Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A (https://www.trojaner-board.de/110330-bundeskriminalamttrojaner-rechner-exp-java-dldr-a.html)

Kaiko 23.02.2012 12:53
Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A
 
Hey Leute,

ich war im Netz und beim öffnen einer Seite wurde mir plötzlich der Screen mit einem Fake Bilder des BKA´s geliefert, alles hing und nichts ging mehr.

Nach dem Neustart war alles normal, doch nach einigen Sekunden ging das Internet wieder auf und das Selbe Bild.

In diesem Forum habe ich gelesen, dass ich im Abgesichertem Modus meine Daten retten kann, dass habe ich bis jetzt auch so gut es ging getan.

Nach folgender Anleitung bin ich vor gegangen:
hxxp://www.redirect301.de/bundespolizei-trojaner-entfernen.html

leider bin ich nur bis Punkt 8 gekommen.
Dort sollte ich Pfad Virus löschen usw klicken, doch da war ich dann Machtlos, ich habe leider nicht soviel erfahrungen mit solchen sachen. Deshalb habe ich das abgebrochen.

Jedenfalls wollte ich heute den Lappi im Abgesicherten Modus Starten, hab zu spät reagiert und somit ist er normal hoch gefahren.
Plötzlich, Alles wieder IO ...ich schaltete sofort den Task-Manager ein und schloss alle mir unbekannten exe Anwendungen.

Ja und nun kann ich von diesem Rechner aus alles machen.
Ich habe einmal Antivier drüber laufen lassen und folgende meldung bekommen:

Code:

Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Donnerstag, 23. Februar 2012  10:45

Es wird nach 3448049 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows 7 x64
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : Melly Schulz
Computername  : MELLYSCHULZ-PC

Versionsinformationen:
BUILD.DAT      : 10.2.0.704          Bytes  28.09.2011 13:14:00
AVSCAN.EXE    : 10.3.0.7      484008 Bytes  02.07.2011 11:32:33
AVSCAN.DLL    : 10.0.5.0      57192 Bytes  02.07.2011 11:32:33
LUKE.DLL      : 10.3.0.5      45416 Bytes  02.07.2011 11:32:34
LUKERES.DLL    : 10.0.0.0      13672 Bytes  14.01.2010 12:22:40
AVSCPLR.DLL    : 10.3.0.7      119656 Bytes  02.07.2011 11:32:34
AVREG.DLL      : 10.3.0.9      88833 Bytes  02.08.2011 04:58:17
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 10:49:21
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 05:52:59
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 19:26:04
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 17:34:47
VBASE004.VDF  : 7.11.21.239    2048 Bytes  01.02.2012 17:35:29
VBASE005.VDF  : 7.11.21.240    2048 Bytes  01.02.2012 17:35:29
VBASE006.VDF  : 7.11.21.241    2048 Bytes  01.02.2012 17:35:30
VBASE007.VDF  : 7.11.21.242    2048 Bytes  01.02.2012 17:35:30
VBASE008.VDF  : 7.11.21.243    2048 Bytes  01.02.2012 17:35:30
VBASE009.VDF  : 7.11.21.244    2048 Bytes  01.02.2012 17:35:30
VBASE010.VDF  : 7.11.21.245    2048 Bytes  01.02.2012 17:35:30
VBASE011.VDF  : 7.11.21.246    2048 Bytes  01.02.2012 17:35:30
VBASE012.VDF  : 7.11.21.247    2048 Bytes  01.02.2012 17:35:31
VBASE013.VDF  : 7.11.22.33  1486848 Bytes  03.02.2012 18:35:19
VBASE014.VDF  : 7.11.22.56    687616 Bytes  03.02.2012 18:35:57
VBASE015.VDF  : 7.11.22.92    178176 Bytes  06.02.2012 18:36:02
VBASE016.VDF  : 7.11.22.154  144896 Bytes  08.02.2012 18:36:06
VBASE017.VDF  : 7.11.22.155    2048 Bytes  08.02.2012 18:36:06
VBASE018.VDF  : 7.11.22.156    2048 Bytes  08.02.2012 18:36:06
VBASE019.VDF  : 7.11.22.157    2048 Bytes  08.02.2012 18:36:06
VBASE020.VDF  : 7.11.22.158    2048 Bytes  08.02.2012 18:36:06
VBASE021.VDF  : 7.11.22.159    2048 Bytes  08.02.2012 18:36:06
VBASE022.VDF  : 7.11.22.160    2048 Bytes  08.02.2012 18:36:06
VBASE023.VDF  : 7.11.22.161    2048 Bytes  08.02.2012 18:36:07
VBASE024.VDF  : 7.11.22.162    2048 Bytes  08.02.2012 18:36:07
VBASE025.VDF  : 7.11.22.163    2048 Bytes  08.02.2012 18:36:07
VBASE026.VDF  : 7.11.22.164    2048 Bytes  08.02.2012 18:36:08
VBASE027.VDF  : 7.11.22.165    2048 Bytes  08.02.2012 18:36:08
VBASE028.VDF  : 7.11.22.166    2048 Bytes  08.02.2012 18:36:08
VBASE029.VDF  : 7.11.22.167    2048 Bytes  08.02.2012 18:36:08
VBASE030.VDF  : 7.11.22.168    2048 Bytes  08.02.2012 18:36:08
VBASE031.VDF  : 7.11.22.206  139776 Bytes  10.02.2012 18:36:16
Engineversion  : 8.2.8.54 
AEVDF.DLL      : 8.1.2.2      106868 Bytes  06.11.2011 17:51:09
AESCRIPT.DLL  : 8.1.4.5      442745 Bytes  11.02.2012 18:39:46
AESCN.DLL      : 8.1.8.2      131444 Bytes  02.02.2012 17:37:14
AESBX.DLL      : 8.2.4.5      434549 Bytes  28.12.2011 19:28:39
AERDL.DLL      : 8.1.9.15      639348 Bytes  03.10.2011 07:12:19
AEPACK.DLL    : 8.2.16.3      799094 Bytes  11.02.2012 18:39:25
AEOFFICE.DLL  : 8.1.2.25      201084 Bytes  22.01.2012 18:29:18
AEHEUR.DLL    : 8.1.3.27    4391285 Bytes  11.02.2012 18:38:54
AEHELP.DLL    : 8.1.19.0      254327 Bytes  22.01.2012 18:29:15
AEGEN.DLL      : 8.1.5.21      409971 Bytes  11.02.2012 18:36:22
AEEMU.DLL      : 8.1.3.0      393589 Bytes  21.04.2011 05:52:17
AECORE.DLL    : 8.1.25.3      201079 Bytes  02.02.2012 17:35:42
AEBB.DLL      : 8.1.1.0        53618 Bytes  21.04.2011 05:52:16
AVWINLL.DLL    : 10.0.0.0      19304 Bytes  21.04.2011 05:52:39
AVPREF.DLL    : 10.0.3.2      44904 Bytes  02.07.2011 11:32:33
AVREP.DLL      : 10.0.0.10    174120 Bytes  02.07.2011 11:32:34
AVARKT.DLL    : 10.0.26.1    255336 Bytes  02.07.2011 11:32:33
AVEVTLOG.DLL  : 10.0.0.9      203112 Bytes  02.07.2011 11:32:33
SQLITE3.DLL    : 3.6.19.0      355688 Bytes  28.01.2010 11:59:50
AVSMTP.DLL    : 10.0.0.17      63848 Bytes  21.04.2011 05:52:38
NETNT.DLL      : 10.0.0.0      11624 Bytes  21.04.2011 05:52:50
RCIMAGE.DLL    : 10.0.0.35    2589544 Bytes  02.07.2011 11:32:33
RCTEXT.DLL    : 10.0.64.0      98664 Bytes  02.07.2011 11:32:33

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\alldrives.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, F:, G:, E:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Donnerstag, 23. Februar 2012  10:45

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RocketDock.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LightScribeControlPanel.exe' - '1' Modul(e) wurden durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD2
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Bootsektor 'D:\'
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Bootsektor 'F:\'
    [INFO]      Im  Laufwerk 'F:\' ist kein Datenträger eingelegt!
Bootsektor 'G:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '150' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Users\Melly Schulz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\52e312d6-13c2fcb9
  [0] Archivtyp: ZIP
  --> json/Parser.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/Java.Dldr.A
Beginne mit der Suche in 'D:\'
Der zu durchsuchende Pfad D:\ konnte nicht geöffnet werden!
Systemfehler [1005]: Auf dem Datenträger befindet sich kein erkanntes Dateisystem.
Beginne mit der Suche in 'F:\'
Der zu durchsuchende Pfad F:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'G:\' <Intenso>
Beginne mit der Suche in 'E:\'
Der zu durchsuchende Pfad E:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.

Beginne mit der Desinfektion:
C:\Users\Melly Schulz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\52e312d6-13c2fcb9
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/Java.Dldr.A
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '49b6b5cb.qua' verschoben!


Ende des Suchlaufs: Donnerstag, 23. Februar 2012  11:26
Benötigte Zeit: 40:29 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

  27872 Verzeichnisse wurden überprüft
 335196 Dateien wurden geprüft
      1 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      1 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 335195 Dateien ohne Befall
  1471 Archive wurden durchsucht
      0 Warnungen
      1 Hinweise
dort habe ich dann " in Quarnatäne verschieben " angeklickt.

nun habe ich wie hier schon gelesen mir das Programm Maleware runter geladen und folgendes Ergebnis erhalten:

Code:
Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.23.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Melly Schulz :: MELLYSCHULZ-PC [Administrator]

Schutz: Aktiviert

23.02.2012 12:24:59
mbam-log-2012-02-23 (12-24-59).txt

Art des Suchlaufs: Flash-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: Registrierung | Dateisystem | P2P
Durchsuchte Objekte: 164149
Laufzeit: 26 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.459932856992547867f76.exe.lnk (Backdoor.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Nach einem weiteren Scan ob im Quick, Vollständigen oder auch Flash Scan wurden mir keine weiteren " gefunden Objekte " angezeigt.

ist das Problem nun behoben?
Wäre nett wenn mir jemand da ein wenig helfen kann!
Lg Thomas

cosinus 23.02.2012 14:34
Die Logs sind in CODE-Tags zu posten, nicht in PHP-Tags!

Funktioniert nun der normale Modus wieder oder gehts nur im abgesicherten mit Netzwerk?

Kaiko 23.02.2012 14:40
Hey Arne,

erstmal Danke für die schnelle Antwort, des weitern war mir nicht bewusst ob PHP oder Code-Tags...Sorry.

Soll ich es nochmal posten?

Des weiteren kann ich nur sagen, dass bevor ich die Programme laufen lassen habe, alles wieder funktionierte... Wie kommt das?

Also Probleme habe ich nichtmehr?
Is es damit behoben?

cosinus 23.02.2012 14:47
Ich habs für dich geändert ;)

Zitat:
dass bevor ich die Programme laufen lassen habe, alles wieder funktionierte... Wie kommt das?
??? :confused: ???
Nach Malwarebytes und AntiVir geht nichts mehr oder wie ist der Satz zu verstehen?

Kaiko 23.02.2012 15:01
Ich glaube ich drücke mich bissl quer aus...!

Ich habe mein PC heute wieder gestartet um im Abgesicherten Modus diverse Programme laufen zu lassen... Ich habe aber vergessen F8 zu drücken und der LapTop ist einfach so hoch gefahren.

Dann habe ich sofort den TaskManager geöffnet und alle mir Unbekannten exe Datein geschlossen...

Ja und dann, ist nichts passiert... also im Sinne von..Kein BKA Trojaner.
Mhhh dann habe ich erstmal Antivier laufen lassen und Malwarebytes, beide habe mir das selbe Ergebnis gebracht : " EXp/java.dldr.A "

Ja und so bin ich hier gelandet...!

Es funktioniert alles... keine Fehler Meldung mehr...nichts...!
Aber ich habe nichts gemacht gehabt.!

Soll ich die DDS und Attach noch hier rein stellen und wenn ja, wie kann ich das nachträglich machen...

Kaiko 23.02.2012 15:03
Zitat:
Zitat von Kaiko (Beitrag 779142)
Ich glaube ich drücke mich bissl quer aus...!

Ich habe mein PC heute wieder gestartet um im Abgesicherten Modus diverse Programme laufen zu lassen... Ich habe aber vergessen F8 zu drücken und der LapTop ist einfach so hoch gefahren.

Dann habe ich sofort den TaskManager geöffnet und alle mir Unbekannten exe Datein geschlossen...

Ja und dann, ist nichts passiert... also im Sinne von..Kein BKA Trojaner.
Mhhh dann habe ich erstmal Antivier laufen lassen und Malwarebytes, beide habe mir das selbe Ergebnis gebracht : " EXp/java.dldr.A "

Ja und so bin ich hier gelandet...!

