Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Abnow.com-Weiterleitung von Google und Yahoo-Links - Massiver Virenfund auf Avira (https://www.trojaner-board.de/110620-abnow-com-weiterleitung-google-yahoo-links-massiver-virenfund-avira.html)

floribu 29.02.2012 14:07
Abnow.com-Weiterleitung von Google und Yahoo-Links - Massiver Virenfund auf Avira
 
Hallo an alle,

ich brauche Hilfe, bei einem wahrscheinlich gerade für viele aktuellem Virusproblem. Mein Computer leitet seit gestern Nachmittag alle Links auf Google und Yahoo auf Links um, die mit (www.)abnow.com anfangen und außerdem hat die Rechengeschwindigkeit stark abgenommen. Ich bin leider nur ein "normaler" Bürocomputer-Nutzer und damit kein Spezialist und die bisherigen Einträge haben mir nur leidlich geholfen, weil ich mich dann bei den Lösungsvorschlägen immer schwer tue.

Mein Avira Virenprogramm Version 12.0.0.898 hat inzwischen 62 Virenbefälle registriert.

Ich habe gleich einmal alle Logs (Malwarebytes, GMER und Avira) hier zum Durchgucken:

Code:
Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.29.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Florian Burkhardtt :: FLORIANBURKHARD [limitiert]

Schutz: Aktiviert

29.02.2012 13:33:01
mbam-log-2012-02-29 (13-49-07).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 196582
Laufzeit: 15 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKLM\System\CurrentControlSet\Services\svchost (Backdoor.Bot) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Backdoor.Agent) -> Daten: C:\Users\Florian Burkhardtt\AppData\Local\67b8bb43\X -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Users\Florian Burkhardtt\AppData\Local\Temp\24B6.tmp (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\Florian Burkhardtt\AppData\Local\Temp\{E9C1E1AC-C9B2-4c85-94DE-9C1518918D02}.tlb (Rootkit.Zeroaccess) -> Keine Aktion durchgeführt.
C:\Windows\Temp\{E9C1E1AC-C9B2-4c85-94DE-9C1518918D02}.tlb (Rootkit.Zeroaccess) -> Keine Aktion durchgeführt.

(Ende)
Code:
aswMBR version 0.9.9.1649 Copyright(c) 2011 AVAST Software
Run date: 2012-02-29 13:18:12
-----------------------------
13:18:12.969    OS Version: Windows x64 6.1.7601 Service Pack 1
13:18:12.969    Number of processors: 2 586 0x170A
13:18:12.969    ComputerName: FLORIANBURKHARD  UserName:
13:18:19.084    Initialize success
13:18:33.145    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
13:18:33.145    Disk 0 Vendor: Hitachi_HDS721032CLA362 JPFOA3EA Size: 305245MB BusType: 3
13:18:33.176    Disk 0 MBR read successfully
13:18:33.176    Disk 0 MBR scan
13:18:33.176    Disk 0 Windows 7 default MBR code
13:18:33.192    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        16384 MB offset 2048
13:18:33.207    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 33556480
13:18:33.238    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      144334 MB offset 33761280
13:18:33.254    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      144425 MB offset 329357312
13:18:33.285    SubSystem.Windows: C:\Windows\system32\consrv.dll  **SUSPICIOUS**
13:18:33.301    Disk 0 scanning C:\Windows\system32\drivers
13:18:50.165    Service scanning
13:19:45.831    Modules scanning
13:19:45.831    Disk 0 trace - called modules:
13:19:46.362    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys
13:19:46.362    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800337f060]
13:19:46.362    3 CLASSPNP.SYS[fffff8800160143f] -> nt!IofCallDriver -> [0xfffffa8002f25520]
13:19:46.377    5 ACPI.sys[fffff88000e0b7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa8002f21680]
13:19:46.377    Scan finished successfully
13:20:02.024    Disk 0 MBR has been saved successfully to "C:\Users\Florian Burkhardtt\Desktop\MBR.dat"
13:20:02.024    The log file has been saved successfully to "C:\Users\Florian Burkhardtt\Desktop\aswMBR.txt"
Code:

Avira Free Antivirus
Erstellungsdatum der Reportdatei: Mittwoch, 29. Februar 2012  13:53

Es wird nach 3508202 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows 7 x64
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : Florian Burkhardtt
Computername  : FLORIANBURKHARD

Versionsinformationen:
BUILD.DAT      : 12.0.0.898          Bytes  31.01.2012 13:51:00
AVSCAN.EXE    : 12.1.0.20    492496 Bytes  31.01.2012 07:55:52
AVSCAN.DLL    : 12.1.0.18      65744 Bytes  31.01.2012 07:56:29
LUKE.DLL      : 12.1.0.19      68304 Bytes  31.01.2012 07:56:01
AVSCPLR.DLL    : 12.1.0.22    100048 Bytes  31.01.2012 07:55:52
AVREG.DLL      : 12.1.0.29    228048 Bytes  31.01.2012 07:55:51
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 10:49:21
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 07:56:15
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 07:56:21
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 15:35:23
VBASE004.VDF  : 7.11.21.239    2048 Bytes  01.02.2012 15:35:23
VBASE005.VDF  : 7.11.21.240    2048 Bytes  01.02.2012 15:35:23
VBASE006.VDF  : 7.11.21.241    2048 Bytes  01.02.2012 15:35:23
VBASE007.VDF  : 7.11.21.242    2048 Bytes  01.02.2012 15:35:23
VBASE008.VDF  : 7.11.21.243    2048 Bytes  01.02.2012 15:35:23
VBASE009.VDF  : 7.11.21.244    2048 Bytes  01.02.2012 15:35:23
VBASE010.VDF  : 7.11.21.245    2048 Bytes  01.02.2012 15:35:23
VBASE011.VDF  : 7.11.21.246    2048 Bytes  01.02.2012 15:35:23
VBASE012.VDF  : 7.11.21.247    2048 Bytes  01.02.2012 15:35:23
VBASE013.VDF  : 7.11.22.33  1486848 Bytes  03.02.2012 15:35:26
VBASE014.VDF  : 7.11.22.56    687616 Bytes  03.02.2012 15:35:27
VBASE015.VDF  : 7.11.22.92    178176 Bytes  06.02.2012 15:35:27
VBASE016.VDF  : 7.11.22.154  144896 Bytes  08.02.2012 15:35:28
VBASE017.VDF  : 7.11.22.220  183296 Bytes  13.02.2012 15:35:28
VBASE018.VDF  : 7.11.23.34    202752 Bytes  15.02.2012 15:35:29
VBASE019.VDF  : 7.11.23.98    126464 Bytes  17.02.2012 15:35:29
VBASE020.VDF  : 7.11.23.150  148480 Bytes  20.02.2012 15:35:29
VBASE021.VDF  : 7.11.23.224  172544 Bytes  23.02.2012 15:35:30
VBASE022.VDF  : 7.11.24.52    219648 Bytes  28.02.2012 15:35:30
VBASE023.VDF  : 7.11.24.53      2048 Bytes  28.02.2012 15:35:30
VBASE024.VDF  : 7.11.24.54      2048 Bytes  28.02.2012 15:35:30
VBASE025.VDF  : 7.11.24.55      2048 Bytes  28.02.2012 15:35:30
VBASE026.VDF  : 7.11.24.56      2048 Bytes  28.02.2012 15:35:30
VBASE027.VDF  : 7.11.24.57      2048 Bytes  28.02.2012 15:35:30
VBASE028.VDF  : 7.11.24.58      2048 Bytes  28.02.2012 15:35:30
VBASE029.VDF  : 7.11.24.59      2048 Bytes  28.02.2012 15:35:30
VBASE030.VDF  : 7.11.24.60      2048 Bytes  28.02.2012 15:35:30
VBASE031.VDF  : 7.11.24.62    12288 Bytes  28.02.2012 15:35:30
Engineversion  : 8.2.10.8 
AEVDF.DLL      : 8.1.2.2      106868 Bytes  31.01.2012 07:55:38
AESCRIPT.DLL  : 8.1.4.7      442746 Bytes  28.02.2012 15:35:37
AESCN.DLL      : 8.1.8.2      131444 Bytes  28.02.2012 15:35:36
AESBX.DLL      : 8.2.4.5      434549 Bytes  31.01.2012 07:55:37
AERDL.DLL      : 8.1.9.15      639348 Bytes  31.01.2012 07:55:37
AEPACK.DLL    : 8.2.16.3      799094 Bytes  28.02.2012 15:35:36
AEOFFICE.DLL  : 8.1.2.25      201084 Bytes  31.01.2012 07:55:36
AEHEUR.DLL    : 8.1.4.0      4436342 Bytes  28.02.2012 15:35:35
AEHELP.DLL    : 8.1.19.0      254327 Bytes  28.02.2012 15:35:32
AEGEN.DLL      : 8.1.5.21      409971 Bytes  28.02.2012 15:35:31
AEEXP.DLL      : 8.1.0.23      70005 Bytes  28.02.2012 15:35:37
AEEMU.DLL      : 8.1.3.0      393589 Bytes  31.01.2012 07:55:34
AECORE.DLL    : 8.1.25.4      201079 Bytes  28.02.2012 15:35:31
AEBB.DLL      : 8.1.1.0        53618 Bytes  31.01.2012 07:55:33
AVWINLL.DLL    : 12.1.0.17      27344 Bytes  31.01.2012 07:55:54
AVPREF.DLL    : 12.1.0.17      51920 Bytes  31.01.2012 07:55:51
AVREP.DLL      : 12.1.0.17    179408 Bytes  31.01.2012 07:55:51
AVARKT.DLL    : 12.1.0.23    209360 Bytes  31.01.2012 07:55:46
AVEVTLOG.DLL  : 12.1.0.17    169168 Bytes  31.01.2012 07:55:47
SQLITE3.DLL    : 3.7.0.0      398288 Bytes  31.01.2012 07:56:07
AVSMTP.DLL    : 12.1.0.17      62928 Bytes  31.01.2012 07:55:52
NETNT.DLL      : 12.1.0.17      17104 Bytes  31.01.2012 07:56:02
RCIMAGE.DLL    : 12.1.0.17    4447952 Bytes  31.01.2012 07:56:32
RCTEXT.DLL    : 12.1.0.16      98512 Bytes  31.01.2012 07:56:32

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Manuelle Auswahl
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\PROFILES\folder.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, E:, F:, G:, H:, I:, J:, Q:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Mittwoch, 29. Februar 2012  13:53

