.02.11 17:37:34 | 000,525,236 | ---- | M] () -- C:\Users\Labe\Documents\cc_20120211_173728.reg
[2012.02.11 17:32:48 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.02.10 19:24:04 | 000,002,128 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2012.02.03 19:02:39 | 000,001,022 | ---- | M] () -- C:\Users\Public\Desktop\LifeFrame.lnk
[2012.01.31 19:23:36 | 000,009,345 | ---- | M] () -- C:\Users\Labe\Documents\Unbenannt 1.odt
[2012.01.27 17:50:26 | 000,001,033 | ---- | M] () -- C:\Users\Labe\Desktop\PhotoScape.lnk
[2012.01.23 16:36:58 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
[2012.01.22 16:27:38 | 000,007,119 | ---- | M] () -- C:\Windows\mgxoschk.ini
[2012.01.21 15:22:40 | 000,000,000 | -H-- | M] () -- C:\Users\Labe\Documents\Default.rdp
 
========== Files Created - No Company Name ==========
 
[2012.02.18 20:36:47 | 000,002,086 | ---- | C] () -- C:\Users\Public\Desktop\Die*Sims™*3.lnk
[2012.02.14 18:51:11 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.02.14 18:51:10 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2012.02.13 15:46:27 | 000,001,810 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.02.13 15:44:27 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.11 17:38:18 | 000,154,286 | ---- | C] () -- C:\Users\Labe\Documents\cc_20120211_173816.reg
[2012.02.11 17:37:30 | 000,525,236 | ---- | C] () -- C:\Users\Labe\Documents\cc_20120211_173728.reg
[2012.02.11 17:32:48 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.02.03 19:02:39 | 000,001,022 | ---- | C] () -- C:\Users\Public\Desktop\LifeFrame.lnk
[2012.01.31 19:23:35 | 000,009,345 | ---- | C] () -- C:\Users\Labe\Documents\Unbenannt 1.odt
[2012.01.27 17:50:26 | 000,001,033 | ---- | C] () -- C:\Users\Labe\Desktop\PhotoScape.lnk
[2012.01.22 16:27:33 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\mgxasio2.dll
[2012.01.22 16:27:33 | 000,014,182 | ---- | C] () -- C:\Windows\SysWow64\DLLAV32.lib
[2012.01.22 16:26:42 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2012.01.22 16:26:19 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2012.01.21 15:22:40 | 000,000,000 | -H-- | C] () -- C:\Users\Labe\Documents\Default.rdp
[2012.01.21 14:36:19 | 000,000,924 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2454271692-3331149861-715777547-1000UA.job
[2012.01.21 14:36:18 | 000,000,902 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2454271692-3331149861-715777547-1000Core.job
[2012.01.19 12:19:09 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.01.19 12:19:09 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.01.19 12:19:09 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.01.19 12:19:09 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.01.19 12:19:09 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.01.19 01:50:03 | 000,067,584 | --S- | C] () -- C:\Windows\BootStat.dat
[2011.11.29 19:03:06 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.11.11 09:52:09 | 000,001,467 | ---- | C] () -- C:\Users\Labe\AppData\Local\RecConfig.xml
[2011.10.13 21:36:17 | 001,527,912 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.06.05 17:13:52 | 000,000,000 | ---- | C] () -- C:\Users\Labe\AppData\Local\{55881D0F-8D90-4390-B120-153AE12E83A0}
[2011.05.22 14:02:47 | 000,007,680 | ---- | C] () -- C:\Users\Labe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.11.18 23:24:57 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.07.26 21:20:26 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2009.07.29 06:20:40 | 000,000,010 | ---- | C] () -- C:\Windows\SysWow64\ABLKSR.ini
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2010.11.15 20:41:28 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Asus WebStorage
[2012.01.18 16:24:33 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Babylon
[2012.02.11 17:41:03 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\BlueSprig
[2011.01.22 20:55:33 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.11.11 10:06:01 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Free Sound Recorder
[2011.10.14 22:48:25 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\gtk-2.0
[2011.07.28 15:56:17 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Jens Lorek
[2010.11.20 15:14:47 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\LG Electronics
[2012.01.22 16:28:36 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\MAGIX
[2011.11.11 09:32:25 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Music Editor Free
[2011.11.27 13:51:11 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\OpenCandy
[2010.11.18 21:48:30 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\OpenOffice.org
[2011.11.11 10:15:54 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Origin
[2011.09.16 23:10:27 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\PhotoScape
[2011.11.29 18:19:11 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\SoftGrid Client
[2011.10.13 21:37:23 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\TP
[2010.11.19 22:47:22 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\TubeBox
[2012.02.14 19:24:03 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\TuneUp Software
[2012.02.18 20:06:18 | 000,000,902 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2454271692-3331149861-715777547-1000Core.job
[2012.02.18 20:06:20 | 000,000,924 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2454271692-3331149861-715777547-1000UA.job
[2012.01.15 12:58:28 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.11.17 21:36:59 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Adobe
[2010.11.15 20:41:28 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Asus WebStorage
[2012.02.07 20:14:02 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\ATI
[2012.01.18 16:24:33 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Babylon
[2012.02.11 17:41:03 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\BlueSprig
[2011.06.18 19:33:50 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\CyberLink
[2011.01.22 20:55:33 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.11.11 10:06:01 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Free Sound Recorder
[2011.10.14 22:48:25 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\gtk-2.0
[2010.11.15 18:05:04 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Identities
[2011.07.28 15:56:17 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Jens Lorek
[2010.11.20 15:14:47 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\LG Electronics
[2010.11.17 21:37:02 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Macromedia
[2012.01.22 16:28:36 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\MAGIX
[2012.01.15 13:14:19 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Malwarebytes
[2009.07.14 08:44:38 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Media Center Programs
[2012.01.29 15:13:26 | 000,000,000 | --SD | M] -- C:\Users\Labe\AppData\Roaming\Microsoft
[2010.11.20 15:10:41 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Mozilla
[2011.11.11 09:32:25 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Music Editor Free
[2011.11.01 01:21:18 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\NCH Software
[2011.11.27 13:51:11 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\OpenCandy
[2010.11.18 21:48:30 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\OpenOffice.org
[2011.11.11 10:15:54 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Origin
[2011.09.16 23:10:27 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\PhotoScape
[2011.09.07 23:46:56 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Skype
[2011.09.07 23:09:19 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\skypePM
[2011.11.29 18:19:11 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\SoftGrid Client
[2012.01.20 19:36:28 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\SUPERAntiSpyware.com
[2011.10.13 21:37:23 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\TP
[2010.11.19 22:47:22 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\TubeBox
[2012.02.14 19:24:03 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\TuneUp Software
 