Es funktioniert alles... keine Fehler Meldung mehr...nichts...!
Aber ich habe nichts gemacht gehabt.!

Soll ich die DDS und Attach noch hier rein stellen und wenn ja, wie kann ich das nachträglich machen...

DDS:
Code:
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 1.6.0_24
Run by Melly Schulz at 14:53:16 on 2012-02-23
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.3069.1527 [GMT 1:00]
.
AV: AntiVir Desktop *Enabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k HsfXAudioService
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\explorer.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://google.de/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll
mURLSearchHooks: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
uRun: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
IE: Nach Microsoft &Excel exportieren - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{EF38288C-2FC6-47E6-B2E6-9D57D17D1AE2} : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{EF38288C-2FC6-47E6-B2E6-9D57D17D1AE2}\D2444525D2354756E67656C6E61647F627 : DhcpNameServer = 192.168.178.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{30F9B915-B755-4826-820B-08FBA6BD249D}
{326E768D-4182-46FD-9C16-1449A49795F4}
{53707962-6F74-2D53-2644-206D7942484F}
{593DDEC6-7468-4cdd-90E1-42DADAA222E9}
{9030D464-4C02-4ABF-8ECC-5164760863C6}
{9FDDE16B-836F-4806-AB1F-1455CBEFF289}
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
{d2ce3e00-f94a-4740-988e-03dc2f38c34f}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
{30F9B915-B755-4826-820B-08FBA6BD249D}
{8dcb7100-df86-4384-8842-8fa844297b3f}
mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce-x64: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
Hosts: 127.0.0.1        www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Melly Schulz\AppData\Roaming\Mozilla\Firefox\Profiles\9mpf25v8.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - google.de
FF - component: C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\kavlinkfilter.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Picasa2\npPicasa3.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
R2 AntiVirSchedulerService;Avira AntiVir Planer;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2011-7-1 136360]
R2 AntiVirService;Avira AntiVir Guard;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2011-7-1 269480]
R2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?]
R2 HsfXAudioService;HsfXAudioService;C:\Windows\system32\svchost.exe -k HsfXAudioService [2009-7-14 20992]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-2-23 652360]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-4-29 2218600]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-4-29 1153368]
R3 CAXHWAZL;CAXHWAZL;C:\Windows\system32\DRIVERS\CAXHWAZL.sys --> C:\Windows\system32\DRIVERS\CAXHWAZL.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-1-31 158856]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-4-1 183560]
S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-02-23 10:36:16        --------        d-----w-        C:\Users\Melly Schulz\AppData\Roaming\Malwarebytes
2012-02-23 10:36:03        --------        d-----w-        C:\ProgramData\Malwarebytes
2012-02-23 10:35:59        23152        ----a-w-        C:\Windows\System32\drivers\mbam.sys
2012-02-23 10:35:59        --------        d-----w-        C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-02-23 10:33:48        8643640        ----a-w-        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6EDFD83D-656E-4CBB-B5C7-112D1592B953}\mpengine.dll
2012-02-23 09:44:45        --------        d-----w-        C:\Users\Melly Schulz\AppData\Roaming\Avira
2012-02-23 09:42:30        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{E0A4CE82-644C-4E7A-B91A-4E74169BBCDA}
2012-02-21 14:24:40        --------        d---a-w-        C:\Kaspersky Rescue Disk 10.0
2012-02-21 05:57:23        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{67B841EA-AFDE-471B-9D4B-E8F59BBDA3E5}
2012-02-21 05:57:01        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{09C31F26-E6D9-40D7-83B9-179BF91462D9}
2012-02-20 17:56:35        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{9C370476-74A7-4A6D-A20F-970400747BE5}
2012-02-20 17:56:22        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{40ECD04A-60C1-4005-8A04-88DAC0293BD0}
2012-02-20 05:41:56        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{75752E13-01F8-457D-85C1-7EF82DE3BA64}
2012-02-20 05:41:39        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{9CCCD3A0-1C7D-4E81-8A0A-EABCA3AFB565}
2012-02-19 07:14:33        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{331651DF-FE89-44E7-865D-482C209EFCAB}
2012-02-19 07:14:20        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{03C78A8C-AE78-4A4B-BFE2-B2BD1C5FE4A0}
2012-02-18 19:13:48        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{F2B64C9D-403B-43CF-8DB4-0976AF655FE2}
2012-02-18 19:13:26        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{F1BB877F-F635-4648-818A-2CDFB26DD108}
2012-02-18 07:12:58        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{877FD7CC-1AD9-41C3-8B18-7BC27E6087C2}
2012-02-18 07:12:33        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{A3A389B4-1F07-42F6-B454-C352344C4057}
2012-02-17 19:11:49        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{25019F1A-5007-47E0-A53D-958544D1FBFA}
2012-02-17 19:11:29        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{A97ECA4C-014C-43D3-8124-CD5E820E015D}
2012-02-17 06:21:15        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{50509A4F-48DE-4A8C-A7BD-965BED94E35B}
2012-02-17 06:20:52        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{56255C04-A495-475B-87D4-FCE8614EBF93}
2012-02-16 18:19:14        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{D99F1BC7-F923-409F-B42C-0C6C53CA4C9D}
2012-02-16 18:19:01        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{03D26D72-C77A-4348-8063-520083468433}
2012-02-16 05:23:15        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{13D7989B-9C91-4433-ACF2-13092C4AB26C}
2012-02-16 05:23:02        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{17605753-059F-4225-9F95-B3B73E98D12C}
2012-02-15 07:32:52        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{363914B3-7DDA-4E97-B5BC-552F2E5432CA}
2012-02-15 07:32:30        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{22B8FB6C-D250-410D-BA1A-4E4CBBCF5D09}
2012-02-15 05:33:23        509952        ----a-w-        C:\Windows\System32\ntshrui.dll
2012-02-15 05:33:23        442880        ----a-w-        C:\Windows\SysWow64\ntshrui.dll
2012-02-15 05:33:21        515584        ----a-w-        C:\Windows\System32\timedate.cpl
2012-02-15 05:33:21        478720        ----a-w-        C:\Windows\SysWow64\timedate.cpl
2012-02-15 05:33:19        498688        ----a-w-        C:\Windows\System32\drivers\afd.sys
2012-02-15 05:33:19        3145728        ----a-w-        C:\Windows\System32\win32k.sys
2012-02-15 05:33:15        690688        ----a-w-        C:\Windows\SysWow64\msvcrt.dll
2012-02-15 05:33:15        634880        ----a-w-        C:\Windows\System32\msvcrt.dll
2012-02-14 19:00:39        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{E6BD3058-EBC7-4104-B293-FA6896CE269F}
2012-02-14 19:00:11        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{7B800ABF-A15C-45FC-A3F7-177DBDBD09AC}
2012-02-14 05:18:28        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{11780F96-0A24-453A-849E-235C909543EB}
2012-02-14 05:18:05        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{E7A5F5DF-12C0-4306-931C-F9F5CD3D088E}
2012-02-13 12:01:50        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{1B7ADD8F-E7F9-4592-8E7E-B8CCB2AA15D5}
2012-02-13 12:01:38        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{02D75284-EC5B-4DAD-BA8C-0AC23EEB4AB2}
2012-02-12 21:13:48        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{CEC131C4-0199-4E3A-9543-4415764F297D}
2012-02-12 21:13:25        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{36F2B80D-0102-45A2-846E-393D0CB9A9F5}
2012-02-12 09:12:45        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{63D7F300-EBA7-49AE-8B92-4423F99038CE}
2012-02-12 09:12:32        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{D9004609-E035-4F3E-B902-D1F5D177FC8D}
2012-02-11 18:33:31        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{E3ADEB0F-F338-4007-B9D3-191B1F8345DD}
2012-02-11 18:33:19        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{AFA6AF86-509F-473F-9AA0-F4C710440251}
2012-02-11 18:33:19        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{8594F631-EA07-4688-BD1B-30B55A353B11}
2012-02-10 18:03:57        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{FD8225DA-1000-483A-BA69-DB5F5F12347A}
2012-02-10 18:03:35        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{5E1E3BA7-6B46-44BA-B0E8-6F04AB7E8938}
2012-02-10 06:03:05        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{DD29878F-E03E-440A-AC3C-EDFFDF1BBBC5}
2012-02-10 06:02:53        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{ED452105-AC03-4F02-8AAA-13A56FEFD2E2}
2012-02-09 09:00:09        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{6C413819-65B6-44C7-BE6D-061F29B71409}
2012-02-09 08:59:58        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{6FC044B4-9029-4AE4-8E4A-E5DCB8C09742}
2012-02-08 21:15:19        --------        d-sh--w-        C:\Windows\SysWow64\%APPDATA%
2012-02-08 20:59:29        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{B24FF372-F436-479F-A973-43677CF67CD5}
2012-02-08 20:59:07        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{88828542-E43B-4F89-8321-6892C8B3D063}
2012-02-08 11:28:54        --------        d-----r-        C:\Program Files (x86)\Skype
2012-02-08 08:58:10        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{03BD65C4-134A-4DD4-B3C4-12C78F79EC70}
2012-02-08 08:57:58        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{5460F2D1-A8EA-46F7-BE42-871B7629E091}
2012-02-08 08:51:52        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{69290E09-F639-4479-AE7F-FCADE042F96F}
2012-02-08 07:49:24        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\{D9078D90-D873-4854-8A6C-8875F75FDC87}
2012-02-07 20:53:28        --------        d-----w-        C:\Users\Melly Schulz\Tracing
2012-02-07 20:41:51        --------        d-----w-        C:\Windows\de
2012-02-07 20:36:54        --------        d-----w-        C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2012-02-07 20:33:21        48488        ----a-w-        C:\Windows\System32\drivers\fssfltr.sys
2012-02-07 20:31:28        --------        d-----w-        C:\Program Files (x86)\Microsoft
2012-02-07 20:31:23        69464        ----a-w-        C:\Windows\SysWow64\XAPOFX1_3.dll
2012-02-07 20:31:23        515416        ----a-w-        C:\Windows\SysWow64\XAudio2_5.dll
2012-02-07 20:31:22        523088        ----a-w-        C:\Windows\System32\d3dx10_42.dll
2012-02-07 20:31:22        453456        ----a-w-        C:\Windows\SysWow64\d3dx10_42.dll
2012-02-07 20:31:08        7450888        ----a-w-        C:\Program Files (x86)\Common Files\Windows Live\.cache\6aac39821cce5d705\bingbarsetup.exe
2012-02-07 20:31:03        4398360        ----a-w-        C:\Windows\System32\d3dx9_32.dll
2012-02-07 20:31:03        3426072        ----a-w-        C:\Windows\SysWow64\d3dx9_32.dll
2012-02-07 20:30:48        15712        ----a-w-        C:\Program Files (x86)\Common Files\Windows Live\.cache\6057a0b21cce5d704\MeshBetaRemover.exe
2012-02-07 20:30:31        94040        ----a-w-        C:\Program Files (x86)\Common Files\Windows Live\.cache\55e6775e1cce5d703\DSETUP.dll
2012-02-07 20:30:31        525656        ----a-w-        C:\Program Files (x86)\Common Files\Windows Live\.cache\55e6775e1cce5d703\DXSETUP.exe
2012-02-07 20:30:31        1691480        ----a-w-        C:\Program Files (x86)\Common Files\Windows Live\.cache\55e6775e1cce5d703\dsetup32.dll
2012-02-07 20:30:24        94040        ----a-w-        C:\Program Files (x86)\Common Files\Windows Live\.cache\515a76781cce5d702\DSETUP.dll
2012-02-07 20:30:24        525656        ----a-w-        C:\Program Files (x86)\Common Files\Windows Live\.cache\515a76781cce5d702\DXSETUP.exe
2012-02-07 20:30:24        1691480        ----a-w-        C:\Program Files (x86)\Common Files\Windows Live\.cache\515a76781cce5d702\dsetup32.dll
2012-02-07 20:30:14        6260088        ----a-w-        C:\Program Files (x86)\Common Files\Windows Live\.cache\4b1f9c811cce5d701\Silverlight.4.0.exe
2012-02-07 20:29:45        --------        d-----w-        C:\Users\Melly Schulz\AppData\Local\Windows Live
2012-02-07 20:29:44        --------        d-----w-        C:\Program Files (x86)\Common Files\Windows Live
.
==================== Find3M  ====================
.
2012-01-29 04:10:42        279656        ------w-        C:\Windows\System32\MpSigStub.exe
2011-12-14 07:11:03        2308096        ----a-w-        C:\Windows\System32\jscript9.dll
2011-12-14 07:04:30        1390080        ----a-w-        C:\Windows\System32\wininet.dll
2011-12-14 07:03:38        1493504        ----a-w-        C:\Windows\System32\inetcpl.cpl
2011-12-14 06:57:28        2382848        ----a-w-        C:\Windows\System32\mshtml.tlb
2011-12-14 03:04:54        1798656        ----a-w-        C:\Windows\SysWow64\jscript9.dll
2011-12-14 02:57:18        1127424        ----a-w-        C:\Windows\SysWow64\wininet.dll
2011-12-14 02:56:58        1427456        ----a-w-        C:\Windows\SysWow64\inetcpl.cpl
2011-12-14 02:50:04        2382848        ----a-w-        C:\Windows\SysWow64\mshtml.tlb
.
============= FINISH: 14:54:21,05 ===============
Attach:
Code:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 29.04.2011 21:23:52
System Uptime: 23.02.2012 12:21:35 (2 hours ago)
.
Motherboard: Wistron |  | 3616
Processor: Intel(R) Core(TM)2 Duo CPU    T5800  @ 2.00GHz | CPU | 2000/800mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 51 GiB total, 20,093 GiB free.
E: is CDROM ()
F: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP222: 23.02.2012 11:32:44 - Windows Update
.
==== Installed Programs ======================
.
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.1.1) - Deutsch
Apple Application Support
Apple Software Update
Aquamarin Haushaltsbuch 2.9.2 b
Ashampoo Photo Commander 9 v.9.2.1
Avira AntiVir Personal - Free Antivirus
Bing Bar
CloneDVD2
Compatibility Pack für 2007 Office System
Conduit Engine
D3DX10
DivX-Setup
High-Definition Video Playback 10
Java Auto Updater
Java(TM) 6 Update 24
Junk Mail filter update
LG PC Suite III
LG USB Modem Drivers
LightScribe System Software
Malwarebytes Anti-Malware Version 1.60.1.1000
Mesh Runtime
Messenger Companion
Microsoft Office Outlook Connector
Microsoft Office Professional Edition 2003
Microsoft Primary Interoperability Assemblies 2005
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 10.0.2 (x86 de)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MyAshampoo Toolbar
Nero 10 Menu TemplatePack Basic
Nero 10 Movie ThemePack Basic
Nero Burning ROM 10
Nero BurnRights 10
Nero Control Center 10
Nero Core Components 10
Nero Dolby Files 10
Nero Express 10
Nero Multimedia Suite 10
Nero StartSmart 10
NVIDIA 3D Vision Controller Driver
NVIDIA PhysX
Picasa 3
QuickTime
RocketDock 1.3.5
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Skype™ 5.8
Spybot - Search & Destroy
System Requirements Lab
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
VC80CRTRedist - 8.0.50727.4053
Windows Live Communications Platform
Windows Live Essentials
Windows Live Fotogalerie
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX control for remote connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinRAR Archivierer
.
==== End Of File ===========================