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD2
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD3
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD4
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD5
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Bootsektor 'D:\'
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Bootsektor 'F:\'
    [INFO]      Im  Laufwerk 'F:\' ist kein Datenträger eingelegt!
Bootsektor 'G:\'
    [INFO]      Im  Laufwerk 'G:\' ist kein Datenträger eingelegt!
Bootsektor 'H:\'
    [INFO]      Im  Laufwerk 'H:\' ist kein Datenträger eingelegt!
Bootsektor 'I:\'
    [INFO]      Im  Laufwerk 'I:\' ist kein Datenträger eingelegt!
Bootsektor 'J:\'
    [INFO]      Im  Laufwerk 'J:\' ist kein Datenträger eingelegt!
Bootsektor 'Q:\'
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'plugin-container.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'IELowutil.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqgpc01.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqbam08.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqSTE08.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'fpassist.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpwuschd2.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'HotkeyUtility.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.bin' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqtra08.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '1' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Windows\Sysnative\AdobeActiveFileMonitor6.0.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\fsaa.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\ipnat.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\UxTuneUp.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\nvstor64.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\pepifilter.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\marvinbus.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\RapiMgr.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\int15.sys.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\NIPALK.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\z800obex.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\wusb54gv2svc.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\ca-messagequeuing.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\backupclientsvc.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\tosporte.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\bglivesvc.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\aswrdr.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\ZSMC303.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\mraid35x.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\sonicatheaterinstallerservice.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\VirtualCam.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\usbser.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\mxssvr.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\ADIDTSFiltService.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\imonitor.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\cpuidlep.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\wap3gx.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\ageremodemaudio.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\ICAM3NT5.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\bdpredir.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\WISTechVIDCAP.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\volsnap.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\MaxtorFrontPanel1.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\swmidi.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\vmkbd.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\moufiltr.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\wwnetdde.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\npapimon.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\egathdrv.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\dnetc.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\LVRS.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\nvrd32.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\eectrl.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\SNMPTRAP.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\sweepsrv.sys.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\rimvserport.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\tunnelguardservice.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\PNDIS5.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\cis1284.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\imaservice.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\w810bus.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\sony_ssm.sys.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\IBMTPCHK.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\SenFiltService.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\sonicwall_netextender.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\winsock2.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\perc2.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\wstcodec.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\symdns.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\dsbrokerservice.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\update.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen
C:\Windows\Sysnative\bgsvcgen.dll
  [FUND]      Ist das Trojanische Pferd TR/ATRAPS.Gen

Die Registry wurde durchsucht ( '1298' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <Packard Bell>

Beginne mit der Desinfektion:
Mein PC ist ein Fertig-PC von Packard Bell, Typ Imedia, gekauft Ende 2010, falls das weiterhilft.

Es würde mich super freuen, wenn mir irgendjemand dabei weiterhelfen kann und mir sagt, was ich nun am besten tun kann. Da ich kein Computerspezialist bin, muss ich mir das Thema nun hier eben erarbeiten, brauche dazu aber definitiv Unterstützung.

Ich habe meine Daten nun schon per USB-Stick und externe Festplatte abgespreichert, bin mir aber überhaupt nicht sicher, ob diese nicht auch schon durch den reinen Kontakt mit meinem PC vom Virus befallen sein könnten. Auch hier bräuchte ich Unterstützung.

Danke im Voraus. Florian

cosinus 29.02.2012 16:29
Du hast offensichtlich einen ZeroAccess drauf, der ist immer ungemütlich. :(
Ich würde dir erstmal für den Fall der Fälle eine Datensicherung empfehlen und dich darauf vorzubereiten, eine komplette Neuinstallation von Windows durchzuführen, den ZA kann man nämlich nicht immer per Bereinigung entfernen!

Zum Thema Datensicherung von infizierten Systemen; mach das über ne Live-CD wie Knoppix, Ubuntu (zweiter Link in meiner Signatur) oder über PartedMagic. Grund: Bei einem Live-System sind keine Schädlinge des infizierten Windows-Systems aktiv, damit ist dann auch eine negative Beeinflussung des Backups durch Schädlinge ausgeschlossen.

Du brauchst natürlich auch ein Sicherungsmedium, am besten dürfte eine externe Platte sein. Sofern du nicht allzuviel sichern musst, kann auch ein USB-Stick ausreichen.

Hier eine kurze Anleitung zu PartedMagic, funktioniert prinzipell so aber fast genauso mit allen anderen Live-Systemen auch.

1. Lade Dir das ISO-Image von PartedMagic herunter, müssten ca. 180 MB sein
2. Brenn es per Imagebrennfunktion auf CD, geht zB mit ImgBurn unter Windows
3. Boote von der gebrannten CD, im Bootmenü von Option 1 starten und warten bis der Linux-Desktop oben ist

http://partedmagic.com/lib/exe/fetch...ia=desktop.png

4. Du müsstest ein Symbol "Mount Devices" finden, das doppelklicken
5. Mounte die Partitionen wo Windows installiert ist, meistens isses /dev/sda1 und natürlich noch etwaige andere Partitionen, wo noch Daten liegen und die gesichert werden müssen - natürlich auch die der externen Platte (du bekommmst nur Lese- und Schreibzugriffe auf die Dateisysteme, wenn diese gemountet sind)
6. Kopiere die Daten der internen Platte auf die externe Platte - kopiere nur persönliche Dateien, Musik, Videos, etc. auf die Backupplatte, KEINE ausführbaren Dateien wie Programme/Spiele/Setups!!
7. Wenn fertig, starte den Rechner neu, schalte die ext. Platte ab und boote wieder Windows


Wenn du dir sicher bist, dass du auch Daten unter Linux gesichert hast, führst du mal Combofix aus:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

floribu 29.02.2012 20:23
Hallo cosinus,

danke für die Erklärung und Hilfe. Ich werde das mal auf diese Art versuchen. Habe mir die Anleitung schon aus einem anderen Thread rausgezogen und gucke mal wie weit ich alleine komme. Sobald ich nicht mehr weiter weiß, poste ich wieder.

Hier übrigens noch die Log-Datei aus dem ESET Online Scanner:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f69f2a199142b240b55b3edfdbe2ef32
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-02-29 03:33:07
# local_time=2012-02-29 04:33:07 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 89382 89382 0 0
# compatibility_mode=5893 16776574 66 94 117409 82158889 0 0
# compatibility_mode=8192 67108863 100 0 3754 3754 0 0
# scanned=19432
# found=0
# cleaned=0
# scan_time=548
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f69f2a199142b240b55b3edfdbe2ef32
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-02-29 07:00:25
# local_time=2012-02-29 08:00:25 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=1792 16777215 100 0 89997 89997 0 0
# compatibility_mode=5893 16776574 66 94 118024 82159504 0 0
# compatibility_mode=8192 67108863 100 0 4369 4369 0 0
# scanned=203818
# found=10
# cleaned=0
# scan_time=12369
C:\Users\Florian Burkhardtt\AppData\Local\67b8bb43\X        Win64/Sirefef.Q Trojaner (Säubern nicht möglich)        00000000000000000000000000000000        I
C:\Users\Florian Burkhardtt\AppData\Local\67b8bb43\U\800000cf.@        Win64/Sirefef.U Trojaner (Säubern nicht möglich)        00000000000000000000000000000000        I
C:\Users\Florian Burkhardtt\AppData\Local\Temp\24B6.tmp        Variante von Win32/Kryptik.ABOS Trojaner (Säubern nicht möglich)        00000000000000000000000000000000        I
C:\Users\Florian Burkhardtt\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\2f731513-4dd26d48        Java/Agent.EA Trojaner (Säubern nicht möglich)        00000000000000000000000000000000        I
C:\Users\Florian Burkhardtt\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\33a70164-587fcf56        Java/Agent.DW Trojaner (Säubern nicht möglich)        00000000000000000000000000000000        I
C:\Users\Florian Burkhardtt\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\31b7aeea-2dd58865        Java/Exploit.CVE-2011-3544.T Trojaner (Säubern nicht möglich)        00000000000000000000000000000000        I
C:\Windows\assembly\tmp\U\00000001.@        Win64/Redirector.A Trojaner (Säubern nicht möglich)        00000000000000000000000000000000        I
C:\Windows\assembly\tmp\U\000000cb.@        Win32/Redirector.A Trojaner (Säubern nicht möglich)        00000000000000000000000000000000        I
C:\Windows\assembly\tmp\U\800000cf.@        Win64/Sirefef.U Trojaner (Säubern nicht möglich)        00000000000000000000000000000000        I
${Memory}        Variante von Win32/Sirefef.EF Trojaner        00000000000000000000000000000000        I
Bis demnächst. Florian

floribu 01.03.2012 15:22
Hallo Arne,

danke für die bisherigen Tipps. Habe nun alles abgespreichert unter externer Festplatte via PartedMagic und auch Combofix ausgeführt.