< %APPDATA%\*.exe /s >
[2011.07.28 15:55:59 | 000,034,494 | R--- | M] () -- C:\Users\Labe\AppData\Roaming\Microsoft\Installer\{15C82F5E-6EA9-44FE-A0FC-B6D08A684037}\_6FEFF9B68218417F98F549.exe
[2011.06.13 14:38:08 | 000,034,494 | R--- | M] () -- C:\Users\Labe\AppData\Roaming\Microsoft\Installer\{7223945A-F037-4AE1-92F9-BA8304F0E21A}\_6FEFF9B68218417F98F549.exe
[2010.11.19 22:46:45 | 000,034,494 | R--- | M] () -- C:\Users\Labe\AppData\Roaming\Microsoft\Installer\{8DB77BE4-629D-458D-BD68-9F36667C2177}\_6FEFF9B68218417F98F549.exe
[2011.05.01 19:44:24 | 000,034,494 | R--- | M] () -- C:\Users\Labe\AppData\Roaming\Microsoft\Installer\{EAE8F6AB-68E8-4AA9-9518-F677090690B2}\_6FEFF9B68218417F98F549.exe
[2011.11.18 05:30:06 | 002,081,208 | ---- | M] (Speedchecker Limited                                        ) -- C:\Users\Labe\AppData\Roaming\OpenCandy\448BBAFED7DA4EFEA2429BE071C719ED\pcspeedup_oc.exe
[2011.11.27 10:55:40 | 000,197,128 | ---- | M] () -- C:\Users\Labe\AppData\Roaming\OpenCandy\89BA276EFFAB46298AF602BB4B827460\SymentecRegMech_Gr_p1v1.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\ERDNT\cache64\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\ERDNT\cache86\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\ERDNT\cache64\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\ERDNT\cache64\netlogon.dll
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\ERDNT\cache86\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\drivers\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\ERDNT\cache86\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\ERDNT\cache64\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\ERDNT\cache64\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\ERDNT\cache86\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\ERDNT\cache86\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\ERDNT\cache64\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\ERDNT\cache64\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\ERDNT\cache86\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.07.26 21:28:36 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010.07.26 21:28:36 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\ERDNT\cache64\winlogon.exe
[2010.07.26 21:28:36 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe
[2010.07.26 21:28:36 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2012.02.14 18:51:11 | 000,353,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll
[2012.02.14 18:51:11 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll
[2010.12.21 06:36:16 | 001,236,992 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\msxml3.dll
 
<          >

< End of report >

cosinus 19.02.2012 19:20
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL =
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E4 1C 8D 38 56 D5 CC 01  [binary data]
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
IE - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.param.yahoo-fr: ""
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems:
FF - prefs.js..extensions.enabledItems:
FF - prefs.js..extensions.enabledItems:
FF - prefs.js..extensions.enabledItems:
FF - prefs.js..extensions.enabledItems:
[2012.01.18 16:24:36 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com
[2012.01.18 16:22:17 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@Facemoods.com
File not found (No name found) -- C:\PROGRAM FILES (X86)\AUTOCOMPLETEPRO\SUPPORT@PREDICTAD.COM
File not found (No name found) -- C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\{635ABD67-4FE9-1B23-4F01-E679FA7484C1}
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\{77F8C945-4B74-4BD6-A073-E0D1997EDCE8}
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\ENGINE@PLASMOO.COM
File not found (No name found) -- C:\USERS\LABE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0F95RQJG.DEFAULT\EXTENSIONS\PLUGIN@YONTOO.COM
O3 - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\..\Toolbar\WebBrowser: (no name) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No CLSID value found.
O4 - HKU\S-1-5-21-2454271692-3331149861-715777547-1000..\Run: [Facebook Update] C:\Users\Labe\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= -  File not found
[2012.01.18 16:24:33 | 000,000,000 | ---D | M] -- C:\Users\Labe\AppData\Roaming\Babylon

:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Monaa 20.02.2012 16:53
Code:
All processes killed
========== OTL ==========
HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Search_URL| /E : value set successfully!
HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Search\\Default_Search_URL| /E : value set successfully!
HKU\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
Prefs.js: "" removed from browser.search.defaultenginename
Prefs.js: "" removed from browser.search.defaultthis.engineName
Prefs.js: "" removed from browser.search.defaulturl
Prefs.js: "" removed from browser.search.param.yahoo-fr
Prefs.js: "" removed from browser.search.param.yahoo-fr-cjkt
Prefs.js: "" removed from browser.search.selectedEngine
Prefs.js: "" removed from browser.startup.homepage
Prefs.js:  removed from extensions.enabledItems
Prefs.js:  removed from extensions.enabledItems
Prefs.js:  removed from extensions.enabledItems
Prefs.js:  removed from extensions.enabledItems
Prefs.js:  removed from extensions.enabledItems
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults\preferences folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\defaults folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content\imgs folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\content folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com\components folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@babylon.com folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@Facemoods.com\defaults\preferences folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@Facemoods.com\defaults folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@Facemoods.com\components folder moved successfully.
C:\Users\Labe\AppData\Roaming\mozilla\Firefox\Profiles\0f95rqjg.default\extensions\ffxtlbr@Facemoods.com folder moved successfully.
Registry value HKEY_USERS\S-1-5-21-2454271692-3331149861-715777547-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}\ not found.
Registry value HKEY_USERS\S-1-5-21-2454271692-3331149861-715777547-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Facebook Update deleted successfully.
C:\Users\Labe\AppData\Local\Facebook\Update\FacebookUpdate.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2454271692-3331149861-715777547-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\Adobe Reader Speed Launcher\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\CLMLServer\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\RtHDVCpl\ not found.
C:\Users\Labe\AppData\Roaming\Babylon folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: AppData
->Temp folder emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Labe
->Temp folder emptied: 22773239 bytes
->Temporary Internet Files folder emptied: 187219079 bytes
->Java cache emptied: 11065579 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 18412401 bytes
->Flash cache emptied: 43635 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 493102 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 28803258 bytes
 
Total Files Cleaned = 256,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 02202012_145321

Files\Folders moved on Reboot...
File move failed. C:\Users\Labe\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

cosinus 20.02.2012 20:50
So, was ist jetzt noch an Problemen offen?

Monaa 21.02.2012 00:48
Ja das würde ich gerne testen aber mein Laptop lässt sich nicht herunterfahren!! :( :(

cosinus 21.02.2012 13:00
Aber bitte nicht zu genau beschreiben :D

Monaa 21.02.2012 18:03
Ja ich habe gerade nachgeguckt und leider funktionieren die Programme nachwievor nicht .. :(

cosinus 21.02.2012 19:06
Dann wirst du wohl mal von vorn anfangen müssen. Folge dem Artikel zur Neuinstallation von Windows

Monaa 22.02.2012 18:50
Das Problem ist nun das ich zu meinem Laptop keine CD mitgeliefert bekommen habe.
Die muss ich mir jetzt wohl kaufen oder?

cosinus 22.02.2012 20:05
DVD-Images von Win7 kann man sich kostenlos und legal runterladen

hier => Windows 7 – Home Premium und Professional Direkt Download Links
oder hier => UNAWAVE - Downloads von Windows 7 ISO-Image-Dateien

Monaa 24.02.2012 23:38
Okey danke

Monaa 29.03.2012 15:20
Heeeey ich brauche unbedingt wieder deine Hilfe.
Ich wollte mir jetzt Windows 7 neu installieren aber dafür muss ja erst die Bootreihenfolge geändert werden und ich weiss nicht wie man die ändert. :(

cosinus 29.03.2012 15:22
http://www.trojaner-board.de/81857-c...cd-booten.html

Monaa 29.03.2012 15:23
dankkkeee :)

Es funktioniert nicht.. :( Mein Laptop startet nicht von der Cd. :(

Monaa 28.04.2012 19:17
Ja danke vielmals für die Hilfe!! Sehr aufmerksam! -.-

cosinus 30.04.2012 11:38
Zitat:
Sehr aufmerksam! -.-
Was soll mir dieser Smilie jetzt sagen :balla:
Hast du es nun nach über vier Wochen nun hinbekommen oder nicht

Monaa 06.05.2012 14:07
Nein habe ich nicht, da ich ja auf eine Antwort gewartet habe die aber nicht kam ..

cosinus 06.05.2012 19:01
Schön, und wenn ich so eine nichtsagende Meldug bekomme wie "Laptop startet nicht von CD" wie soll man dir da bei soviel Information helfen :balla:


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:27 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55