cosinus 23.02.2012 15:10
Führ bitte auch ESET aus, danach sehen wir weiter:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Kaiko 23.02.2012 16:41
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=51bba6138040bb499f83642ec3835182
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-02-23 03:29:27
# local_time=2012-02-23 04:29:27 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 972702 66538832 1017765 0
# compatibility_mode=5893 16776573 100 94 17341 81636819 0 0
# compatibility_mode=8192 67108863 100 0 3775 3775 0 0
# scanned=122734
# found=1
# cleaned=0
# scan_time=4019
C:\Users\Melly Schulz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\127a4c40-2cc265b0        Java/TrojanDownloader.Agent.AD trojan (unable to clean)        00000000000000000000000000000000        I

cosinus 23.02.2012 17:38
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Kaiko 23.02.2012 19:49
OTL Logfile:
Code:
OTL logfile created on: 23.02.2012 19:33:33 - Run 1
OTL by OldTimer - Version 3.2.33.2    Folder = C:\Users\Melly Schulz\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,73 Gb Available Physical Memory | 57,75% Memory free
5,99 Gb Paging File | 4,57 Gb Available in Paging File | 76,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 50,68 Gb Total Space | 19,94 Gb Free Space | 39,34% Space Free | Partition Type: NTFS
 
Computer Name: MELLYSCHULZ-PC | User Name: Melly Schulz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.02.23 19:28:46 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Melly Schulz\Desktop\OTL.exe
PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.01.13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.07.02 12:32:33 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.04.21 06:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.04.08 06:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.03.21 19:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2009.03.05 15:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.01.26 14:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2007.09.02 12:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files (x86)\RocketDock\RocketDock.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.03.21 19:57:34 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.03.21 19:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2009.06.17 10:40:16 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
MOD - [2009.06.17 10:40:16 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
MOD - [2009.06.17 10:40:16 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2007.09.02 12:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files (x86)\RocketDock\RocketDock.exe
MOD - [2007.09.02 12:57:36 | 000,069,632 | ---- | M] () -- C:\Program Files (x86)\RocketDock\RocketDock.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.01.31 15:09:34 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.07.02 12:32:33 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.04.08 06:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.04.01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.04.29 02:21:18 | 000,436,736 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\XAudio64.dll -- (HsfXAudioService)
SRV - [2009.01.26 14:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011.08.02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.07.02 12:32:34 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.07.02 12:32:34 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.05.13 15:37:54 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.03 16:59:18 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2010.12.16 23:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 12:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2009.10.09 01:41:02 | 001,394,176 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009.06.10 22:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009.06.10 22:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.04.29 02:21:08 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio)
DRV:64bit: - [2009.03.01 22:05:32 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.02.12 13:24:56 | 001,485,824 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV)
DRV:64bit: - [2009.02.12 13:20:56 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL)
DRV:64bit: - [2009.02.12 13:19:34 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf)
DRV:64bit: - [2008.10.03 02:40:12 | 000,264,704 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2008.03.28 01:06:00 | 000,324,656 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2006.06.17 21:27:24 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 8D DD 60 21 16 CC 01  [binary data]
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:11.0.2.556
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011.04.29 21:04:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011.04.29 21:04:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.17 15:58:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.02 21:48:51 | 000,000,000 | ---D | M]
 
[2011.04.29 20:51:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Extensions
[2012.02.15 07:33:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions
[2012.02.15 07:33:00 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2011.05.22 18:59:09 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com
[2011.03.24 12:03:00 | 000,000,923 | ---- | M] () -- C:\Users\Melly Schulz\AppData\Roaming\Mozilla\Firefox\Profiles\9mpf25v8.default\searchplugins\conduit.xml
[2011.11.10 18:53:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.02.17 15:58:12 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.02.02 20:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.12 19:49:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.12 19:49:29 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.12 19:49:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.12 19:49:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.12 19:49:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.12 19:49:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.04.29 21:16:57 | 000,433,294 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 127.0.0.1        123fporn.info
O1 - Hosts: 14910 more lines...
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001..\Run: [RocketDock] C:\Program Files (x86)\RocketDock\RocketDock.exe ()
O4 - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-1224103868-3582190197-2854413230-1004..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1224103868-3582190197-2854413230-1004..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EF38288C-2FC6-47E6-B2E6-9D57D17D1AE2}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
 
SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.23 19:28:43 | 000,583,680 | ---- | C] (OldTimer Tools) -- C:\Users\Melly Schulz\Desktop\OTL.exe
[2012.02.23 19:26:36 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{81D7CCD8-90FE-4670-9724-E4322C7136D7}
[2012.02.23 19:26:10 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{C8808FBD-5326-4E09-AEA9-3627D194B8CE}
[2012.02.23 15:19:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.02.23 11:36:16 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Roaming\Malwarebytes
[2012.02.23 11:36:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.02.23 11:36:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.02.23 11:35:59 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.02.23 11:35:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.02.23 10:44:45 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Roaming\Avira
[2012.02.23 10:42:30 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{E0A4CE82-644C-4E7A-B91A-4E74169BBCDA}
[2012.02.21 15:24:40 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012.02.21 06:57:23 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{67B841EA-AFDE-471B-9D4B-E8F59BBDA3E5}
[2012.02.21 06:57:01 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{09C31F26-E6D9-40D7-83B9-179BF91462D9}
[2012.02.20 18:56:35 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{9C370476-74A7-4A6D-A20F-970400747BE5}
[2012.02.20 18:56:22 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{40ECD04A-60C1-4005-8A04-88DAC0293BD0}
[2012.02.20 06:41:56 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{75752E13-01F8-457D-85C1-7EF82DE3BA64}
[2012.02.20 06:41:39 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{9CCCD3A0-1C7D-4E81-8A0A-EABCA3AFB565}
[2012.02.19 08:14:33 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{331651DF-FE89-44E7-865D-482C209EFCAB}
[2012.02.19 08:14:20 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{03C78A8C-AE78-4A4B-BFE2-B2BD1C5FE4A0}
[2012.02.18 20:13:48 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{F2B64C9D-403B-43CF-8DB4-0976AF655FE2}
[2012.02.18 20:13:26 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{F1BB877F-F635-4648-818A-2CDFB26DD108}
[2012.02.18 08:12:58 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{877FD7CC-1AD9-41C3-8B18-7BC27E6087C2}
[2012.02.18 08:12:33 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{A3A389B4-1F07-42F6-B454-C352344C4057}
[2012.02.17 20:11:49 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{25019F1A-5007-47E0-A53D-958544D1FBFA}
[2012.02.17 20:11:29 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{A97ECA4C-014C-43D3-8124-CD5E820E015D}
[2012.02.17 07:21:15 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{50509A4F-48DE-4A8C-A7BD-965BED94E35B}
[2012.02.17 07:20:52 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{56255C04-A495-475B-87D4-FCE8614EBF93}
[2012.02.16 19:19:14 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{D99F1BC7-F923-409F-B42C-0C6C53CA4C9D}
[2012.02.16 19:19:01 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{03D26D72-C77A-4348-8063-520083468433}
[2012.02.16 06:23:15 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{13D7989B-9C91-4433-ACF2-13092C4AB26C}
[2012.02.16 06:23:02 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{17605753-059F-4225-9F95-B3B73E98D12C}
[2012.02.15 08:32:52 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{363914B3-7DDA-4E97-B5BC-552F2E5432CA}
[2012.02.15 08:32:30 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{22B8FB6C-D250-410D-BA1A-4E4CBBCF5D09}
[2012.02.14 20:00:39 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{E6BD3058-EBC7-4104-B293-FA6896CE269F}
[2012.02.14 20:00:11 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{7B800ABF-A15C-45FC-A3F7-177DBDBD09AC}
[2012.02.14 06:18:28 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{11780F96-0A24-453A-849E-235C909543EB}
[2012.02.14 06:18:05 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{E7A5F5DF-12C0-4306-931C-F9F5CD3D088E}
[2012.02.13 14:17:57 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\Documents\Meine empfangenen Dateien
[2012.02.13 13:01:50 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{1B7ADD8F-E7F9-4592-8E7E-B8CCB2AA15D5}
[2012.02.13 13:01:38 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{02D75284-EC5B-4DAD-BA8C-0AC23EEB4AB2}
[2012.02.12 22:13:48 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{CEC131C4-0199-4E3A-9543-4415764F297D}
[2012.02.12 22:13:25 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{36F2B80D-0102-45A2-846E-393D0CB9A9F5}
[2012.02.12 10:12:45 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{63D7F300-EBA7-49AE-8B92-4423F99038CE}
[2012.02.12 10:12:32 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{D9004609-E035-4F3E-B902-D1F5D177FC8D}
[2012.02.11 19:33:31 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{E3ADEB0F-F338-4007-B9D3-191B1F8345DD}
[2012.02.11 19:33:19 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{AFA6AF86-509F-473F-9AA0-F4C710440251}
[2012.02.11 19:33:19 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{8594F631-EA07-4688-BD1B-30B55A353B11}
[2012.02.10 19:03:57 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{FD8225DA-1000-483A-BA69-DB5F5F12347A}
[2012.02.10 19:03:35 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{5E1E3BA7-6B46-44BA-B0E8-6F04AB7E8938}
[2012.02.10 07:03:05 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{DD29878F-E03E-440A-AC3C-EDFFDF1BBBC5}
[2012.02.10 07:02:53 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{ED452105-AC03-4F02-8AAA-13A56FEFD2E2}
[2012.02.09 10:00:09 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{6C413819-65B6-44C7-BE6D-061F29B71409}
[2012.02.09 09:59:58 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{6FC044B4-9029-4AE4-8E4A-E5DCB8C09742}
[2012.02.08 22:15:19 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
[2012.02.08 21:59:29 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{B24FF372-F436-479F-A973-43677CF67CD5}
[2012.02.08 21:59:07 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{88828542-E43B-4F89-8321-6892C8B3D063}
[2012.02.08 12:29:06 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Roaming\Skype
[2012.02.08 12:28:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.02.08 12:28:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.02.08 12:28:54 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2012.02.08 12:28:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2012.02.08 09:58:10 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{03BD65C4-134A-4DD4-B3C4-12C78F79EC70}
[2012.02.08 09:57:58 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{5460F2D1-A8EA-46F7-BE42-871B7629E091}
[2012.02.08 09:51:52 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{69290E09-F639-4479-AE7F-FCADE042F96F}
[2012.02.08 08:49:24 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{D9078D90-D873-4854-8A6C-8875F75FDC87}
[2012.02.07 21:53:28 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\Tracing
[2012.02.07 21:41:51 | 000,000,000 | ---D | C] -- C:\Windows\de
[2012.02.07 21:36:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2012.02.07 21:33:21 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
[2012.02.07 21:33:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live
[2012.02.07 21:32:39 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2012.02.07 21:31:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft
[2012.02.07 21:30:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012.02.07 21:30:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2012.02.07 21:29:45 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\Windows Live
[2012.02.07 21:29:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.23 19:29:56 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.23 19:29:56 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.23 19:28:46 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Melly Schulz\Desktop\OTL.exe
[2012.02.23 19:24:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.23 19:24:37 | 2413,711,360 | -HS- | M] () -- C:\hiberfil.sys
[2012.02.23 14:36:52 | 001,524,620 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.02.23 14:36:52 | 000,664,700 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.02.23 14:36:52 | 000,625,060 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.02.23 14:36:52 | 000,133,852 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.02.23 14:36:52 | 000,109,442 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.02.23 11:36:05 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.21 13:19:48 | 257,540,096 | ---- | M] () -- C:\Users\Melly Schulz\Desktop\kav_rescue_10.iso
[2012.02.15 19:54:23 | 000,415,640 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.02.08 12:28:56 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
 