Die Logfiles sagen folgendes: (Wie geht es nun weiter?)
Combofix Logfile:
Code:
ComboFix 12-03-01.01 - Florian Burkhardtt 01.03.2012  14:55:52.1.2 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3037.1553 [GMT 1:00]
ausgeführt von:: c:\users\Florian Burkhardtt\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\boost_interprocess\20120301103636.375199
c:\programdata\boost_interprocess\20120301103636.375199\Nobu64AgentService
c:\programdata\boost_interprocess\20120301103636.375199\Nobu64TrayIcon
c:\users\Florian Burkhardtt\7225-INST-WIN7-A.EXE
c:\users\Florian Burkhardtt\AppData\Local\67b8bb43\U
c:\users\Florian Burkhardtt\AppData\Local\67b8bb43\U\80000000.@
c:\users\Florian Burkhardtt\AppData\Local\67b8bb43\U\800000cb.@
c:\users\Florian Burkhardtt\AppData\Local\67b8bb43\U\800000cf.@
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\assembly\tmp\U
c:\windows\assembly\tmp\U\00000001.@
c:\windows\assembly\tmp\U\000000c0.@
c:\windows\assembly\tmp\U\000000cb.@
c:\windows\assembly\tmp\U\000000cf.@
c:\windows\assembly\tmp\U\80000000.@
c:\windows\assembly\tmp\U\800000c0.@
c:\windows\assembly\tmp\U\800000cb.@
c:\windows\assembly\tmp\U\800000cf.@
c:\windows\system32\AdobeActiveFileMonitor6.0.dll
c:\windows\system32\dds_log_trash.cmd
D:\install.exe
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_svchost
-------\Service_acprfmgrsvc
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-02-01 bis 2012-03-01  ))))))))))))))))))))))))))))))
.
.
2012-03-01 14:01 . 2012-03-01 14:01        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-02-29 15:21 . 2012-02-29 15:21        --------        d-----w-        c:\program files (x86)\ESET
2012-02-29 12:29 . 2012-02-29 12:29        --------        d-----w-        c:\users\Florian Burkhardtt\AppData\Roaming\Malwarebytes
2012-02-29 12:29 . 2012-02-29 12:29        --------        d-----w-        c:\programdata\Malwarebytes
2012-02-29 12:29 . 2012-02-29 12:29        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-02-29 12:29 . 2011-12-10 14:24        23152        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-02-28 15:35 . 2012-02-28 15:35        --------        d-----w-        c:\users\Florian Burkhardtt\AppData\Roaming\Avira
2012-02-28 15:34 . 2012-01-31 07:56        97312        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-02-28 15:34 . 2012-01-31 07:56        132320        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-02-28 15:34 . 2011-09-16 15:08        27760        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2012-02-28 15:34 . 2012-02-28 15:34        --------        d-----w-        c:\programdata\Avira
2012-02-28 15:34 . 2012-02-28 15:34        --------        d-----w-        c:\program files (x86)\Avira
2012-02-28 14:11 . 2012-02-28 14:11        --------        d-sh--w-        c:\windows\system32\%APPDATA%
2012-02-28 14:06 . 2012-03-01 12:10        --------        d-sh--w-        c:\users\Florian Burkhardtt\AppData\Local\67b8bb43
2012-02-28 07:47 . 2012-02-08 07:13        8643640        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F2423EF2-7D54-4A35-800C-E5C09B98890E}\mpengine.dll
2012-02-19 10:10 . 2012-02-19 16:21        --------        d-----w-        c:\program files (x86)\BitTorrent
2012-02-19 10:09 . 2012-02-20 18:25        --------        d-----w-        c:\users\Florian Burkhardtt\AppData\Roaming\BitTorrent
2012-02-15 08:33 . 2012-01-04 10:44        509952        ----a-w-        c:\windows\system32\ntshrui.dll
2012-02-15 08:33 . 2012-01-04 08:58        442880        ----a-w-        c:\windows\SysWow64\ntshrui.dll
2012-02-15 08:33 . 2011-12-30 06:26        515584        ----a-w-        c:\windows\system32\timedate.cpl
2012-02-15 08:33 . 2011-12-30 05:27        478720        ----a-w-        c:\windows\SysWow64\timedate.cpl
2012-02-15 08:33 . 2012-01-14 04:06        3145728        ----a-w-        c:\windows\system32\win32k.sys
2012-02-15 08:33 . 2011-12-28 03:59        498688        ----a-w-        c:\windows\system32\drivers\afd.sys
2012-02-15 08:33 . 2011-12-16 08:46        634880        ----a-w-        c:\windows\system32\msvcrt.dll
2012-02-15 08:33 . 2011-12-16 07:52        690688        ----a-w-        c:\windows\SysWow64\msvcrt.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-28 11:51 . 2011-06-02 09:02        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-01-29 04:10 . 2011-01-31 08:58        279656        ------w-        c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-07 39408]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296]
"Hotkey Utility"="c:\program files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe" [2010-08-04 611872]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2011-10-12 3151000]
"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-01-31 258512]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
c:\users\Florian Burkhardtt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-02 135664]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 DATEV Update-Service;DATEV Update-Service;c:\datev\PROGRAMM\INSTALL\DvInesASDSvc.Exe [2011-02-21 155232]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-02 135664]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-10-09 169312]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-01-31 86224]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 Greg_Service;GRegService;c:\program files (x86)\Packard Bell\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 Updater Service;Updater Service;c:\program files\Packard Bell\Packard Bell Updater\UpdaterService.exe [2010-01-28 243232]
S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\DRIVERS\LVUSBS64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-02 09:17]
.
2012-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-02 09:17]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-17 9608224]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
"combofix"="c:\combofix\CF11948.3XE" [2010-11-20 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
NETSVCS BENÖTIGT REPARATUR - Derzeitig vorhandene Einträge:
AeLookupSvc
CertPropSvc
SCPolicySvc
lanmanserver
gpsvc
IKEEXT
AudioSrv
FastUserSwitchingCompatibility
Ias
Irmon
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
SENS
Sharedaccess
SRService
Tapisrv
Wmi
WmdmPmSp
slabbus
SE27mdfl
apache2
rpcapd
wlancfg
EIO_XP
MREMP50a64
wlluc48
SE26bus
se45mdm
s217obex
neokdss
HIDSwvd
SE2Eobex
amusbprt
Si3132
vrservice
W700bus
AKSIFDH
fasttraksvc
DLH5X
prevxagent
SPCtl
LMIRfsClientNP
mstdfrgs
HpqRemHid
ssfs0509
symc810
PGPsdkDriver
btwavdt
ctxcpubal
adihdaudaddservice
was
DcFpoint
EAWDMFD
se44bus
W700mdfl
InCDsrvR
surveyor
crystalaps
epsonbidirectionalagent
pnkbstrb
webrootspysweeperservice
Cam5607
W700obex
IBM_LLC2
ctaud2k
aic78xx
uhcd
netrcacm
emproxy
acprfmgrsvc
WaveEnrollmentService
iaimtv1
SE2Emdfl
SrvcTPIOMngr
MaxtorFrontPanel1
ATMsrvc
Xponaut_WBD
pid_0928
kwatchsvc
PCDRSRVC
patrol_scheduler
se45unic
meiudf
svchost
mps9
addfiltr
pcx1nd5
mwssched
TermService
wuauserv
BITS
ShellHWDetection
LogonHours
PCAudit
helpsvc
uploadmgr
iphlpsvc
seclogon
AppInfo
msiscsi
MMCSS
winmgmt
SessionEnv
browser
EapHost
schedule
hkmsvc
wercplsupport
ProfSvc
Themes
BDESVC
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=imedia_s1800&r=173612105206pe4c5v105y6794219s
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=imedia_s1800&r=173612105206pe4c5v105y6794219s
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Florian Burkhardtt\AppData\Roaming\Mozilla\Firefox\Profiles\0cyy998l.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-NortonOnlineBackupReminder - c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-03-01  15:09:52 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-03-01 14:09
.
Vor Suchlauf: 9 Verzeichnis(se), 91.438.542.848 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 95.325.188.096 Bytes frei
.
- - End Of File - - EEDF7C31CE1318D956A82FD653300D1C
--- --- ---

floribu 01.03.2012 15:27
Ach ja, und habe gerade gesehen, dass zumindest das ABNOW-Weiterleitungs-Problem jetzt schon mal beseitigt ist. Denke aber, der Computer ist immer noch in Gefahr, oder?

cosinus 01.03.2012 20:32
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

floribu 02.03.2012 09:05
Hallo Arne,

hier nun die OTL Logfiles:OTL Logfile:
Code:
OTL logfile created on: 02.03.2012 08:46:05 - Run 1
OTL by OldTimer - Version 3.2.34.0    Folder = C:\Users\Florian Burkhardtt\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 1,83 Gb Available Physical Memory | 61,85% Memory free
5,93 Gb Paging File | 4,46 Gb Available in Paging File | 75,19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 140,95 Gb Total Space | 88,57 Gb Free Space | 62,84% Space Free | Partition Type: NTFS
Drive D: | 141,04 Gb Total Space | 140,94 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
 
Computer Name: FLORIANBURKHARD | User Name: Florian Burkhardtt | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.02 08:42:55 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\Florian Burkhardtt\Desktop\OTL.exe
PRC - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.01.31 08:55:48 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.01.13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011.02.25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.02.23 22:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Program Files (x86)\FreePDF_XP\fpassist.exe
PRC - [2010.08.04 13:40:12 | 000,611,872 | ---- | M] () -- C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe
PRC - [2010.05.20 23:59:30 | 011,312,128 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010.05.20 23:59:28 | 011,318,784 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2010.02.28 02:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
PRC - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe
PRC - [2009.10.09 04:45:56 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) -- c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
PRC - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.06.24 21:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 21:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.08.04 13:40:12 | 000,611,872 | ---- | M] () -- C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe
MOD - [2010.08.04 10:47:32 | 000,144,896 | ---- | M] () -- C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyHook.dll
MOD - [2010.05.04 15:36:28 | 000,970,752 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2010.02.28 02:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (slabbus)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (SE27mdfl)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (pcx1nd5)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (mwssched)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (mps9)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (apache2)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (addfiltr)
SRV - [2012.02.15 13:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.10.12 17:06:48 | 004,700,824 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)
SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.02.28 18:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.02.25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2011.02.21 02:48:00 | 000,155,232 | ---- | M] (DATEV eG) [On_Demand | Stopped] -- C:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe -- (DATEV Update-Service)
SRV - [2010.10.22 13:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2010.09.16 19:23:58 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe -- (Updater Service)
SRV - [2010.01.15 22:08:38 | 000,935,208 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.10.10 03:59:08 | 000,238,328 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Packard Bell Games\Packard Bell Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009.10.09 04:45:56 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor8.0)
SRV - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.01.31 08:56:33 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.01.31 08:56:33 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.09.16 16:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.05.10 07:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.08.25 19:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008.07.26 15:26:34 | 000,050,072 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)
DRV:64bit: - [2008.07.26 15:22:34 | 002,624,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV:64bit: - [2008.06.16 02:00:00 | 000,055,024 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2007.11.15 17:00:00 | 000,321,064 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW_deDE408DE409
IE - HKU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-flv
IE - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.12.30 10:42:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.01.07 15:05:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.17 13:35:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.16 08:24:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.03.01 14:35:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.12.30 10:42:07 | 000,000,000 | ---D | M]
 
[2010.12.01 11:31:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Florian Burkhardtt\AppData\Roaming\mozilla\Extensions
[2010.12.01 11:31:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Florian Burkhardtt\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.01.18 09:05:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.03.01 18:21:33 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.02.17 13:35:03 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.02.03 08:39:33 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.03 08:39:33 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.02.03 08:39:33 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.03 08:39:33 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.03 08:39:33 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.03 08:39:33 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.03.01 15:01:58 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Hotkey Utility] C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - Startup: C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - %SystemRoot%\System32\nwprovau.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E90AA975-21BE-48C7-9ECA-7EEBDFFD5EC8}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs:64bit: slabbus - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: SE27mdfl - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: apache2 - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: svchost - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: mps9 - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: addfiltr - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: pcx1nd5 - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: mwssched - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
 
 
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {0F1D198F-E5EA-4542-930E-2FB2B099F3F3} - LanaConfigTool_3383
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: vidc.i420 - lvcod64.dll (Logitech Inc.)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\SysWow64\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.tscc - C:\Windows\SysWow64\tsccvid.dll (TechSmith Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.02 08:42:52 | 000,584,704 | ---- | C] (OldTimer Tools) -- C:\Users\Florian Burkhardtt\Desktop\OTL.exe
[2012.03.01 18:21:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.03.01 18:21:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.03.01 15:04:25 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012.03.01 14:54:29 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.03.01 14:54:29 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.03.01 14:54:29 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.03.01 14:54:24 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.03.01 14:54:21 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.03.01 14:53:42 | 004,423,209 | R--- | C] (Swearware) -- C:\Users\Florian Burkhardtt\Desktop\ComboFix.exe
[2012.02.29 16:21:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.02.29 14:12:48 | 000,000,000 | ---D | C] -- C:\Users\Florian Burkhardtt\Desktop\Logdateien
[2012.02.29 13:29:31 | 000,000,000 | ---D | C] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Malwarebytes
[2012.02.29 13:29:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.02.29 13:29:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.02.29 13:29:16 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.02.29 13:29:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.02.28 16:35:26 | 000,000,000 | ---D | C] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Avira
[2012.02.28 16:34:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.02.28 16:34:20 | 000,132,320 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.02.28 16:34:20 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.02.28 16:34:20 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.02.28 16:34:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.02.28 16:34:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2012.02.28 15:11:25 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2012.02.28 15:06:36 | 000,000,000 | -HSD | C] -- C:\Users\Florian Burkhardtt\AppData\Local\67b8bb43
[2012.02.19 11:10:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BitTorrent
[2012.02.19 11:09:34 | 000,000,000 | ---D | C] -- C:\Users\Florian Burkhardtt\AppData\Roaming\BitTorrent
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.02 08:42:55 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\Florian Burkhardtt\Desktop\OTL.exe
[2012.03.02 08:40:47 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.02 08:40:47 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.02 08:40:01 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.02 08:32:47 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.02 08:32:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.02 08:32:32 | 2388,582,400 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.01 18:21:17 | 000,002,515 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.03.01 15:01:58 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.03.01 14:51:58 | 004,423,209 | R--- | M] (Swearware) -- C:\Users\Florian Burkhardtt\Desktop\ComboFix.exe
[2012.03.01 14:47:56 | 000,000,000 | -HS- | M] () -- C:\Windows\muzuki.exc
[2012.02.29 16:19:08 | 001,500,294 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.02.29 16:19:08 | 000,654,602 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.02.29 16:19:08 | 000,616,484 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.02.29 16:19:08 | 000,130,216 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.02.29 16:19:08 | 000,106,606 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.02.29 13:29:20 | 000,001,121 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.28 16:34:45 | 000,002,078 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012.02.15 20:36:10 | 000,314,368 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.02.15 16:11:07 | 001,526,976 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
 
========== Files Created - No Company Name ==========
 
[2012.03.01 14:54:29 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.03.01 14:54:29 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.03.01 14:54:29 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.03.01 14:54:29 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.03.01 14:54:29 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.03.01 14:38:46 | 000,000,000 | -HS- | C] () -- C:\Windows\muzuki.exc
[2012.02.29 13:29:20 | 000,001,121 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.28 16:34:45 | 000,002,078 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2010.12.30 10:31:53 | 000,233,461 | ---- | C] () -- C:\Windows\hpoins47.dat
[2010.12.07 11:30:46 | 000,000,231 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2010.12.07 11:30:46 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini
[2010.12.07 11:29:04 | 000,000,009 | ---- | C] () -- C:\Windows\Brfaxrx.ini
[2010.12.03 14:54:19 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.12.03 14:54:19 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD7820N.DAT
[2010.12.01 17:35:10 | 000,000,021 | ---- | C] () -- C:\Windows\DvInesKurusOleServer003.INI
[2010.12.01 17:34:52 | 000,000,125 | ---- | C] () -- C:\Windows\dvinesinstart001.INI
[2010.12.01 17:34:52 | 000,000,125 | ---- | C] () -- C:\Windows\dvinesinstalllocation001.INI
[2010.12.01 17:34:46 | 000,000,126 | ---- | C] () -- C:\Windows\Startup.INI
[2010.12.01 15:04:28 | 001,526,976 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.12.01 11:31:40 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.12.01 11:29:45 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.12.01 11:27:04 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.12.01 10:48:28 | 000,106,496 | ---- | C] () -- C:\Windows\SysWow64\BrMuSNMP.dll
[2010.08.25 19:34:30 | 000,982,240 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2010.08.25 19:34:30 | 000,439,308 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2010.08.25 19:34:30 | 000,092,356 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2010.05.07 12:58:32 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll
[2010.05.07 12:58:32 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll
[2010.04.01 00:39:01 | 000,000,574 | ---- | C] () -- C:\Windows\hpomdl47.dat
 
========== LOP Check ==========
 
[2012.02.20 19:25:15 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\BitTorrent
[2012.01.16 13:13:58 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\FreePDF
[2010.12.01 10:12:51 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\OEM
[2011.01.19 11:33:32 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\OpenOffice.org
[2011.09.22 11:16:19 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Opera
[2012.03.02 08:37:03 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\SoftGrid Client
[2010.12.01 11:31:40 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Thunderbird
[2010.12.01 15:05:33 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\TP
[2011.05.09 14:04:35 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\WildTangent
[2011.12.07 20:10:48 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.04.28 10:09:28 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Adobe
[2011.10.29 13:03:37 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Apple Computer
[2012.02.28 16:35:26 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Avira
[2012.02.20 19:25:15 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\BitTorrent
[2010.12.04 17:22:25 | 000,000,000 | R--D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Brother
[2012.01.16 13:13:58 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\FreePDF
[2010.12.01 10:13:35 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Google
[2010.12.30 10:55:15 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\HP
[2011.12.31 20:10:51 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\HpUpdate
[2010.12.01 10:12:26 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Identities
[2010.12.01 10:12:50 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Macromedia
[2012.02.29 13:29:31 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Malwarebytes
[2009.07.14 08:44:38 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Media Center Programs
[2012.01.20 16:00:15 | 000,000,000 | --SD | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft
[2010.12.01 11:26:52 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft Web Folders
[2011.05.13 15:41:02 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Mozilla
[2011.05.24 16:23:02 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Nero
[2010.12.01 10:12:51 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\OEM
[2011.01.19 11:33:32 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\OpenOffice.org
[2011.09.22 11:16:19 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Opera
[2012.03.02 08:45:51 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Skype
[2011.06.21 08:08:40 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\skypePM
[2012.03.02 08:37:03 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\SoftGrid Client
[2010.12.01 11:31:40 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Thunderbird
[2010.12.01 15:05:33 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\TP
[2011.05.09 14:04:35 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\WildTangent
[2010.12.21 16:56:38 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\WinRAR
[2011.01.04 14:19:38 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Yahoo!
 
< %APPDATA%\*.exe /s >
[2011.02.04 14:59:05 | 000,010,134 | R--- | M] () -- C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft\Installer\{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\ERDNT\cache64\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.20621_none_39f398b8542b6259\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\ERDNT\cache86\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\ERDNT\cache64\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\ERDNT\cache64\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\ERDNT\cache86\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\ERDNT\cache86\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\ERDNT\cache64\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\ERDNT\cache86\user32.dll
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\ERDNT\cache64\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\ERDNT\cache86\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\ERDNT\cache64\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\ERDNT\cache64\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\ERDNT\cache86\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\ERDNT\cache64\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
--- --- ---

floribu 02.03.2012 09:09
Hallo Arne,

hier nun die OTL Logfiles:OTL Logfile:
Code:
OTL logfile created on: 02.03.2012 08:46:05 - Run 1
OTL by OldTimer - Version 3.2.34.0    Folder = C:\Users\Florian Burkhardtt\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 1,83 Gb Available Physical Memory | 61,85% Memory free
5,93 Gb Paging File | 4,46 Gb Available in Paging File | 75,19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 140,95 Gb Total Space | 88,57 Gb Free Space | 62,84% Space Free | Partition Type: NTFS
Drive D: | 141,04 Gb Total Space | 140,94 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
 
Computer Name: FLORIANBURKHARD | User Name: Florian Burkhardtt | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.02 08:42:55 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\Florian Burkhardtt\Desktop\OTL.exe
PRC - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.01.31 08:55:48 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.01.13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011.02.25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.02.23 22:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Program Files (x86)\FreePDF_XP\fpassist.exe
PRC - [2010.08.04 13:40:12 | 000,611,872 | ---- | M] () -- C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe
PRC - [2010.05.20 23:59:30 | 011,312,128 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010.05.20 23:59:28 | 011,318,784 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2010.02.28 02:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
PRC - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe
PRC - [2009.10.09 04:45:56 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) -- c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
PRC - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.06.24 21:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 21:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.08.04 13:40:12 | 000,611,872 | ---- | M] () -- C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe
MOD - [2010.08.04 10:47:32 | 000,144,896 | ---- | M] () -- C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyHook.dll
MOD - [2010.05.04 15:36:28 | 000,970,752 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2010.02.28 02:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (slabbus)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (SE27mdfl)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (pcx1nd5)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (mwssched)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (mps9)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (apache2)
SRV:64bit: - [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\svchost.exe -- (addfiltr)
SRV - [2012.02.15 13:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.10.12 17:06:48 | 004,700,824 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)
SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.02.28 18:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.02.25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2011.02.21 02:48:00 | 000,155,232 | ---- | M] (DATEV eG) [On_Demand | Stopped] -- C:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe -- (DATEV Update-Service)
SRV - [2010.10.22 13:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2010.09.16 19:23:58 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe -- (Updater Service)
SRV - [2010.01.15 22:08:38 | 000,935,208 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.10.10 03:59:08 | 000,238,328 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Packard Bell Games\Packard Bell Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009.10.09 04:45:56 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor8.0)
SRV - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.01.31 08:56:33 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.01.31 08:56:33 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.09.16 16:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.05.10 07:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.08.25 19:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008.07.26 15:26:34 | 000,050,072 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)
DRV:64bit: - [2008.07.26 15:22:34 | 002,624,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV:64bit: - [2008.06.16 02:00:00 | 000,055,024 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2007.11.15 17:00:00 | 000,321,064 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW_deDE408DE409
IE - HKU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-flv
IE - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.12.30 10:42:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.01.07 15:05:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.17 13:35:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.16 08:24:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.03.01 14:35:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.12.30 10:42:07 | 000,000,000 | ---D | M]
 
[2010.12.01 11:31:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Florian Burkhardtt\AppData\Roaming\mozilla\Extensions
[2010.12.01 11:31:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Florian Burkhardtt\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.01.18 09:05:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.03.01 18:21:33 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.02.17 13:35:03 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.02.03 08:39:33 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.03 08:39:33 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.02.03 08:39:33 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.03 08:39:33 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.03 08:39:33 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.03 08:39:33 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.03.01 15:01:58 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Hotkey Utility] C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - Startup: C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - %SystemRoot%\System32\nwprovau.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E90AA975-21BE-48C7-9ECA-7EEBDFFD5EC8}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs:64bit: slabbus - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: SE27mdfl - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: apache2 - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: svchost - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: mps9 - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: addfiltr - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: pcx1nd5 - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
NetSvcs:64bit: mwssched - C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
 