========== Files Created - No Company Name ==========
 
[2012.02.23 11:36:05 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.23 10:48:17 | 257,540,096 | ---- | C] () -- C:\Users\Melly Schulz\Desktop\kav_rescue_10.iso
[2012.02.08 12:28:56 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.02.07 21:38:13 | 000,001,305 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk
[2012.02.07 21:37:37 | 000,001,374 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
[2012.02.07 21:36:14 | 000,001,458 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2012.02.07 21:35:34 | 000,002,486 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2011.11.06 22:08:24 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2011.05.28 19:23:21 | 000,037,053 | ---- | C] () -- C:\Users\Melly Schulz\AppData\Roaming\Kommagetrennte Werte (DOS).ADR
[2011.05.28 19:09:51 | 000,037,057 | ---- | C] () -- C:\Users\Melly Schulz\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
[2011.05.10 19:14:16 | 000,004,096 | -H-- | C] () -- C:\Users\Melly Schulz\AppData\Local\keyfile3.drm
[2011.04.30 16:48:49 | 000,003,584 | ---- | C] () -- C:\Users\Melly Schulz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.29 21:42:45 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
 
========== LOP Check ==========
 
[2012.01.12 21:09:07 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Aquamarin Haushaltsbuch
[2011.05.22 18:59:16 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Ashampoo
[2011.05.28 09:47:55 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\LG Electronics
[2012.01.07 09:34:49 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.05.06 19:47:02 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Adobe
[2011.05.27 20:31:56 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Apple Computer
[2012.01.12 21:09:07 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Aquamarin Haushaltsbuch
[2011.05.22 18:59:16 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Ashampoo
[2012.02.23 10:44:45 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Avira
[2011.04.29 21:04:18 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\DivX
[2011.04.29 20:33:50 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Identities
[2011.05.28 09:40:05 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\InstallShield
[2011.05.28 09:47:55 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\LG Electronics
[2011.04.30 08:21:14 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Macromedia
[2012.02.23 11:36:16 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Malwarebytes
[2009.07.14 19:18:19 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Media Center Programs
[2012.02.07 21:44:51 | 000,000,000 | --SD | M] -- C:\Users\Melly Schulz\AppData\Roaming\Microsoft
[2011.04.29 20:51:40 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Mozilla
[2011.04.29 22:01:35 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Nero
[2012.02.23 19:33:10 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Skype
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2011.12.14 04:10:13 | 009,705,472 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\ieframe.dll
[2010.11.20 13:19:56 | 001,236,992 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\msxml3.dll
 
<          >

< End of report >
--- --- ---

cosinus 23.02.2012 21:12
Zitat:
O2 - BHO: (DivX Plus Web Player HTML5 <video>)
Sagmal, gehörst du auch zur der Fraktion, die sich Serien und Kinofilme über dubiose Portale anschaut?
Wenn ja: in Zukunft Finger weg, diese illegalen Portale verbreiten Malware und wenn du in Zukunft malwarefrei sein wilst, musst du auf legale Alternativen ausweichen und auf solche riskanten Streamingseiten verzichten!

Kaiko 23.02.2012 22:00
Naja, ab und an mal OnlineStream zwecks Sky Bundesliga... aber nun haben wir Sky und das ist eigentlich erledigt.

Uhrsprünglich wollte ich mir für mein LG nen Update ziehen und diverse Programme...!
Aber nix was jetzt Illegal erschien oder der gleichen...!

Doch wie kannst du mir jetzt helfen?
Is das ding nun weg, kann mir der Trojaner noch gefährlich werden?

cosinus 24.02.2012 09:02
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
IE - HKLM\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 8D DD 60 21 16 CC 01  [binary data]
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}"
[2012.02.15 07:33:00 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2011.05.22 18:59:09 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com
[2011.03.24 12:03:00 | 000,000,923 | ---- | M] () -- C:\Users\Melly Schulz\AppData\Roaming\Mozilla\Firefox\Profiles\9mpf25v8.default\searchplugins\conduit.xml
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1224103868-3582190197-2854413230-1004..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
:Files
C:\Users\Melly Schulz\AppData\Local\{*
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Kaiko 24.02.2012 09:50
Das wäre dann auch erledigt!
Was ist nun zu tun?
Nochmal alles Scans mit AntiVir und Malewarebyts durchlaufen lassen?

Code:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ deleted successfully.
C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll moved successfully.
HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1224103868-3582190197-2854413230-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ not found.
File C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll not found.
Prefs.js: "MyAshampoo Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\modules folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\META-INF folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\defaults folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\chrome folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\searchplugin folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\META-INF folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\lib folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\DualPackage folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\defaults folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\components folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\chrome folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\Mozilla\Firefox\Profiles\9mpf25v8.default\searchplugins\conduit.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ not found.
File C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.
C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}\ deleted successfully.
File C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ not found.
File C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1224103868-3582190197-2854413230-1004\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
========== FILES ==========
C:\Users\Melly Schulz\AppData\Local\{02D75284-EC5B-4DAD-BA8C-0AC23EEB4AB2} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{03BD65C4-134A-4DD4-B3C4-12C78F79EC70} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{03C78A8C-AE78-4A4B-BFE2-B2BD1C5FE4A0} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{03D26D72-C77A-4348-8063-520083468433} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{09C31F26-E6D9-40D7-83B9-179BF91462D9} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{11780F96-0A24-453A-849E-235C909543EB} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{13D7989B-9C91-4433-ACF2-13092C4AB26C} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{17605753-059F-4225-9F95-B3B73E98D12C} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{1814472D-94CE-47AA-AC3D-4B154BFEC8AA} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{1B7ADD8F-E7F9-4592-8E7E-B8CCB2AA15D5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{22B8FB6C-D250-410D-BA1A-4E4CBBCF5D09} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{25019F1A-5007-47E0-A53D-958544D1FBFA} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{331651DF-FE89-44E7-865D-482C209EFCAB} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{363914B3-7DDA-4E97-B5BC-552F2E5432CA} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{36F2B80D-0102-45A2-846E-393D0CB9A9F5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{40ECD04A-60C1-4005-8A04-88DAC0293BD0} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{50509A4F-48DE-4A8C-A7BD-965BED94E35B} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{5460F2D1-A8EA-46F7-BE42-871B7629E091} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{56255C04-A495-475B-87D4-FCE8614EBF93} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{5E1E3BA7-6B46-44BA-B0E8-6F04AB7E8938} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{63D7F300-EBA7-49AE-8B92-4423F99038CE} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{67B841EA-AFDE-471B-9D4B-E8F59BBDA3E5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{69290E09-F639-4479-AE7F-FCADE042F96F} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{6C413819-65B6-44C7-BE6D-061F29B71409} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{6FC044B4-9029-4AE4-8E4A-E5DCB8C09742} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{75752E13-01F8-457D-85C1-7EF82DE3BA64} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{7B800ABF-A15C-45FC-A3F7-177DBDBD09AC} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{81D7CCD8-90FE-4670-9724-E4322C7136D7} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{8594F631-EA07-4688-BD1B-30B55A353B11} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{877FD7CC-1AD9-41C3-8B18-7BC27E6087C2} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{88828542-E43B-4F89-8321-6892C8B3D063} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{9C370476-74A7-4A6D-A20F-970400747BE5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{9CCCD3A0-1C7D-4E81-8A0A-EABCA3AFB565} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{A3A389B4-1F07-42F6-B454-C352344C4057} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{A97ECA4C-014C-43D3-8124-CD5E820E015D} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{AFA6AF86-509F-473F-9AA0-F4C710440251} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{B24FF372-F436-479F-A973-43677CF67CD5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{B4547B03-288B-4011-A5C9-DBC662FC3A7B} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{C8808FBD-5326-4E09-AEA9-3627D194B8CE} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{CEC131C4-0199-4E3A-9543-4415764F297D} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{D9004609-E035-4F3E-B902-D1F5D177FC8D} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{D9078D90-D873-4854-8A6C-8875F75FDC87} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{D99F1BC7-F923-409F-B42C-0C6C53CA4C9D} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{DD29878F-E03E-440A-AC3C-EDFFDF1BBBC5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{E0A4CE82-644C-4E7A-B91A-4E74169BBCDA} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{E3ADEB0F-F338-4007-B9D3-191B1F8345DD} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{E6BD3058-EBC7-4104-B293-FA6896CE269F} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{E7A5F5DF-12C0-4306-931C-F9F5CD3D088E} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{ED452105-AC03-4F02-8AAA-13A56FEFD2E2} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{F1BB877F-F635-4648-818A-2CDFB26DD108} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{F2B64C9D-403B-43CF-8DB4-0976AF655FE2} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{FD8225DA-1000-483A-BA69-DB5F5F12347A} folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Melly Schulz
->Temp folder emptied: 56788277 bytes
->Temporary Internet Files folder emptied: 222220476 bytes
->Java cache emptied: 2692016 bytes
->FireFox cache emptied: 63494316 bytes
->Flash cache emptied: 101482 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6701158 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67832 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 336,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.33.2 log created on 02242012_094311

Files\Folders moved on Reboot...
C:\Users\Melly Schulz\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Kaiko 24.02.2012 11:00
So, habe Antivir nochmal laufen lassen.