 
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {0F1D198F-E5EA-4542-930E-2FB2B099F3F3} - LanaConfigTool_3383
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: vidc.i420 - lvcod64.dll (Logitech Inc.)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\SysWow64\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.tscc - C:\Windows\SysWow64\tsccvid.dll (TechSmith Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.02 08:42:52 | 000,584,704 | ---- | C] (OldTimer Tools) -- C:\Users\Florian Burkhardtt\Desktop\OTL.exe
[2012.03.01 18:21:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.03.01 18:21:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.03.01 15:04:25 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012.03.01 14:54:29 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.03.01 14:54:29 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.03.01 14:54:29 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.03.01 14:54:24 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.03.01 14:54:21 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.03.01 14:53:42 | 004,423,209 | R--- | C] (Swearware) -- C:\Users\Florian Burkhardtt\Desktop\ComboFix.exe
[2012.02.29 16:21:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.02.29 14:12:48 | 000,000,000 | ---D | C] -- C:\Users\Florian Burkhardtt\Desktop\Logdateien
[2012.02.29 13:29:31 | 000,000,000 | ---D | C] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Malwarebytes
[2012.02.29 13:29:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.02.29 13:29:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.02.29 13:29:16 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.02.29 13:29:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.02.28 16:35:26 | 000,000,000 | ---D | C] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Avira
[2012.02.28 16:34:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.02.28 16:34:20 | 000,132,320 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.02.28 16:34:20 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.02.28 16:34:20 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.02.28 16:34:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.02.28 16:34:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2012.02.28 15:11:25 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2012.02.28 15:06:36 | 000,000,000 | -HSD | C] -- C:\Users\Florian Burkhardtt\AppData\Local\67b8bb43
[2012.02.19 11:10:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BitTorrent
[2012.02.19 11:09:34 | 000,000,000 | ---D | C] -- C:\Users\Florian Burkhardtt\AppData\Roaming\BitTorrent
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.02 08:42:55 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\Florian Burkhardtt\Desktop\OTL.exe
[2012.03.02 08:40:47 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.02 08:40:47 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.02 08:40:01 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.02 08:32:47 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.02 08:32:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.02 08:32:32 | 2388,582,400 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.01 18:21:17 | 000,002,515 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.03.01 15:01:58 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.03.01 14:51:58 | 004,423,209 | R--- | M] (Swearware) -- C:\Users\Florian Burkhardtt\Desktop\ComboFix.exe
[2012.03.01 14:47:56 | 000,000,000 | -HS- | M] () -- C:\Windows\muzuki.exc
[2012.02.29 16:19:08 | 001,500,294 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.02.29 16:19:08 | 000,654,602 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.02.29 16:19:08 | 000,616,484 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.02.29 16:19:08 | 000,130,216 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.02.29 16:19:08 | 000,106,606 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.02.29 13:29:20 | 000,001,121 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.28 16:34:45 | 000,002,078 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012.02.15 20:36:10 | 000,314,368 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.02.15 16:11:07 | 001,526,976 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
 
========== Files Created - No Company Name ==========
 
[2012.03.01 14:54:29 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.03.01 14:54:29 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.03.01 14:54:29 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.03.01 14:54:29 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.03.01 14:54:29 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.03.01 14:38:46 | 000,000,000 | -HS- | C] () -- C:\Windows\muzuki.exc
[2012.02.29 13:29:20 | 000,001,121 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.28 16:34:45 | 000,002,078 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2010.12.30 10:31:53 | 000,233,461 | ---- | C] () -- C:\Windows\hpoins47.dat
[2010.12.07 11:30:46 | 000,000,231 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2010.12.07 11:30:46 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini
[2010.12.07 11:29:04 | 000,000,009 | ---- | C] () -- C:\Windows\Brfaxrx.ini
[2010.12.03 14:54:19 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.12.03 14:54:19 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD7820N.DAT
[2010.12.01 17:35:10 | 000,000,021 | ---- | C] () -- C:\Windows\DvInesKurusOleServer003.INI
[2010.12.01 17:34:52 | 000,000,125 | ---- | C] () -- C:\Windows\dvinesinstart001.INI
[2010.12.01 17:34:52 | 000,000,125 | ---- | C] () -- C:\Windows\dvinesinstalllocation001.INI
[2010.12.01 17:34:46 | 000,000,126 | ---- | C] () -- C:\Windows\Startup.INI
[2010.12.01 15:04:28 | 001,526,976 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.12.01 11:31:40 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.12.01 11:29:45 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.12.01 11:27:04 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.12.01 10:48:28 | 000,106,496 | ---- | C] () -- C:\Windows\SysWow64\BrMuSNMP.dll
[2010.08.25 19:34:30 | 000,982,240 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2010.08.25 19:34:30 | 000,439,308 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2010.08.25 19:34:30 | 000,092,356 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2010.05.07 12:58:32 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll
[2010.05.07 12:58:32 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll
[2010.04.01 00:39:01 | 000,000,574 | ---- | C] () -- C:\Windows\hpomdl47.dat
 
========== LOP Check ==========
 
[2012.02.20 19:25:15 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\BitTorrent
[2012.01.16 13:13:58 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\FreePDF
[2010.12.01 10:12:51 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\OEM
[2011.01.19 11:33:32 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\OpenOffice.org
[2011.09.22 11:16:19 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Opera
[2012.03.02 08:37:03 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\SoftGrid Client
[2010.12.01 11:31:40 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Thunderbird
[2010.12.01 15:05:33 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\TP
[2011.05.09 14:04:35 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\WildTangent
[2011.12.07 20:10:48 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.04.28 10:09:28 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Adobe
[2011.10.29 13:03:37 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Apple Computer
[2012.02.28 16:35:26 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Avira
[2012.02.20 19:25:15 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\BitTorrent
[2010.12.04 17:22:25 | 000,000,000 | R--D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Brother
[2012.01.16 13:13:58 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\FreePDF
[2010.12.01 10:13:35 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Google
[2010.12.30 10:55:15 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\HP
[2011.12.31 20:10:51 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\HpUpdate
[2010.12.01 10:12:26 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Identities
[2010.12.01 10:12:50 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Macromedia
[2012.02.29 13:29:31 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Malwarebytes
[2009.07.14 08:44:38 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Media Center Programs
[2012.01.20 16:00:15 | 000,000,000 | --SD | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft
[2010.12.01 11:26:52 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft Web Folders
[2011.05.13 15:41:02 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Mozilla
[2011.05.24 16:23:02 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Nero
[2010.12.01 10:12:51 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\OEM
[2011.01.19 11:33:32 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\OpenOffice.org
[2011.09.22 11:16:19 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Opera
[2012.03.02 08:45:51 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Skype
[2011.06.21 08:08:40 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\skypePM
[2012.03.02 08:37:03 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\SoftGrid Client
[2010.12.01 11:31:40 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Thunderbird
[2010.12.01 15:05:33 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\TP
[2011.05.09 14:04:35 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\WildTangent
[2010.12.21 16:56:38 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\WinRAR
[2011.01.04 14:19:38 | 000,000,000 | ---D | M] -- C:\Users\Florian Burkhardtt\AppData\Roaming\Yahoo!
 
< %APPDATA%\*.exe /s >
[2011.02.04 14:59:05 | 000,010,134 | R--- | M] () -- C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft\Installer\{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\ERDNT\cache64\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.20621_none_39f398b8542b6259\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\ERDNT\cache86\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\ERDNT\cache64\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\ERDNT\cache64\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\ERDNT\cache86\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\ERDNT\cache86\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\ERDNT\cache64\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\ERDNT\cache86\user32.dll
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\ERDNT\cache64\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\ERDNT\cache86\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\ERDNT\cache64\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\ERDNT\cache64\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\ERDNT\cache86\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\ERDNT\cache64\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
--- --- ---

cosinus 02.03.2012 13:56
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW_deDE408DE409
IE - HKU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://de.search.yahoo.com/search?p={searchTerms}&fr=chr-flv
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3691275058-1885143113-103313090-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html File not found
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

floribu 02.03.2012 14:30
Hallo Arne,

Mensch, danke für die tolle Hilfe. Ich sollte euch Jungs glaube ich mal was spenden. Habe den OTL-Fix wie beschrieben ausgeführt und hier kommt der Log:

Code:
All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
HKU\S-1-5-21-3691275058-1885143113-103313090-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-3691275058-1885143113-103313090-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.
C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll moved successfully.
Unable to set value : HKEY_USERS\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E!
Registry key HKEY_USERS\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ not found.
Registry key HKEY_USERS\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_USERS\Software\Microsoft\Internet Explorer\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
File C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ deleted successfully.
C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.
C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}\ deleted successfully.
C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll moved successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\ deleted successfully.
File C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}\ deleted successfully.
File C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
File C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
64bit-Registry value HKEY_USERS\S-1-5-21-3691275058-1885143113-103313090-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
File C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-3691275058-1885143113-103313090-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3691275058-1885143113-103313090-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Florian Burkhardtt
->Temp folder emptied: 25654473 bytes
->Temporary Internet Files folder emptied: 1187250402 bytes
->Java cache emptied: 714790 bytes
->FireFox cache emptied: 60381974 bytes
->Apple Safari cache emptied: 2150400 bytes
->Opera cache emptied: 14474888 bytes
->Flash cache emptied: 558 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 30567 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 55393064 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1.284,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.34.0 log created on 03022012_142043

Files\Folders moved on Reboot...
C:\Users\Florian Burkhardtt\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

cosinus 02.03.2012 15:03
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

floribu 02.03.2012 15:15
Hallo Arne,

danke wieder für die schnelle Hilfe. Hier der Log vom TDSS-Killer:

Code:
15:09:15.0321 2664        TDSS rootkit removing tool 2.7.18.0 Mar  2 2012 09:40:07
15:09:15.0624 2664        ============================================================
15:09:15.0624 2664        Current date / time: 2012/03/02 15:09:15.0624
15:09:15.0624 2664        SystemInfo:
15:09:15.0624 2664       
15:09:15.0624 2664        OS Version: 6.1.7601 ServicePack: 1.0
15:09:15.0624 2664        Product type: Workstation
15:09:15.0624 2664        ComputerName: FLORIANBURKHARD
15:09:15.0624 2664        UserName: Florian Burkhardtt
15:09:15.0624 2664        Windows directory: C:\Windows
15:09:15.0624 2664        System windows directory: C:\Windows
15:09:15.0624 2664        Running under WOW64
15:09:15.0624 2664        Processor architecture: Intel x64
15:09:15.0624 2664        Number of processors: 2
15:09:15.0624 2664        Page size: 0x1000
15:09:15.0624 2664        Boot type: Normal boot
15:09:15.0624 2664        ============================================================
15:09:16.0575 2664        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
15:09:16.0589 2664        \Device\Harddisk0\DR0:
15:09:16.0589 2664        MBR used
15:09:16.0589 2664        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x2000800, BlocksNum 0x32000
15:09:16.0589 2664        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2032800, BlocksNum 0x119E7000
15:09:16.0589 2664        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x13A19800, BlocksNum 0x11A14800
15:09:16.0648 2664        Initialize success
15:09:16.0648 2664        ============================================================
15:12:02.0741 1704        ============================================================
15:12:02.0741 1704        Scan started
15:12:02.0741 1704        Mode: Manual; SigCheck; TDLFS;
15:12:02.0741 1704        ============================================================
15:12:03.0146 1704        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
15:12:03.0224 1704        1394ohci - ok
15:12:03.0271 1704        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
15:12:03.0287 1704        ACPI - ok
15:12:03.0380 1704        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
15:12:03.0427 1704        AcpiPmi - ok
15:12:03.0552 1704        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
15:12:03.0583 1704        adp94xx - ok
15:12:03.0692 1704        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
15:12:03.0724 1704        adpahci - ok
15:12:03.0770 1704        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
15:12:03.0786 1704        adpu320 - ok
15:12:03.0864 1704        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
15:12:03.0942 1704        AFD - ok
15:12:04.0036 1704        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
15:12:04.0051 1704        agp440 - ok
15:12:04.0129 1704        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
15:12:04.0145 1704        aliide - ok
15:12:04.0207 1704        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
15:12:04.0223 1704        amdide - ok
15:12:04.0316 1704        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
15:12:04.0363 1704        AmdK8 - ok
15:12:04.0410 1704        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
15:12:04.0472 1704        AmdPPM - ok
15:12:04.0535 1704        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
15:12:04.0566 1704        amdsata - ok
15:12:04.0628 1704        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
15:12:04.0644 1704        amdsbs - ok
15:12:04.0722 1704        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
15:12:04.0738 1704        amdxata - ok
15:12:04.0878 1704        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
15:12:04.0956 1704        AppID - ok
15:12:05.0081 1704        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
15:12:05.0096 1704        arc - ok
15:12:05.0096 1704        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
15:12:05.0112 1704        arcsas - ok
15:12:05.0128 1704        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
15:12:05.0190 1704        AsyncMac - ok
15:12:05.0284 1704        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
15:12:05.0299 1704        atapi - ok
15:12:05.0377 1704        avgntflt        (aa8f79a1bdfc03b3bc70c44ab00589b4) C:\Windows\system32\DRIVERS\avgntflt.sys
15:12:05.0408 1704        avgntflt - ok
15:12:05.0471 1704        avipbb          (852e3c0a60d368c487949e55ad52a47f) C:\Windows\system32\DRIVERS\avipbb.sys
15:12:05.0486 1704        avipbb - ok
15:12:05.0564 1704        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys
15:12:05.0580 1704        avkmgr - ok
15:12:05.0689 1704        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
15:12:05.0752 1704        b06bdrv - ok
15:12:05.0845 1704        b57nd60a        (a375aa8f1549ba51cfbcbd9a4ae0c2d3) C:\Windows\system32\DRIVERS\b57nd60a.sys
15:12:05.0876 1704        b57nd60a - ok
15:12:05.0970 1704        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
15:12:06.0064 1704        Beep - ok
15:12:06.0110 1704        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
15:12:06.0126 1704        blbdrive - ok
15:12:06.0282 1704        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
15:12:06.0329 1704        bowser - ok
15:12:06.0360 1704        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
15:12:06.0391 1704        BrFiltLo - ok
15:12:06.0454 1704        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
15:12:06.0485 1704        BrFiltUp - ok
15:12:06.0532 1704        BridgeMP        (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys
15:12:06.0610 1704        BridgeMP - ok
15:12:06.0688 1704        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
15:12:06.0734 1704        Brserid - ok
15:12:06.0750 1704        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
15:12:06.0781 1704        BrSerWdm - ok
15:12:06.0844 1704        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
15:12:06.0875 1704        BrUsbMdm - ok
15:12:06.0890 1704        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
15:12:06.0922 1704        BrUsbSer - ok
15:12:06.0922 1704        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
15:12:06.0984 1704        BTHMODEM - ok
15:12:07.0046 1704        catchme - ok
15:12:07.0140 1704        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
15:12:07.0187 1704        cdfs - ok
15:12:07.0249 1704        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
15:12:07.0296 1704        cdrom - ok
15:12:07.0390 1704        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
15:12:07.0436 1704        circlass - ok
15:12:07.0483 1704        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
15:12:07.0514 1704        CLFS - ok
15:12:07.0624 1704        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
15:12:07.0655 1704        CmBatt - ok
15:12:07.0686 1704        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
15:12:07.0686 1704        cmdide - ok
15:12:07.0733 1704        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
15:12:07.0764 1704        CNG - ok
15:12:07.0826 1704        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
15:12:07.0858 1704        Compbatt - ok
15:12:07.0889 1704        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
15:12:07.0936 1704        CompositeBus - ok
15:12:08.0014 1704        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
15:12:08.0029 1704        crcdisk - ok
15:12:08.0216 1704        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
15:12:08.0279 1704        DfsC - ok
15:12:08.0294 1704        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
15:12:08.0326 1704        discache - ok
15:12:08.0435 1704        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
15:12:08.0450 1704        Disk - ok
15:12:08.0591 1704        Dot4            (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys
15:12:08.0638 1704        Dot4 - ok
15:12:08.0747 1704        Dot4Print      (e9f5969233c5d89f3c35e3a66a52a361) C:\Windows\system32\drivers\Dot4Prt.sys
15:12:08.0794 1704        Dot4Print - ok
15:12:08.0840 1704        dot4usb        (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys
15:12:08.0872 1704        dot4usb - ok
15:12:08.0965 1704        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
15:12:08.0996 1704        drmkaud - ok
15:12:09.0059 1704        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
15:12:09.0106 1704        DXGKrnl - ok
15:12:09.0277 1704        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
15:12:09.0324 1704        ebdrv - ok
15:12:09.0449 1704        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
15:12:09.0480 1704        elxstor - ok
15:12:09.0511 1704        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
15:12:09.0558 1704        ErrDev - ok
15:12:09.0636 1704        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
15:12:09.0698 1704        exfat - ok
15:12:09.0714 1704        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
15:12:09.0761 1704        fastfat - ok
15:12:09.0854 1704        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
15:12:09.0886 1704        fdc - ok
15:12:09.0917 1704        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
15:12:09.0932 1704        FileInfo - ok
15:12:09.0948 1704        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
15:12:09.0979 1704        Filetrace - ok
15:12:10.0057 1704        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
15:12:10.0088 1704        flpydisk - ok
15:12:10.0135 1704        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
15:12:10.0166 1704        FltMgr - ok
15:12:10.0260 1704        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
15:12:10.0276 1704        FsDepends - ok
15:12:10.0291 1704        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
15:12:10.0307 1704        Fs_Rec - ok
15:12:10.0354 1704        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
15:12:10.0369 1704        fvevol - ok
15:12:10.0478 1704        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
15:12:10.0494 1704        gagp30kx - ok
15:12:10.0619 1704        GEARAspiWDM    (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
15:12:10.0634 1704        GEARAspiWDM - ok
15:12:10.0775 1704        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
15:12:10.0806 1704        hcw85cir - ok
15:12:10.0868 1704        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
15:12:10.0900 1704        HdAudAddService - ok
15:12:10.0993 1704        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
15:12:11.0024 1704        HDAudBus - ok
15:12:11.0071 1704        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
15:12:11.0102 1704        HidBatt - ok
15:12:11.0165 1704        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
15:12:11.0212 1704        HidBth - ok
15:12:11.0227 1704        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
15:12:11.0258 1704        HidIr - ok
15:12:11.0399 1704        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys
15:12:11.0414 1704        HidUsb - ok
15:12:11.0570 1704        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
15:12:11.0586 1704        HpSAMD - ok
15:12:11.0633 1704        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
15:12:11.0711 1704        HTTP - ok
15:12:11.0804 1704        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
15:12:11.0820 1704        hwpolicy - ok
15:12:11.0867 1704        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
15:12:11.0882 1704        i8042prt - ok
15:12:12.0007 1704        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
15:12:12.0038 1704        iaStorV - ok
15:12:12.0319 1704        igfx            (677aa5991026a65ada128c4b59cf2bad) C:\Windows\system32\DRIVERS\igdkmd64.sys
15:12:12.0553 1704        igfx - ok
15:12:12.0647 1704        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
15:12:12.0678 1704        iirsp - ok
15:12:12.0834 1704        IntcAzAudAddService (52d9171838bb92319f23656f502916e9) C:\Windows\system32\drivers\RTKVHD64.sys
15:12:12.0881 1704        IntcAzAudAddService - ok
15:12:12.0912 1704        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
15:12:12.0928 1704        intelide - ok
15:12:13.0021 1704        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
15:12:13.0052 1704        intelppm - ok
15:12:13.0099 1704        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
15:12:13.0146 1704        IpFilterDriver - ok
15:12:13.0240 1704        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
15:12:13.0271 1704        IPMIDRV - ok
15:12:13.0318 1704        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
15:12:13.0396 1704        IPNAT - ok
15:12:13.0474 1704        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
15:12:13.0536 1704        IRENUM - ok
15:12:13.0567 1704        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
15:12:13.0583 1704        isapnp - ok
15:12:13.0676 1704        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
15:12:13.0692 1704        iScsiPrt - ok
15:12:13.0739 1704        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
15:12:13.0754 1704        kbdclass - ok
15:12:13.0832 1704        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
15:12:13.0864 1704        kbdhid - ok
15:12:13.0910 1704        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
15:12:13.0910 1704        KSecDD - ok
15:12:13.0973 1704        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
15:12:14.0004 1704        KSecPkg - ok
15:12:14.0066 1704        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
15:12:14.0113 1704        ksthunk - ok
15:12:14.0222 1704        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
15:12:14.0285 1704        lltdio - ok
15:12:14.0378 1704        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
15:12:14.0394 1704        LSI_FC - ok
15:12:14.0410 1704        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
15:12:14.0425 1704        LSI_SAS - ok
15:12:14.0425 1704        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
15:12:14.0441 1704        LSI_SAS2 - ok
15:12:14.0441 1704        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
15:12:14.0456 1704        LSI_SCSI - ok
15:12:14.0472 1704        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
15:12:14.0519 1704        luafv - ok
15:12:14.0612 1704        LVUSBS64        (5c3ff68267a5d242ee79ee01b993d6ce) C:\Windows\system32\DRIVERS\LVUSBS64.sys
15:12:14.0628 1704        LVUSBS64 - ok
15:12:14.0690 1704        MBAMProtector  (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys
15:12:14.0690 1704        MBAMProtector - ok
15:12:14.0800 1704        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
15:12:14.0815 1704        megasas - ok
15:12:14.0831 1704        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
15:12:14.0831 1704        MegaSR - ok
15:12:14.0846 1704        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
15:12:14.0893 1704        Modem - ok
15:12:14.0987 1704        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
15:12:15.0018 1704        monitor - ok
15:12:15.0065 1704        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
15:12:15.0080 1704        mouclass - ok
15:12:15.0174 1704        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
15:12:15.0190 1704        mouhid - ok
15:12:15.0236 1704        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
15:12:15.0236 1704        mountmgr - ok
15:12:15.0330 1704        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
15:12:15.0346 1704        mpio - ok
15:12:15.0392 1704        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
15:12:15.0439 1704        mpsdrv - ok
15:12:15.0548 1704        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
15:12:15.0626 1704        MRxDAV - ok
15:12:15.0673 1704        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
15:12:15.0704 1704        mrxsmb - ok
15:12:15.0798 1704        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
15:12:15.0829 1704        mrxsmb10 - ok
15:12:15.0876 1704        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
15:12:15.0892 1704        mrxsmb20 - ok
15:12:15.0985 1704        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
15:12:16.0001 1704        msahci - ok
15:12:16.0032 1704        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