Code:


Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Freitag, 24. Februar 2012  10:03

Es wird nach 3497262 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows 7 x64
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : Melly Schulz
Computername  : MELLYSCHULZ-PC

Versionsinformationen:
BUILD.DAT      : 10.2.0.707    36070 Bytes  25.01.2012 12:53:00
AVSCAN.EXE    : 10.3.0.7      484008 Bytes  02.07.2011 11:32:33
AVSCAN.DLL    : 10.0.5.0      57192 Bytes  02.07.2011 11:32:33
LUKE.DLL      : 10.3.0.5      45416 Bytes  02.07.2011 11:32:34
LUKERES.DLL    : 10.0.0.0      13672 Bytes  14.01.2010 12:22:40
AVSCPLR.DLL    : 10.3.0.7      119656 Bytes  02.07.2011 11:32:34
AVREG.DLL      : 10.3.0.9      88833 Bytes  02.08.2011 04:58:17
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 10:49:21
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 05:52:59
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 19:26:04
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 17:34:47
VBASE004.VDF  : 7.11.21.239    2048 Bytes  01.02.2012 17:35:29
VBASE005.VDF  : 7.11.21.240    2048 Bytes  01.02.2012 17:35:29
VBASE006.VDF  : 7.11.21.241    2048 Bytes  01.02.2012 17:35:30
VBASE007.VDF  : 7.11.21.242    2048 Bytes  01.02.2012 17:35:30
VBASE008.VDF  : 7.11.21.243    2048 Bytes  01.02.2012 17:35:30
VBASE009.VDF  : 7.11.21.244    2048 Bytes  01.02.2012 17:35:30
VBASE010.VDF  : 7.11.21.245    2048 Bytes  01.02.2012 17:35:30
VBASE011.VDF  : 7.11.21.246    2048 Bytes  01.02.2012 17:35:30
VBASE012.VDF  : 7.11.21.247    2048 Bytes  01.02.2012 17:35:31
VBASE013.VDF  : 7.11.22.33  1486848 Bytes  03.02.2012 18:35:19
VBASE014.VDF  : 7.11.22.56    687616 Bytes  03.02.2012 18:35:57
VBASE015.VDF  : 7.11.22.92    178176 Bytes  06.02.2012 18:36:02
VBASE016.VDF  : 7.11.22.154  144896 Bytes  08.02.2012 18:36:06
VBASE017.VDF  : 7.11.22.220  183296 Bytes  13.02.2012 08:58:38
VBASE018.VDF  : 7.11.23.34    202752 Bytes  15.02.2012 08:58:45
VBASE019.VDF  : 7.11.23.98    126464 Bytes  17.02.2012 08:58:47
VBASE020.VDF  : 7.11.23.150  148480 Bytes  20.02.2012 08:58:50
VBASE021.VDF  : 7.11.23.224  172544 Bytes  23.02.2012 08:58:56
VBASE022.VDF  : 7.11.23.225    2048 Bytes  23.02.2012 08:58:56
VBASE023.VDF  : 7.11.23.226    2048 Bytes  23.02.2012 08:58:56
VBASE024.VDF  : 7.11.23.227    2048 Bytes  23.02.2012 08:58:56
VBASE025.VDF  : 7.11.23.228    2048 Bytes  23.02.2012 08:58:56
VBASE026.VDF  : 7.11.23.229    2048 Bytes  23.02.2012 08:58:57
VBASE027.VDF  : 7.11.23.230    2048 Bytes  23.02.2012 08:58:57
VBASE028.VDF  : 7.11.23.231    2048 Bytes  23.02.2012 08:58:57
VBASE029.VDF  : 7.11.23.232    2048 Bytes  23.02.2012 08:58:57
VBASE030.VDF  : 7.11.23.233    2048 Bytes  23.02.2012 08:58:57
VBASE031.VDF  : 7.11.23.240    50176 Bytes  23.02.2012 08:58:58
Engineversion  : 8.2.10.8 
AEVDF.DLL      : 8.1.2.2      106868 Bytes  06.11.2011 17:51:09
AESCRIPT.DLL  : 8.1.4.7      442746 Bytes  24.02.2012 08:59:43
AESCN.DLL      : 8.1.8.2      131444 Bytes  02.02.2012 17:37:14
AESBX.DLL      : 8.2.4.5      434549 Bytes  28.12.2011 19:28:39
AERDL.DLL      : 8.1.9.15      639348 Bytes  03.10.2011 07:12:19
AEPACK.DLL    : 8.2.16.3      799094 Bytes  11.02.2012 18:39:25
AEOFFICE.DLL  : 8.1.2.25      201084 Bytes  22.01.2012 18:29:18
AEHEUR.DLL    : 8.1.4.0      4436342 Bytes  24.02.2012 08:59:40
AEHELP.DLL    : 8.1.19.0      254327 Bytes  22.01.2012 18:29:15
AEGEN.DLL      : 8.1.5.21      409971 Bytes  11.02.2012 18:36:22
AEEXP.DLL      : 8.1.0.23      70005 Bytes  24.02.2012 08:59:43
AEEMU.DLL      : 8.1.3.0      393589 Bytes  21.04.2011 05:52:17
AECORE.DLL    : 8.1.25.4      201079 Bytes  24.02.2012 08:59:04
AEBB.DLL      : 8.1.1.0        53618 Bytes  21.04.2011 05:52:16
AVWINLL.DLL    : 10.0.0.0      19304 Bytes  21.04.2011 05:52:39
AVPREF.DLL    : 10.0.3.2      44904 Bytes  02.07.2011 11:32:33
AVREP.DLL      : 10.0.0.10    174120 Bytes  02.07.2011 11:32:34
AVARKT.DLL    : 10.0.26.1    255336 Bytes  02.07.2011 11:32:33
AVEVTLOG.DLL  : 10.0.0.9      203112 Bytes  02.07.2011 11:32:33
SQLITE3.DLL    : 3.6.19.0      355688 Bytes  28.01.2010 11:59:50
AVSMTP.DLL    : 10.0.0.17      63848 Bytes  21.04.2011 05:52:38
NETNT.DLL      : 10.0.0.0      11624 Bytes  21.04.2011 05:52:50
RCIMAGE.DLL    : 10.0.0.35    2589544 Bytes  02.07.2011 11:32:33
RCTEXT.DLL    : 10.0.64.0      98664 Bytes  02.07.2011 11:32:33

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\alldrives.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, F:, E:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Freitag, 24. Februar 2012  10:03

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamgui.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AdobeARM.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DivXUpdate.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'msnmsgr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RocketDock.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LightScribeControlPanel.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeaTimer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWinSec.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MDM.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LSSrvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'D:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'F:\'
    [INFO]      Im  Laufwerk 'F:\' ist kein Datenträger eingelegt!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '185' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
Beginne mit der Suche in 'D:\'
Der zu durchsuchende Pfad D:\ konnte nicht geöffnet werden!
Systemfehler [1005]: Auf dem Datenträger befindet sich kein erkanntes Dateisystem.
Beginne mit der Suche in 'F:\'
Der zu durchsuchende Pfad F:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'E:\'
Der zu durchsuchende Pfad E:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.


Ende des Suchlaufs: Freitag, 24. Februar 2012  10:39
Benötigte Zeit: 35:59 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

  26602 Verzeichnisse wurden überprüft
 332706 Dateien wurden geprüft
      0 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 332706 Dateien ohne Befall
  1495 Archive wurden durchsucht
      0 Warnungen
      0 Hinweise
Maleware:

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.23.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Melly Schulz :: MELLYSCHULZ-PC [Administrator]