15:12:16.0063 1704        msdsm - ok
15:12:16.0141 1704        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
15:12:16.0188 1704        Msfs - ok
15:12:16.0235 1704        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
15:12:16.0266 1704        mshidkmdf - ok
15:12:16.0344 1704        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
15:12:16.0360 1704        msisadrv - ok
15:12:16.0438 1704        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
15:12:16.0484 1704        MSKSSRV - ok
15:12:16.0562 1704        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
15:12:16.0640 1704        MSPCLOCK - ok
15:12:16.0687 1704        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
15:12:16.0765 1704        MSPQM - ok
15:12:16.0843 1704        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
15:12:16.0874 1704        MsRPC - ok
15:12:16.0921 1704        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
15:12:16.0937 1704        mssmbios - ok
15:12:16.0999 1704        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
15:12:17.0046 1704        MSTEE - ok
15:12:17.0077 1704        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
15:12:17.0140 1704        MTConfig - ok
15:12:17.0218 1704        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
15:12:17.0233 1704        Mup - ok
15:12:17.0311 1704        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
15:12:17.0358 1704        NativeWifiP - ok
15:12:17.0467 1704        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
15:12:17.0498 1704        NDIS - ok
15:12:17.0592 1704        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
15:12:17.0670 1704        NdisCap - ok
15:12:17.0701 1704        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
15:12:17.0748 1704        NdisTapi - ok
15:12:17.0826 1704        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
15:12:17.0904 1704        Ndisuio - ok
15:12:17.0935 1704        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
15:12:17.0982 1704        NdisWan - ok
15:12:18.0060 1704        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
15:12:18.0138 1704        NDProxy - ok
15:12:18.0247 1704        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
15:12:18.0310 1704        NetBIOS - ok
15:12:18.0341 1704        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
15:12:18.0372 1704        NetBT - ok
15:12:18.0497 1704        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
15:12:18.0512 1704        nfrd960 - ok
15:12:18.0575 1704        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
15:12:18.0622 1704        Npfs - ok
15:12:18.0700 1704        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
15:12:18.0762 1704        nsiproxy - ok
15:12:18.0840 1704        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
15:12:18.0871 1704        Ntfs - ok
15:12:18.0949 1704        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
15:12:18.0996 1704        Null - ok
15:12:19.0043 1704        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
15:12:19.0043 1704        nvraid - ok
15:12:19.0121 1704        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
15:12:19.0152 1704        nvstor - ok
15:12:19.0168 1704        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
15:12:19.0168 1704        nv_agp - ok
15:12:19.0199 1704        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
15:12:19.0230 1704        ohci1394 - ok
15:12:19.0324 1704        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
15:12:19.0339 1704        Parport - ok
15:12:19.0386 1704        partmgr        (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
15:12:19.0402 1704        partmgr - ok
15:12:19.0526 1704        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
15:12:19.0542 1704        pci - ok
15:12:19.0558 1704        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
15:12:19.0573 1704        pciide - ok
15:12:19.0604 1704        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
15:12:19.0620 1704        pcmcia - ok
15:12:19.0682 1704        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
15:12:19.0698 1704        pcw - ok
15:12:19.0823 1704        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
15:12:19.0885 1704        PEAUTH - ok
15:12:20.0057 1704        PID_PEPI        (087a343dfc337f37723dd7912de6b6cd) C:\Windows\system32\DRIVERS\LV302V64.SYS
15:12:20.0119 1704        PID_PEPI - ok
15:12:20.0260 1704        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
15:12:20.0338 1704        PptpMiniport - ok
15:12:20.0384 1704        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
15:12:20.0400 1704        Processor - ok
15:12:20.0509 1704        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
15:12:20.0587 1704        Psched - ok
15:12:20.0634 1704        PxHlpa64        (fbf4db6d53585437e41a113300002a2b) C:\Windows\system32\Drivers\PxHlpa64.sys
15:12:20.0634 1704        PxHlpa64 - ok
15:12:20.0743 1704        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
15:12:20.0774 1704        ql2300 - ok
15:12:20.0790 1704        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
15:12:20.0806 1704        ql40xx - ok
15:12:20.0821 1704        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
15:12:20.0837 1704        QWAVEdrv - ok
15:12:20.0852 1704        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
15:12:20.0884 1704        RasAcd - ok
15:12:20.0977 1704        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
15:12:21.0024 1704        RasAgileVpn - ok
15:12:21.0071 1704        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
15:12:21.0133 1704        Rasl2tp - ok
15:12:21.0227 1704        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
15:12:21.0289 1704        RasPppoe - ok
15:12:21.0305 1704        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
15:12:21.0336 1704        RasSstp - ok
15:12:21.0445 1704        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
15:12:21.0492 1704        rdbss - ok
15:12:21.0523 1704        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
15:12:21.0539 1704        rdpbus - ok
15:12:21.0601 1704        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
15:12:21.0664 1704        RDPCDD - ok
15:12:21.0695 1704        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
15:12:21.0726 1704        RDPENCDD - ok
15:12:21.0804 1704        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
15:12:21.0851 1704        RDPREFMP - ok
15:12:21.0882 1704        RDPWD          (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
15:12:21.0913 1704        RDPWD - ok
15:12:22.0007 1704        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
15:12:22.0038 1704        rdyboost - ok
15:12:22.0100 1704        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
15:12:22.0163 1704        rspndr - ok
15:12:22.0256 1704        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
15:12:22.0288 1704        sbp2port - ok
15:12:22.0319 1704        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
15:12:22.0381 1704        scfilter - ok
15:12:22.0522 1704        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
15:12:22.0600 1704        secdrv - ok
15:12:22.0631 1704        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
15:12:22.0646 1704        Serenum - ok
15:12:22.0646 1704        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
15:12:22.0662 1704        Serial - ok
15:12:22.0693 1704        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
15:12:22.0709 1704        sermouse - ok
15:12:22.0802 1704        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
15:12:22.0834 1704        sffdisk - ok
15:12:22.0849 1704        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
15:12:22.0865 1704        sffp_mmc - ok
15:12:22.0880 1704        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
15:12:22.0896 1704        sffp_sd - ok
15:12:22.0974 1704        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
15:12:23.0005 1704        sfloppy - ok
15:12:23.0052 1704        Sftfs          (c6cc9297bd53e5229653303e556aa539) C:\Windows\system32\DRIVERS\Sftfslh.sys
15:12:23.0083 1704        Sftfs - ok
15:12:23.0177 1704        Sftplay        (390aa7bc52cee43f6790cdea1e776703) C:\Windows\system32\DRIVERS\Sftplaylh.sys
15:12:23.0177 1704        Sftplay - ok
15:12:23.0192 1704        Sftredir        (617e29a0b0a2807466560d4c4e338d3e) C:\Windows\system32\DRIVERS\Sftredirlh.sys
15:12:23.0208 1704        Sftredir - ok
15:12:23.0224 1704        Sftvol          (8f571f016fa1976f445147e9e6c8ae9b) C:\Windows\system32\DRIVERS\Sftvollh.sys
15:12:23.0239 1704        Sftvol - ok
15:12:23.0333 1704        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
15:12:23.0364 1704        SiSRaid2 - ok
15:12:23.0364 1704        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
15:12:23.0380 1704        SiSRaid4 - ok
15:12:23.0411 1704        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
15:12:23.0442 1704        Smb - ok
15:12:23.0551 1704        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
15:12:23.0567 1704        spldr - ok
15:12:23.0629 1704        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
15:12:23.0660 1704        srv - ok
15:12:23.0738 1704        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
15:12:23.0785 1704        srv2 - ok
15:12:23.0848 1704        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
15:12:23.0879 1704        srvnet - ok
15:12:23.0988 1704        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
15:12:24.0004 1704        stexstor - ok
15:12:24.0050 1704        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
15:12:24.0050 1704        swenum - ok
15:12:24.0206 1704        Tcpip          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
15:12:24.0253 1704        Tcpip - ok
15:12:24.0300 1704        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
15:12:24.0331 1704        TCPIP6 - ok
15:12:24.0362 1704        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
15:12:24.0440 1704        tcpipreg - ok
15:12:24.0534 1704        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
15:12:24.0581 1704        TDPIPE - ok
15:12:24.0596 1704        TDTCP          (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
15:12:24.0628 1704        TDTCP - ok
15:12:24.0674 1704        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
15:12:24.0721 1704        tdx - ok
15:12:24.0799 1704        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
15:12:24.0830 1704        TermDD - ok
15:12:24.0877 1704        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
15:12:24.0908 1704        tssecsrv - ok
15:12:25.0064 1704        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
15:12:25.0111 1704        TsUsbFlt - ok
15:12:25.0220 1704        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
15:12:25.0267 1704        tunnel - ok
15:12:25.0298 1704        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
15:12:25.0314 1704        uagp35 - ok
15:12:25.0408 1704        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
15:12:25.0486 1704        udfs - ok
15:12:25.0532 1704        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
15:12:25.0532 1704        uliagpkx - ok
15:12:25.0642 1704        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
15:12:25.0657 1704        umbus - ok
15:12:25.0688 1704        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
15:12:25.0704 1704        UmPass - ok
15:12:25.0813 1704        USBAAPL64      (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys
15:12:25.0844 1704        USBAAPL64 - ok
15:12:25.0922 1704        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
15:12:25.0954 1704        usbaudio - ok
15:12:26.0032 1704        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
15:12:26.0094 1704        usbccgp - ok
15:12:26.0188 1704        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
15:12:26.0219 1704        usbcir - ok
15:12:26.0297 1704        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
15:12:26.0312 1704        usbehci - ok
15:12:26.0375 1704        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
15:12:26.0390 1704        usbhub - ok
15:12:26.0453 1704        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
15:12:26.0468 1704        usbohci - ok
15:12:26.0531 1704        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
15:12:26.0562 1704        usbprint - ok
15:12:26.0640 1704        usbscan        (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
15:12:26.0671 1704        usbscan - ok
15:12:26.0734 1704        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
15:12:26.0765 1704        USBSTOR - ok
15:12:26.0843 1704        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
15:12:26.0874 1704        usbuhci - ok
15:12:26.0952 1704        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
15:12:26.0968 1704        vdrvroot - ok
15:12:27.0030 1704        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
15:12:27.0046 1704        vga - ok
15:12:27.0092 1704        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
15:12:27.0155 1704        VgaSave - ok
15:12:27.0217 1704        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
15:12:27.0233 1704        vhdmp - ok
15:12:27.0295 1704        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
15:12:27.0311 1704        viaide - ok
15:12:27.0358 1704        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
15:12:27.0373 1704        volmgr - ok
15:12:27.0436 1704        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
15:12:27.0451 1704        volmgrx - ok
15:12:27.0529 1704        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
15:12:27.0545 1704        volsnap - ok
15:12:27.0623 1704        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
15:12:27.0638 1704        vsmraid - ok
15:12:27.0685 1704        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
15:12:27.0716 1704        vwifibus - ok
15:12:27.0794 1704        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
15:12:27.0841 1704        WacomPen - ok
15:12:27.0935 1704        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
15:12:27.0982 1704        WANARP - ok
15:12:27.0982 1704        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
15:12:28.0013 1704        Wanarpv6 - ok
15:12:28.0122 1704        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
15:12:28.0138 1704        Wd - ok
15:12:28.0169 1704        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
15:12:28.0184 1704        Wdf01000 - ok
15:12:28.0325 1704        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
15:12:28.0372 1704        WfpLwf - ok
15:12:28.0387 1704        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
15:12:28.0387 1704        WIMMount - ok
15:12:28.0543 1704        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
15:12:28.0574 1704        WinUsb - ok
15:12:28.0652 1704        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
15:12:28.0668 1704        WmiAcpi - ok
15:12:28.0746 1704        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
15:12:28.0793 1704        ws2ifsl - ok
15:12:28.0855 1704        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
15:12:28.0886 1704        WudfPf - ok
15:12:28.0949 1704        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
15:12:28.0996 1704        WUDFRd - ok
15:12:29.0042 1704        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
15:12:29.0183 1704        \Device\Harddisk0\DR0 - ok
15:12:29.0183 1704        Boot (0x1200)  (d352c35f01a8ba43361eb41d4b91a8e1) \Device\Harddisk0\DR0\Partition0
15:12:29.0183 1704        \Device\Harddisk0\DR0\Partition0 - ok
15:12:29.0230 1704        Boot (0x1200)  (277707de848871a778a39c669570d7f7) \Device\Harddisk0\DR0\Partition1
15:12:29.0230 1704        \Device\Harddisk0\DR0\Partition1 - ok
15:12:29.0261 1704        Boot (0x1200)  (0d4709fa36a7ebf7a85a9c45d9c3e938) \Device\Harddisk0\DR0\Partition2
15:12:29.0261 1704        \Device\Harddisk0\DR0\Partition2 - ok
15:12:29.0261 1704        ============================================================
15:12:29.0261 1704        Scan finished
15:12:29.0261 1704        ============================================================
15:12:29.0276 4412        Detected object count: 0
15:12:29.0276 4412        Actual detected object count: 0