Schutz: Aktiviert

24.02.2012 09:53:45
mbam-log-2012-02-24 (09-53-45).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 199027
Laufzeit: 3 Minute(n), 10 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus 24.02.2012 11:49
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Kaiko 24.02.2012 14:08
Code:
14:04:06.0206 4924        ============================================================
14:04:06.0206 4924        Scan started
14:04:06.0206 4924        Mode: Manual; SigCheck; TDLFS;
14:04:06.0206 4924        ============================================================
14:04:07.0720 4924        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
14:04:07.0735 4924        1394ohci - ok
14:04:07.0782 4924        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
14:04:07.0798 4924        ACPI - ok
14:04:07.0844 4924        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
14:04:07.0860 4924        AcpiPmi - ok
14:04:07.0922 4924        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
14:04:07.0938 4924        adp94xx - ok
14:04:07.0969 4924        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
14:04:07.0985 4924        adpahci - ok
14:04:08.0000 4924        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
14:04:08.0016 4924        adpu320 - ok
14:04:08.0063 4924        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
14:04:08.0078 4924        AFD - ok
14:04:08.0110 4924        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
14:04:08.0125 4924        agp440 - ok
14:04:08.0141 4924        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
14:04:08.0156 4924        aliide - ok
14:04:08.0172 4924        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
14:04:08.0188 4924        amdide - ok
14:04:08.0234 4924        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
14:04:08.0250 4924        AmdK8 - ok
14:04:08.0266 4924        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
14:04:08.0281 4924        AmdPPM - ok
14:04:08.0312 4924        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
14:04:08.0328 4924        amdsata - ok
14:04:08.0359 4924        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
14:04:08.0375 4924        amdsbs - ok
14:04:08.0422 4924        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
14:04:08.0422 4924        amdxata - ok
14:04:08.0531 4924        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
14:04:08.0578 4924        AppID - ok
14:04:08.0624 4924        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
14:04:08.0640 4924        arc - ok
14:04:08.0656 4924        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
14:04:08.0671 4924        arcsas - ok
14:04:08.0702 4924        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
14:04:08.0734 4924        AsyncMac - ok
14:04:08.0765 4924        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
14:04:08.0780 4924        atapi - ok
14:04:08.0827 4924        athr            (8c56e93749ba53a4b645963d3439e01e) C:\Windows\system32\DRIVERS\athrx.sys
14:04:08.0858 4924        athr - ok
14:04:08.0905 4924        avgntflt        (b1224e6b086cd6548315b04ab575a23e) C:\Windows\system32\DRIVERS\avgntflt.sys
14:04:08.0905 4924        avgntflt - ok
14:04:08.0921 4924        avipbb          (ed45f12cfa62b83765c9c1496758cc87) C:\Windows\system32\DRIVERS\avipbb.sys
14:04:08.0936 4924        avipbb - ok
14:04:08.0983 4924        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
14:04:08.0999 4924        b06bdrv - ok
14:04:09.0046 4924        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
14:04:09.0061 4924        b57nd60a - ok
14:04:09.0092 4924        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
14:04:09.0139 4924        Beep - ok
14:04:09.0155 4924        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
14:04:09.0170 4924        blbdrive - ok
14:04:09.0217 4924        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
14:04:09.0233 4924        bowser - ok
14:04:09.0264 4924        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
14:04:09.0280 4924        BrFiltLo - ok
14:04:09.0295 4924        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
14:04:09.0311 4924        BrFiltUp - ok
14:04:09.0342 4924        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
14:04:09.0358 4924        Brserid - ok
14:04:09.0389 4924        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
14:04:09.0404 4924        BrSerWdm - ok
14:04:09.0420 4924        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
14:04:09.0436 4924        BrUsbMdm - ok
14:04:09.0451 4924        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
14:04:09.0467 4924        BrUsbSer - ok
14:04:09.0482 4924        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
14:04:09.0498 4924        BTHMODEM - ok
14:04:09.0545 4924        CAXHWAZL        (d1787e11c6a0078ddeaf8cf3ee2ab293) C:\Windows\system32\DRIVERS\CAXHWAZL.sys
14:04:09.0560 4924        CAXHWAZL - ok
14:04:09.0607 4924        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
14:04:09.0638 4924        cdfs - ok
14:04:09.0685 4924        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
14:04:09.0701 4924        cdrom - ok
14:04:09.0748 4924        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
14:04:09.0763 4924        circlass - ok
14:04:09.0810 4924        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
14:04:09.0826 4924        CLFS - ok
14:04:09.0966 4924        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
14:04:09.0982 4924        CmBatt - ok
14:04:10.0028 4924        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
14:04:10.0044 4924        cmdide - ok
14:04:10.0075 4924        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
14:04:10.0106 4924        CNG - ok
14:04:10.0138 4924        CnxtHdAudService (d760753a9b2489a317d722133ce67efc) C:\Windows\system32\drivers\CHDRT64.sys
14:04:10.0153 4924        CnxtHdAudService - ok
14:04:10.0200 4924        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
14:04:10.0216 4924        Compbatt - ok
14:04:10.0262 4924        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
14:04:10.0278 4924        CompositeBus - ok
14:04:10.0294 4924        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
14:04:10.0309 4924        crcdisk - ok
14:04:10.0372 4924        CSC            (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
14:04:10.0387 4924        CSC - ok
14:04:10.0434 4924        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
14:04:10.0465 4924        DfsC - ok
14:04:10.0512 4924        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
14:04:10.0543 4924        discache - ok
14:04:10.0574 4924        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
14:04:10.0590 4924        Disk - ok
14:04:10.0652 4924        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
14:04:10.0668 4924        drmkaud - ok
14:04:10.0730 4924        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
14:04:10.0762 4924        DXGKrnl - ok
14:04:10.0871 4924        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
14:04:10.0918 4924        ebdrv - ok
14:04:10.0949 4924        ElbyCDIO        (a05fc7eca0966ebb70e4d17b855a853b) C:\Windows\system32\Drivers\ElbyCDIO.sys
14:04:10.0964 4924        ElbyCDIO - ok
14:04:11.0011 4924        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
14:04:11.0027 4924        elxstor - ok
14:04:11.0074 4924        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
14:04:11.0074 4924        ErrDev - ok
14:04:11.0136 4924        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
14:04:11.0183 4924        exfat - ok
14:04:11.0198 4924        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
14:04:11.0245 4924        fastfat - ok
14:04:11.0261 4924        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
14:04:11.0276 4924        fdc - ok
14:04:11.0308 4924        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
14:04:11.0323 4924        FileInfo - ok
14:04:11.0339 4924        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
14:04:11.0386 4924        Filetrace - ok
14:04:11.0401 4924        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
14:04:11.0417 4924        flpydisk - ok
14:04:11.0495 4924        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
14:04:11.0510 4924        FltMgr - ok
14:04:11.0542 4924        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
14:04:11.0557 4924        FsDepends - ok
14:04:11.0588 4924        fssfltr        (dc0dce4ec2c5d2cf6472f9fd6aa9a7dc) C:\Windows\system32\DRIVERS\fssfltr.sys
14:04:11.0604 4924        fssfltr - ok
14:04:11.0635 4924        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
14:04:11.0651 4924        Fs_Rec - ok
14:04:11.0698 4924        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
14:04:11.0713 4924        fvevol - ok
14:04:11.0760 4924        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
14:04:11.0760 4924        gagp30kx - ok
14:04:11.0869 4924        GEARAspiWDM    (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
14:04:11.0885 4924        GEARAspiWDM - ok
14:04:12.0010 4924        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
14:04:12.0025 4924        hcw85cir - ok
14:04:12.0119 4924        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
14:04:12.0150 4924        HdAudAddService - ok
14:04:12.0290 4924        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
14:04:12.0306 4924        HDAudBus - ok
14:04:12.0478 4924        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
14:04:12.0493 4924        HidBatt - ok
14:04:12.0540 4924        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
14:04:12.0556 4924        HidBth - ok
14:04:12.0587 4924        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
14:04:12.0602 4924        HidIr - ok
14:04:12.0649 4924        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
14:04:12.0665 4924        HidUsb - ok
14:04:12.0712 4924        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
14:04:12.0727 4924        HpSAMD - ok
14:04:12.0805 4924        HSF_DPV        (26c5d00321937e49b6bc91029947d094) C:\Windows\system32\DRIVERS\CAX_DPV.sys
14:04:12.0821 4924        HSF_DPV - ok
14:04:12.0883 4924        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
14:04:12.0930 4924        HTTP - ok
14:04:12.0977 4924        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
14:04:12.0992 4924        hwpolicy - ok
14:04:13.0024 4924        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
14:04:13.0039 4924        i8042prt - ok
14:04:13.0086 4924        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
14:04:13.0102 4924        iaStorV - ok
14:04:13.0148 4924        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
14:04:13.0148 4924        iirsp - ok
14:04:13.0195 4924        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
14:04:13.0211 4924        intelide - ok
14:04:13.0242 4924        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
14:04:13.0258 4924        intelppm - ok
14:04:13.0289 4924        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:04:13.0336 4924        IpFilterDriver - ok
14:04:13.0382 4924        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
14:04:13.0398 4924        IPMIDRV - ok
14:04:13.0460 4924        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
14:04:13.0507 4924        IPNAT - ok
14:04:13.0523 4924        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
14:04:13.0554 4924        IRENUM - ok
14:04:13.0601 4924        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
14:04:13.0601 4924        isapnp - ok
14:04:13.0663 4924        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
14:04:13.0679 4924        iScsiPrt - ok
14:04:13.0694 4924        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
14:04:13.0710 4924        kbdclass - ok
14:04:13.0741 4924        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
14:04:13.0757 4924        kbdhid - ok
14:04:13.0788 4924        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
14:04:13.0804 4924        KSecDD - ok
14:04:13.0819 4924        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
14:04:13.0835 4924        KSecPkg - ok
14:04:13.0882 4924        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
14:04:13.0913 4924        ksthunk - ok
14:04:13.0944 4924        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
14:04:13.0991 4924        lltdio - ok
14:04:14.0022 4924        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
14:04:14.0022 4924        LSI_FC - ok
14:04:14.0053 4924        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
14:04:14.0069 4924        LSI_SAS - ok
14:04:14.0084 4924        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
14:04:14.0100 4924        LSI_SAS2 - ok
14:04:14.0131 4924        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
14:04:14.0147 4924        LSI_SCSI - ok
14:04:14.0178 4924        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
14:04:14.0209 4924        luafv - ok
14:04:14.0350 4924        MBAMProtector  (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys
14:04:14.0365 4924        MBAMProtector - ok
14:04:14.0412 4924        mdmxsdk        (e4f44ec214b3e381e1fc844a02926666) C:\Windows\system32\DRIVERS\mdmxsdk.sys
14:04:14.0428 4924        mdmxsdk - ok
14:04:14.0474 4924        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
14:04:14.0490 4924        megasas - ok
14:04:14.0521 4924        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
14:04:14.0537 4924        MegaSR - ok
14:04:14.0552 4924        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
14:04:14.0584 4924        Modem - ok
14:04:14.0615 4924        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
14:04:14.0630 4924        monitor - ok
14:04:14.0677 4924        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
14:04:14.0677 4924        mouclass - ok
14:04:14.0724 4924        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
14:04:14.0740 4924        mouhid - ok
14:04:14.0771 4924        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
14:04:14.0786 4924        mountmgr - ok
14:04:14.0833 4924        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
14:04:14.0849 4924        mpio - ok
14:04:14.0880 4924        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
14:04:14.0927 4924        mpsdrv - ok
14:04:14.0974 4924        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
14:04:14.0989 4924        MRxDAV - ok
14:04:15.0036 4924        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
14:04:15.0052 4924        mrxsmb - ok
14:04:15.0098 4924        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
14:04:15.0114 4924        mrxsmb10 - ok
14:04:15.0161 4924        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
14:04:15.0176 4924        mrxsmb20 - ok
14:04:15.0317 4924        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
14:04:15.0317 4924        msahci - ok
14:04:15.0395 4924        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
14:04:15.0410 4924        msdsm - ok
14:04:15.0488 4924        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
14:04:15.0520 4924        Msfs - ok
14:04:15.0566 4924        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
14:04:15.0598 4924        mshidkmdf - ok
14:04:15.0754 4924        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
14:04:15.0754 4924        msisadrv - ok
14:04:15.0847 4924        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
14:04:15.0878 4924        MSKSSRV - ok
14:04:15.0972 4924        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
14:04:16.0019 4924        MSPCLOCK - ok
14:04:16.0128 4924        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
14:04:16.0159 4924        MSPQM - ok
14:04:16.0237 4924        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
14:04:16.0253 4924        MsRPC - ok
14:04:16.0300 4924        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
14:04:16.0300 4924        mssmbios - ok
14:04:16.0346 4924        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
14:04:16.0393 4924        MSTEE - ok
14:04:16.0393 4924        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
14:04:16.0409 4924        MTConfig - ok
14:04:16.0440 4924        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
14:04:16.0440 4924        Mup - ok
14:04:16.0471 4924        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
14:04:16.0487 4924        NativeWifiP - ok
14:04:16.0549 4924        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
14:04:16.0580 4924        NDIS - ok
14:04:16.0658 4924        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
14:04:16.0721 4924        NdisCap - ok
14:04:16.0892 4924        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
14:04:16.0924 4924        NdisTapi - ok
14:04:17.0095 4924        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
14:04:17.0142 4924        Ndisuio - ok
14:04:17.0298 4924        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
14:04:17.0329 4924        NdisWan - ok
14:04:17.0516 4924        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
14:04:17.0548 4924        NDProxy - ok
14:04:17.0719 4924        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
14:04:17.0766 4924        NetBIOS - ok
14:04:17.0938 4924        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
14:04:17.0969 4924        NetBT - ok
14:04:18.0140 4924        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
14:04:18.0156 4924        nfrd960 - ok
14:04:18.0312 4924        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
14:04:18.0359 4924        Npfs - ok
14:04:18.0530 4924        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
14:04:18.0562 4924        nsiproxy - ok
14:04:18.0764 4924        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
14:04:18.0796 4924        Ntfs - ok
14:04:18.0952 4924        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
14:04:18.0998 4924        Null - ok
14:04:19.0170 4924        NVHDA          (f2662fdc20518ee8a8eed4f61ba42349) C:\Windows\system32\drivers\nvhda64v.sys
14:04:19.0170 4924        NVHDA - ok
14:04:19.0607 4924        nvlddmkm        (a963c2c276a97b088ded5d7a83be8052) C:\Windows\system32\DRIVERS\nvlddmkm.sys
14:04:19.0825 4924        nvlddmkm - ok
14:04:20.0122 4924        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
14:04:20.0137 4924        nvraid - ok
14:04:20.0309 4924        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
14:04:20.0324 4924        nvstor - ok
14:04:20.0512 4924        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
14:04:20.0527 4924        nv_agp - ok
14:04:20.0714 4924        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
14:04:20.0714 4924        ohci1394 - ok
14:04:20.0933 4924        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
14:04:20.0948 4924        Parport - ok
14:04:21.0120 4924        partmgr        (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
14:04:21.0136 4924        partmgr - ok
14:04:21.0323 4924        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
14:04:21.0338 4924        pci - ok
14:04:21.0510 4924        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
14:04:21.0526 4924        pciide - ok
14:04:21.0713 4924        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
14:04:21.0728 4924        pcmcia - ok
14:04:21.0916 4924        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
14:04:21.0931 4924        pcw - ok
14:04:22.0103 4924        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
14:04:22.0150 4924        PEAUTH - ok
14:04:22.0415 4924        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
14:04:22.0446 4924        PptpMiniport - ok
14:04:22.0618 4924        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
14:04:22.0633 4924        Processor - ok
14:04:22.0820 4924        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
14:04:22.0867 4924        Psched - ok
14:04:23.0070 4924        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
14:04:23.0101 4924        ql2300 - ok
14:04:23.0273 4924        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
14:04:23.0273 4924        ql40xx - ok
14:04:23.0444 4924        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
14:04:23.0460 4924        QWAVEdrv - ok
14:04:23.0632 4924        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
14:04:23.0678 4924        RasAcd - ok
14:04:23.0819 4924        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
14:04:23.0866 4924        RasAgileVpn - ok
14:04:24.0006 4924        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
14:04:24.0053 4924        Rasl2tp - ok
14:04:24.0224 4924        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
14:04:24.0271 4924        RasPppoe - ok
14:04:24.0443 4924        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
14:04:24.0490 4924        RasSstp - ok
14:04:24.0661 4924        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
14:04:24.0708 4924        rdbss - ok
14:04:24.0880 4924        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
14:04:24.0895 4924        rdpbus - ok
14:04:25.0067 4924        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
14:04:25.0098 4924        RDPCDD - ok
14:04:25.0285 4924        RDPDR          (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
14:04:25.0301 4924        RDPDR - ok
14:04:25.0472 4924        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
14:04:25.0504 4924        RDPENCDD - ok
14:04:25.0675 4924        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
14:04:25.0706 4924        RDPREFMP - ok
14:04:25.0862 4924        RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys
14:04:25.0862 4924        RdpVideoMiniport - ok
14:04:25.0987 4924        RDPWD          (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
14:04:26.0018 4924        RDPWD - ok
14:04:26.0206 4924        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
14:04:26.0206 4924        rdyboost - ok
14:04:26.0440 4924        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
14:04:26.0486 4924        rspndr - ok
14:04:26.0642 4924        RTL8167        (abcb5a38a0d85bdf69b7877e1ad1eed5) C:\Windows\system32\DRIVERS\Rt64win7.sys
14:04:26.0674 4924        RTL8167 - ok
14:04:26.0814 4924        s3cap          (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
14:04:26.0830 4924        s3cap - ok
14:04:27.0032 4924        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
14:04:27.0032 4924        sbp2port - ok
14:04:27.0251 4924        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
14:04:27.0282 4924        scfilter - ok
14:04:27.0500 4924        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
14:04:27.0532 4924        secdrv - ok
14:04:27.0703 4924        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
14:04:27.0719 4924        Serenum - ok
14:04:27.0859 4924        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
14:04:27.0875 4924        Serial - ok
14:04:28.0046 4924        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
14:04:28.0046 4924        sermouse - ok
14:04:28.0280 4924        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
14:04:28.0296 4924        sffdisk - ok
14:04:28.0452 4924        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
14:04:28.0468 4924        sffp_mmc - ok
14:04:28.0624 4924        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
14:04:28.0639 4924        sffp_sd - ok
14:04:28.0826 4924        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
14:04:28.0842 4924        sfloppy - ok
14:04:29.0029 4924        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
14:04:29.0045 4924        SiSRaid2 - ok
14:04:29.0201 4924        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
14:04:29.0216 4924        SiSRaid4 - ok
14:04:29.0419 4924        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
14:04:29.0450 4924        Smb - ok
14:04:29.0638 4924        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
14:04:29.0653 4924        spldr - ok
14:04:29.0840 4924        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
14:04:29.0856 4924        srv - ok
14:04:30.0043 4924        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
14:04:30.0059 4924        srv2 - ok
14:04:30.0230 4924        SrvHsfHDA      (0c4540311e11664b245a263e1154cef8) C:\Windows\system32\DRIVERS\VSTAZL6.SYS
14:04:30.0246 4924        SrvHsfHDA - ok
14:04:30.0449 4924        SrvHsfV92      (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS
14:04:30.0480 4924        SrvHsfV92 - ok
14:04:30.0683 4924        SrvHsfWinac    (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
14:04:30.0698 4924        SrvHsfWinac - ok
14:04:30.0901 4924        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
14:04:30.0917 4924        srvnet - ok
14:04:31.0104 4924        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
14:04:31.0104 4924        stexstor - ok
14:04:31.0260 4924        storflt        (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
14:04:31.0276 4924        storflt - ok
14:04:31.0432 4924        storvsc        (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
14:04:31.0432 4924        storvsc - ok
14:04:31.0588 4924        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
14:04:31.0603 4924        swenum - ok
14:04:31.0728 4924        Synth3dVsc - ok
14:04:31.0931 4924        SynTP          (c52b05821884f9a0ebee38c45dbd73cd) C:\Windows\system32\DRIVERS\SynTP.sys
14:04:31.0946 4924        SynTP - ok
14:04:32.0212 4924        Tcpip          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
14:04:32.0258 4924        Tcpip - ok
14:04:32.0492 4924        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
14:04:32.0524 4924        TCPIP6 - ok
14:04:32.0711 4924        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
14:04:32.0742 4924        tcpipreg - ok
14:04:32.0914 4924        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
14:04:32.0945 4924        TDPIPE - ok
14:04:33.0116 4924        TDTCP          (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
14:04:33.0163 4924        TDTCP - ok
14:04:33.0335 4924        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
14:04:33.0382 4924        tdx - ok
14:04:33.0538 4924        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
14:04:33.0553 4924        TermDD - ok
14:04:33.0740 4924        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
14:04:33.0787 4924        tssecsrv - ok
14:04:33.0959 4924        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
14:04:33.0974 4924        TsUsbFlt - ok
14:04:34.0099 4924        tsusbhub - ok
14:04:34.0302 4924        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
14:04:34.0333 4924        tunnel - ok
14:04:34.0520 4924        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
14:04:34.0520 4924        uagp35 - ok
14:04:34.0708 4924        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
14:04:34.0754 4924        udfs - ok
14:04:34.0926 4924        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
14:04:34.0942 4924        uliagpkx - ok
14:04:35.0113 4924        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
14:04:35.0129 4924        umbus - ok
14:04:35.0316 4924        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
14:04:35.0332 4924        UmPass - ok
14:04:35.0519 4924        USBAAPL64      (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys
14:04:35.0534 4924        USBAAPL64 - ok
14:04:35.0706 4924        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
14:04:35.0722 4924        usbccgp - ok
14:04:35.0878 4924        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
14:04:35.0909 4924        usbcir - ok
14:04:36.0080 4924        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
14:04:36.0096 4924        usbehci - ok
14:04:36.0361 4924        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
14:04:36.0377 4924        usbhub - ok
14:04:36.0564 4924        usbohci        (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
14:04:36.0564 4924        usbohci - ok
14:04:36.0751 4924        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
14:04:36.0767 4924        usbprint - ok
14:04:36.0954 4924        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
14:04:36.0970 4924        USBSTOR - ok
14:04:37.0141 4924        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
14:04:37.0157 4924        usbuhci - ok
14:04:37.0344 4924        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
14:04:37.0360 4924        usbvideo - ok
14:04:37.0531 4924        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
14:04:37.0547 4924        vdrvroot - ok
14:04:37.0734 4924        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
14:04:37.0750 4924        vga - ok
14:04:37.0921 4924        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
14:04:37.0968 4924        VgaSave - ok
14:04:38.0140 4924        VGPU - ok
14:04:38.0327 4924        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
14:04:38.0342 4924        vhdmp - ok
14:04:38.0498 4924        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
14:04:38.0514 4924        viaide - ok
14:04:38.0701 4924        vmbus          (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
14:04:38.0701 4924        vmbus - ok
14:04:38.0873 4924        VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
14:04:38.0888 4924        VMBusHID - ok
14:04:39.0044 4924        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
14:04:39.0060 4924        volmgr - ok
14:04:39.0200 4924        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
14:04:39.0216 4924        volmgrx - ok
14:04:39.0388 4924        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
14:04:39.0403 4924        volsnap - ok
14:04:39.0559 4924        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
14:04:39.0575 4924        vsmraid - ok
14:04:39.0731 4924        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
14:04:39.0746 4924        vwifibus - ok
14:04:39.0902 4924        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
14:04:39.0918 4924        vwififlt - ok
14:04:40.0105 4924        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
14:04:40.0121 4924        WacomPen - ok
14:04:40.0292 4924        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
14:04:40.0324 4924        WANARP - ok
14:04:40.0339 4924        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
14:04:40.0370 4924        Wanarpv6 - ok
14:04:40.0589 4924        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
14:04:40.0604 4924        Wd - ok
14:04:40.0792 4924        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
14:04:40.0807 4924        Wdf01000 - ok
14:04:40.0979 4924        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
14:04:41.0010 4924        WfpLwf - ok
14:04:41.0150 4924        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
14:04:41.0166 4924        WIMMount - ok
14:04:41.0291 4924        winachsf        (a6ea7a3fc4b00f48535b506db1e86efd) C:\Windows\system32\DRIVERS\CAX_CNXT.sys
14:04:41.0322 4924        winachsf - ok
14:04:41.0478 4924        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
14:04:41.0494 4924        WinUsb - ok
14:04:41.0618 4924        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
14:04:41.0634 4924        WmiAcpi - ok
14:04:41.0821 4924        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
14:04:41.0868 4924        ws2ifsl - ok
14:04:42.0024 4924        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
14:04:42.0071 4924        WudfPf - ok
14:04:42.0242 4924        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
14:04:42.0289 4924        WUDFRd - ok
14:04:42.0445 4924        XAudio          (e8f3fa126a06f8e7088f63757112a186) C:\Windows\system32\DRIVERS\XAudio64.sys
14:04:42.0461 4924        XAudio - ok
14:04:42.0492 4924        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
14:04:42.0695 4924        \Device\Harddisk0\DR0 - ok
14:04:42.0695 4924        Boot (0x1200)  (07f5f2d4cca1b9a0c4a4c75ce0070558) \Device\Harddisk0\DR0\Partition0
14:04:42.0695 4924        \Device\Harddisk0\DR0\Partition0 - ok
14:04:42.0757 4924        Boot (0x1200)  (4eae9d2227e092f102316018f3d3a580) \Device\Harddisk0\DR0\Partition1
14:04:42.0757 4924        \Device\Harddisk0\DR0\Partition1 - ok
14:04:42.0788 4924        Boot (0x1200)  (b1e27aa018409de6bfd73f8afb883a65) \Device\Harddisk0\DR0\Partition2
14:04:42.0788 4924        \Device\Harddisk0\DR0\Partition2 - ok
14:04:42.0788 4924        ============================================================
14:04:42.0788 4924        Scan finished
14:04:42.0788 4924        ============================================================
14:04:42.0788 2164        Detected object count: 0
14:04:42.0788 2164        Actual detected object count: 0

cosinus 24.02.2012 15:45
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Kaiko 26.02.2012 19:00
War am WE leider nicht da Sorry...
Hoffe du hattest ein schönes.

So hier nun der ComboFix Code.


[CODE]
Combofix Logfile:
Code:
ComboFix 12-02-25.02 - Melly Schulz 26.02.2012  18:07:06.1.2 - x64
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.3069.2046 [GMT 1:00]
ausgeführt von:: c:\users\Melly Schulz\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-01-26 bis 2012-02-26  ))))))))))))))))))))))))))))))
.
.
2012-02-26 17:15 . 2012-02-26 17:15        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2012-02-26 17:15 . 2012-02-26 17:15        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-02-24 08:43 . 2012-02-24 08:43        --------        d-----w-        C:\_OTL
2012-02-24 08:41 . 2012-02-08 07:13        8643640        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{C661F45C-05C3-47C6-B1E6-7774403D6DDF}\mpengine.dll
2012-02-23 14:19 . 2012-02-23 14:19        --------        d-----w-        c:\program files (x86)\ESET
2012-02-23 10:36 . 2012-02-23 10:36        --------        d-----w-        c:\users\Melly Schulz\AppData\Roaming\Malwarebytes
2012-02-23 10:36 . 2012-02-23 10:36        --------        d-----w-        c:\programdata\Malwarebytes
2012-02-23 10:35 . 2012-02-23 10:36        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-02-23 10:35 . 2011-12-10 14:24        23152        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-02-23 09:44 . 2012-02-23 09:44        --------        d-----w-        c:\users\Melly Schulz\AppData\Roaming\Avira
2012-02-21 14:24 . 2012-02-21 16:27        --------        d---a-w-        C:\Kaspersky Rescue Disk 10.0
2012-02-15 05:33 . 2012-01-04 10:44        509952        ----a-w-        c:\windows\system32\ntshrui.dll
2012-02-15 05:33 . 2012-01-04 08:58        442880        ----a-w-        c:\windows\SysWow64\ntshrui.dll
2012-02-15 05:33 . 2011-12-30 06:26        515584        ----a-w-        c:\windows\system32\timedate.cpl
2012-02-15 05:33 . 2011-12-30 05:27        478720        ----a-w-        c:\windows\SysWow64\timedate.cpl
2012-02-15 05:33 . 2012-01-14 04:06        3145728        ----a-w-        c:\windows\system32\win32k.sys
2012-02-15 05:33 . 2011-12-28 03:59        498688        ----a-w-        c:\windows\system32\drivers\afd.sys
2012-02-15 05:33 . 2011-12-16 08:46        634880        ----a-w-        c:\windows\system32\msvcrt.dll
2012-02-15 05:33 . 2011-12-16 07:52        690688        ----a-w-        c:\windows\SysWow64\msvcrt.dll
2012-02-08 21:15 . 2012-02-08 21:15        --------        d-sh--w-        c:\windows\SysWow64\%APPDATA%
2012-02-08 11:29 . 2012-02-26 17:04        --------        d-----w-        c:\users\Melly Schulz\AppData\Roaming\Skype
2012-02-08 11:28 . 2012-02-08 11:28        --------        d-----w-        c:\program files (x86)\Common Files\Skype
2012-02-08 11:28 . 2012-02-08 11:28        --------        d-----r-        c:\program files (x86)\Skype
2012-02-08 11:28 . 2012-02-08 11:28        --------        d-----w-        c:\programdata\Skype
2012-02-07 20:53 . 2012-02-26 16:51        --------        d-----w-        c:\users\Melly Schulz\Tracing
2012-02-07 20:41 . 2012-02-07 20:41        --------        d-----w-        c:\windows\de
2012-02-07 20:36 . 2012-02-07 20:36        --------        d-----w-        c:\program files (x86)\Microsoft SQL Server Compact Edition
2012-02-07 20:33 . 2011-05-13 14:37        48488        ----a-w-        c:\windows\system32\drivers\fssfltr.sys
2012-02-07 20:33 . 2012-02-07 20:42        --------        d-----w-        c:\program files (x86)\Windows Live
2012-02-07 20:32 . 2012-02-07 20:33        --------        d-----w-        c:\program files\Windows Live
2012-02-07 20:31 . 2012-02-07 20:31        --------        d-----w-        c:\program files (x86)\Microsoft
2012-02-07 20:31 . 2009-09-04 16:44        69464        ----a-w-        c:\windows\SysWow64\XAPOFX1_3.dll
2012-02-07 20:31 . 2009-09-04 16:44        515416        ----a-w-        c:\windows\SysWow64\XAudio2_5.dll
2012-02-07 20:31 . 2009-09-04 16:29        453456        ----a-w-        c:\windows\SysWow64\d3dx10_42.dll
2012-02-07 20:31 . 2009-09-04 16:29        523088        ----a-w-        c:\windows\system32\d3dx10_42.dll
2012-02-07 20:31 . 2006-11-29 12:06        4398360        ----a-w-        c:\windows\system32\d3dx9_32.dll
2012-02-07 20:31 . 2006-11-29 12:06        3426072        ----a-w-        c:\windows\SysWow64\d3dx9_32.dll
2012-02-07 20:30 . 2012-02-16 05:21        --------        d-----w-        c:\program files (x86)\Microsoft Silverlight
2012-02-07 20:29 . 2012-02-26 16:52        --------        d-----w-        c:\users\Melly Schulz\AppData\Local\Windows Live
2012-02-07 20:29 . 2012-02-07 20:29        --------        d-----w-        c:\program files (x86)\Common Files\Windows Live
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-07 20:32 . 2011-03-28 17:36        18328        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-01-29 04:10 . 2011-04-29 20:00        279656        ------w-        c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-01-31 17147528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-04-08 2218600]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 10:11        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1234216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Melly Schulz\AppData\Roaming\Mozilla\Firefox\Profiles\9mpf25v8.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.startup.homepage - google.de
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-02-26  18:33:57 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-02-26 17:33
.
Vor Suchlauf: 14 Verzeichnis(se), 20.846.116.864 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 21.134.860.288 Bytes frei
.
- - End Of File - - 64E9394928E6D2F323FB1ACD60192E7D
--- --- ---

cosinus 26.02.2012 19:35
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehlalarm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Kaiko 26.02.2012 21:01
Code:

aswMBR version 0.9.9.1649 Copyright(c) 2011 AVAST Software
Run date: 2012-02-26 20:51:58
-----------------------------
20:51:58.425    OS Version: Windows x64 6.1.7601 Service Pack 1
20:51:58.425    Number of processors: 2 586 0xF0D
20:51:58.425    ComputerName: MELLYSCHULZ-PC  UserName: Melly Schulz
20:51:58.940    Initialize success
20:52:03.604    AVAST engine defs: 12022602
20:52:06.818    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
20:52:06.818    Disk 0 Vendor: WDC_WD2500BEVT-00A23T0 01.01A01 Size: 238475MB BusType: 11
20:52:06.833    Disk 0 MBR read successfully
20:52:06.833    Disk 0 MBR scan
20:52:06.849    Disk 0 Windows 7 default MBR code
20:52:06.865    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
20:52:06.880    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        51899 MB offset 206848
20:52:06.896    Disk 0 Partition 3 00    06        FAT16            186474 MB offset 106496000
20:52:06.927    Disk 0 scanning C:\Windows\system32\drivers
20:52:18.908    Service scanning
20:53:14.819    Modules scanning
20:53:14.819    Disk 0 trace - called modules:
20:53:14.819   
20:53:15.553    AVAST engine scan C:\Windows
20:53:17.986    AVAST engine scan C:\Windows\system32
20:56:00.384    AVAST engine scan C:\Windows\system32\drivers
20:56:12.896    AVAST engine scan C:\Users\Melly Schulz
20:57:39.976    AVAST engine scan C:\ProgramData
20:58:21.145    Scan finished successfully
20:58:29.272    Disk 0 MBR has been saved successfully to "C:\Users\Melly Schulz\Desktop\MBR.dat"
20:58:29.272    The log file has been saved successfully to "C:\Users\Melly Schulz\Desktop\aswMBR3.txt"

cosinus 26.02.2012 21:24
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Kaiko 27.02.2012 09:12
Hab das Komplette Program noch offen und Warte auf deine Antwort was ich machen soll...

Remove Treads???


Code:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 02/27/2012 at 09:09 AM

Application Version : 5.0.1144

Core Rules Database Version : 8279
Trace Rules Database Version: 6091

Scan type      : Complete Scan
Total Scan Time : 01:14:11

Operating System Information
Windows 7 Ultimate 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 558
Memory threats detected  : 0
Registry items scanned    : 69542
Registry threats detected : 0
File items scanned        : 125872
File threats detected    : 555

Adware.Tracking Cookie
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\melly_schulz@partypoker[2].txt [ /partypoker ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\NDG5806I.txt [ /invitemedia.com ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\LU9G0VEU.txt [ /ad.zanox.com ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\I0PEDUMS.txt [ /microsoftwllivemkt.112.2o7.net ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\Q3CC7RK1.txt [ /bs.serving-sys.com ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\4FAQNAT5.txt [ /microsoftxbox.112.2o7.net ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\K2KSKRDR.txt [ /serving-sys.com ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\I7CKOAVX.txt [ /adfarm1.adition.com ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\OLLPKCG8.txt [ /media6degrees.com ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\3C4CFAB3.txt [ /ru4.com ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\VG9451P6.txt [ /ad2.adfarm1.adition.com ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\XTA0J2SS.txt [ /zanox.com ]
        C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Cookies\YDOSH1G6.txt [ /smartadserver.com ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@rts.pgmediaserve[1].txt [ Cookie:melly schulz@rts.pgmediaserve.com/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@adnetxchange[2].txt [ Cookie:melly schulz@adnetxchange.com/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@de.partypoker[2].txt [ Cookie:melly schulz@de.partypoker.com/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@adfarm1.adition[2].txt [ Cookie:melly schulz@adfarm1.adition.com/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@ero-advertising[2].txt [ Cookie:melly schulz@ero-advertising.com/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@www.sexpartnerclub[1].txt [ Cookie:melly schulz@www.sexpartnerclub.de/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@content.yieldmanager[3].txt [ Cookie:melly schulz@content.yieldmanager.com/ak/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@rambler[2].txt [ Cookie:melly schulz@rambler.ru/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@yadro[1].txt [ Cookie:melly schulz@yadro.ru/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\GZ239I5D.txt [ Cookie:melly schulz@vodafonegroup.122.2o7.net/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@www.youporn[1].txt [ Cookie:melly schulz@www.youporn.com/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@youporn[2].txt [ Cookie:melly schulz@youporn.com/ ]
        C:\USERS\MELLY SCHULZ\AppData\Roaming\Microsoft\Windows\Cookies\Low\melly_schulz@adultfriendfinder[1].txt [ Cookie:melly schulz@adultfriendfinder.com/ ]
        C:\USERS\MELLY SCHULZ\Cookies\NDG5806I.txt [ Cookie:melly schulz@invitemedia.com/ ]
        C:\USERS\MELLY SCHULZ\Cookies\Q3CC7RK1.txt [ Cookie:melly schulz@bs.serving-sys.com/ ]
        C:\USERS\MELLY SCHULZ\Cookies\K2KSKRDR.txt [ Cookie:melly schulz@serving-sys.com/ ]
        C:\USERS\MELLY SCHULZ\Cookies\I7CKOAVX.txt [ Cookie:melly schulz@adfarm1.adition.com/ ]
        C:\USERS\MELLY SCHULZ\Cookies\3C4CFAB3.txt [ Cookie:melly schulz@ru4.com/ ]
        C:\USERS\MELLY SCHULZ\Cookies\VG9451P6.txt [ Cookie:melly schulz@ad2.adfarm1.adition.com/ ]
        C:\USERS\MELLY SCHULZ\Cookies\XTA0J2SS.txt [ Cookie:melly schulz@zanox.com/ ]
        C:\USERS\MELLY SCHULZ\Cookies\YDOSH1G6.txt [ Cookie:melly schulz@smartadserver.com/ ]
        C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MELLY_SCHULZ@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]
        C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MELLY_SCHULZ@ADS.TRAFFIKINGS[1].TXT [ /ADS.TRAFFIKINGS ]
        C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MELLY_SCHULZ@CONTENT.YIELDMANAGER[2].TXT [ /CONTENT.YIELDMANAGER ]
        C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MELLY_SCHULZ@SEXPARTNERCLUB[2].TXT [ /SEXPARTNERCLUB ]
        C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MELLY_SCHULZ@PARTYPOKER[1].TXT [ /PARTYPOKER ]
        C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MELLY_SCHULZ@ADS.YOUPORN[1].TXT [ /ADS.YOUPORN ]
        C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\MELLY_SCHULZ@ADS.CRAKMEDIA[2].TXT [ /ADS.CRAKMEDIA ]
        .smartadserver.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adxpose.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .traffichaus.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .harrenmedianetwork.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .rambler.ru [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        urbia.wwe-media.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ads2.4crazy-europe.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ads.adxvalue.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .gostats.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        media.gan-online.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .getclicky.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .static.getclicky.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        in.getclicky.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.sexygbpics.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.sexygbpics.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .sexygbpics.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .sexygbpics.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        api.zanox.ws [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ads2.4crazy-europe.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ads.gamesbannernet.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ads.gamesbannernet.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ads1.moonchildmedia.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .yieldmanager.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .stepstone.112.2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adserver2.clipkit.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adserver.w3anythink.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        s09.flagcounter.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .conrad.122.2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .discount24.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .discount24.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aelyomcjiep.stats.esomniture.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aeliklczsgp.stats.esomniture.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adserver.eclickz.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        partners.webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        partners.webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ad.adserver01.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .urbia.wwe-media.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .elitepartner.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .elitepartner.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .elitepartner.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        media.stage-entertainment.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hairfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .de.hairfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .de.hairfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .jobscanner.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .jobscanner.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ads.click-business.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        zbox.zanox.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ads20.wwe-media.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ads20.wwe-media.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ads20.wwe-media.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        counter.devk.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        tracking.mobile.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .audiag.112.2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .autoscout24.112.2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .game-clicks.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .sonyeurope.112.2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .parship.122.2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ads.rokatraffic.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .telefonsex.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .telefonsex.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .schlampen-telefonsex.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .schlampen-telefonsex.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.schlampen-telefonsex.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.schlampen-telefonsex.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        media.gan-online.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .komtrack.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .komtrack.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adserver.momo-net.ch [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .gostats.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.maxxxads.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.pornosl.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.reifersex.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .youporn.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .youporn.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.pornme.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        pt.trafficjunky.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        pt.trafficjunky.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        pt.trafficjunky.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.altxxx.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .forcedsexfhgs.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .forcedsexfhgs.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adserver.i3d.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adserver.momo-net.ch [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.livecamsexchat.org [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.adult-tracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .seniorfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .seniorfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .seniorfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .seniorfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .seniorfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .seniorfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .seniorfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .seniorfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.seximfreien.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .unzensierte-pornobilder.thumblogger.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .unzensierte-pornobilder.thumblogger.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .schlampensex.thumblogger.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .schlampensex.thumblogger.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.porno-hub.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .tradetracker.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .microsoftwllivemkt.112.2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ads2.zeusclicks.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adinterax.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        studivz.adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        studivz.adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .mmotraffic.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .newsclick.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .newsclick.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextubepremium.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextubepremium.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .girlsteachsex.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .sexforum.tv [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .sexforum.tv [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .sexforum.tv [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .sexforum.tv [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .josefines-sexkino.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .josefines-sexkino.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.xxxcounter.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ads.crakmedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .sexad.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .de.partypoker.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .pornoadler.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .pornoadler.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adserver.cpms.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adserver.anschlusstor.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .aka-cdn-ns.adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hightraffic.hugoboss.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hightraffic.hugoboss.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adserver.hardsextube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adt.traffictrack.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ad.adserver01.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .skydeutschland.122.2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .tto2.traffictrack.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        stats.o2more.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        stats.o2more.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .bullporn.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .bullporn.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .pornme.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .pornme.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.pornme.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.pornme.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .pornpros.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .pornpros.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adinterax.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .secmedia.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.usenext.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        partners.webmasterplan.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        freepornmpg.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        freepornmpg.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        freepornmpg.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        freepornmpg.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        teenporni.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .syndication.traffichaus.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .syndication.traffichaus.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .syndication.traffichaus.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .exoclick.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .exoclick.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adxpansion.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        teenporni.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        teenporni.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .fuckteenmovs.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        fuckteenmovs.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        fuckteenmovs.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .noccxxx.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        noccxxx.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        bobiporn.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        xxxhubster.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .blogads.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .blogads.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .kaspersky.122.2o7.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adserv.kwick.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        adserv.kwick.de [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\MELLY SCHULZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9MPF25V8.DEFAULT\COOKIES.SQLITE ]

Adware.Toggle
        C:\USERS\MELLY SCHULZ\DESKTOP\INSTALLER_KASPERSKY_TDSSKILLER.EXE

Kaiko 27.02.2012 09:55
Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.26.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Melly Schulz :: MELLYSCHULZ-PC [Administrator]

Schutz: Aktiviert

27.02.2012 09:13:52
mbam-log-2012-02-27 (09-13-52).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 313995
Laufzeit: 39 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus 27.02.2012 10:42
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Kaiko 27.02.2012 10:49
Sollte ich nun als Auswahl bei dem Programm Super AntiSpyware auf Remove Treads oder Abbrechen klicken, kann ich diese Cookies entfernen..so dass sie gelöscht sind?

cosinus 27.02.2012 11:17
Ja die können weg

Kaiko 27.02.2012 13:40
Hey Arne, erstmal ein Dickes Lob an Dich und Danke das du Uns geholfen hast.!
Schön das es noch solche Leute gibt...

In diesem Sinne wünsche Ich dir nen wundervollen Tag!

Danke Danke Danke...

P.S.: Welche Programme genau, kannst du Uns Empfehlen unseren Lappi zu schützen???

cosinus 27.02.2012 14:59
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:32 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129