cosinus 02.03.2012 17:49
Die Logs sind in CODE-Tags zu posten!!!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehlalarm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

floribu 04.03.2012 11:58
Hallo Arne,

also, nun habe ich auch diesen Scan durchgeführt und hier kommt der Logfile-Eintrag:
Code:
aswMBR version 0.9.9.1649 Copyright(c) 2011 AVAST Software
Run date: 2012-03-04 11:40:26
-----------------------------
11:40:26.771    OS Version: Windows x64 6.1.7601 Service Pack 1
11:40:26.771    Number of processors: 2 586 0x170A
11:40:26.771    ComputerName: FLORIANBURKHARD  UserName:
11:40:29.298    Initialize success
11:42:02.524    AVAST engine defs: 12030400
11:42:56.812    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
11:42:56.812    Disk 0 Vendor: Hitachi_HDS721032CLA362 JPFOA3EA Size: 305245MB BusType: 3
11:42:56.828    Disk 0 MBR read successfully
11:42:56.828    Disk 0 MBR scan
11:42:56.843    Disk 0 Windows 7 default MBR code
11:42:56.843    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        16384 MB offset 2048
11:42:56.859    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 33556480
11:42:56.875    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      144334 MB offset 33761280
11:42:56.890    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      144425 MB offset 329357312
11:42:56.937    Disk 0 scanning C:\Windows\system32\drivers
11:43:06.359    Service scanning
11:43:37.091    Modules scanning
11:43:37.091    Disk 0 trace - called modules:
11:43:37.123    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys
11:43:37.138    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800337f430]
11:43:37.138    3 CLASSPNP.SYS[fffff880019a843f] -> nt!IofCallDriver -> [0xfffffa8002f25520]
11:43:37.138    5 ACPI.sys[fffff88000fa77a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa8002f21680]
11:43:37.637    AVAST engine scan C:\Windows
11:43:40.055    AVAST engine scan C:\Windows\system32
11:43:50.975    File: C:\Windows\system32\consrv.dll  **INFECTED** Win32:Sirefef-JQ [Trj]
11:46:45.392    File: C:\Windows\assembly\tmp\loader.tlb **SUSPICIOUS**
11:46:45.454    File: C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} **SUSPICIOUS**
11:46:45.704    AVAST engine scan C:\Windows\system32\drivers
11:46:57.654    AVAST engine scan C:\Users\Florian Burkhardtt
11:51:33.236    AVAST engine scan C:\ProgramData
11:53:39.428    Scan finished successfully
11:55:24.417    Disk 0 MBR has been saved successfully to "C:\Users\Florian Burkhardtt\Desktop\MBR.dat"
11:55:24.417    The log file has been saved successfully to "C:\Users\Florian Burkhardtt\Desktop\aswMBR.txt"

cosinus 05.03.2012 13:42
Geh mal bitte in den abgesicherten Modus. Versuch dort diese Objekte zu verschieben, zB nach C:\TB

C:\Windows\system32\consrv.dll
C:\Windows\assembly\tmp\loader.tlb
C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Sag Bescheid wenn es da hapert. Hat das Verschieben geklappt, startest du wieder in den normalen Modus von WIndows und machst wieder ein neues Log mit aswMBR

floribu 05.03.2012 15:40
Hallo Arne,

danke für die weiteren Instruktionen.

Habe das soweit versucht, bin aber an einer Sache gescheitert und zwar konnte ich die consrv.dll verschieben, aber bei den beiden anderen fehlte mir jeweils der Unterordner \tmp\ und konnte sie daher nicht verschieben.

Hier allerdings auch schon mal der neue Log-Eintrag nach dem letzten Scan:

Code:
aswMBR version 0.9.9.1649 Copyright(c) 2011 AVAST Software
Run date: 2012-03-05 14:58:08
-----------------------------
14:58:08.785    OS Version: Windows x64 6.1.7601 Service Pack 1
14:58:08.785    Number of processors: 2 586 0x170A
14:58:08.785    ComputerName: FLORIANBURKHARD  UserName:
14:58:09.331    Initialize success
14:58:12.997    AVAST engine defs: 12030400
14:58:25.306    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
14:58:25.306    Disk 0 Vendor: Hitachi_HDS721032CLA362 JPFOA3EA Size: 305245MB BusType: 3
14:58:25.321    Disk 0 MBR read successfully
14:58:25.321    Disk 0 MBR scan
14:58:25.321    Disk 0 Windows 7 default MBR code
14:58:25.337    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        16384 MB offset 2048
14:58:25.352    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 33556480
14:58:25.368    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      144334 MB offset 33761280
14:58:25.399    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      144425 MB offset 329357312
14:58:25.446    Disk 0 scanning C:\Windows\system32\drivers
14:58:35.368    Service scanning
14:59:05.803    Modules scanning
14:59:05.803    Disk 0 trace - called modules:
14:59:05.834    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys
14:59:05.834    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8003384350]
14:59:05.834    3 CLASSPNP.SYS[fffff8800197243f] -> nt!IofCallDriver -> [0xfffffa8002ebd520]
14:59:05.850    5 ACPI.sys[fffff88000f807a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa8002ee4060]
14:59:06.349    AVAST engine scan C:\Windows
14:59:09.313    AVAST engine scan C:\Windows\system32
15:02:37.531    AVAST engine scan C:\Windows\system32\drivers
15:02:52.237    AVAST engine scan C:\Users\Florian Burkhardtt
15:07:03.376    AVAST engine scan C:\ProgramData
15:09:18.806    Scan finished successfully
15:36:01.218    Disk 0 MBR has been saved successfully to "C:\Users\Florian Burkhardtt\Desktop\MBR.dat"
15:36:01.222    The log file has been saved successfully to "C:\Users\Florian Burkhardtt\Desktop\aswMBR.txt"

cosinus 05.03.2012 16:06
Sieht aber nun ok aus.

Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

floribu 06.03.2012 08:52
Hallo Arne,

anbei die Logfile-Einträge der beiden Suchprogramme:

1. Malwarebytes:

Code:
Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.05.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Florian Burkhardtt :: FLORIANBURKHARD [Administrator]

Schutz: Aktiviert

05.03.2012 16:18:35
mbam-log-2012-03-05 (17-11-41).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 339219
Laufzeit: 41 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 9
C:\Qoobox\Quarantine\C\Users\Florian Burkhardtt\AppData\Local\67b8bb43\U\800000cb.@.vir (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Users\Florian Burkhardtt\AppData\Local\67b8bb43\U\800000cf.@.vir (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Windows\assembly\tmp\U\00000001.@.vir (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Windows\assembly\tmp\U\000000cb.@.vir (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Windows\assembly\tmp\U\800000c0.@.vir (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Windows\assembly\tmp\U\800000cb.@.vir (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Windows\assembly\tmp\U\800000cf.@.vir (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Qoobox\Quarantine\C\Windows\System32\AdobeActiveFileMonitor6.0.dll.vir (Trojan.Siredef) -> Keine Aktion durchgeführt.
C:\TB\consrv.dll (Trojan.Siredef) -> Keine Aktion durchgeführt.

(Ende)
2. SuperAntispyware

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 03/05/2012 at 06:36 PM

Application Version : 5.0.1144

Core Rules Database Version : 8302
Trace Rules Database Version: 6114

Scan type      : Complete Scan
Total Scan Time : 01:18:14

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 574
Memory threats detected  : 0
Registry items scanned    : 67050
Registry threats detected : 0
File items scanned        : 203260
File threats detected    : 370

Adware.Tracking Cookie
        C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft\Windows\Cookies\1WHX7DZH.txt [ /smartadserver.com ]
        C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft\Windows\Cookies\5XGTB3WL.txt [ /doubleclick.net ]
        C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft\Windows\Cookies\OO1FKP1D.txt [ /apmebf.com ]
        C:\Users\Florian Burkhardtt\AppData\Roaming\Microsoft\Windows\Cookies\R0OE63MW.txt [ /mediaplex.com ]
        C:\USERS\FLORIAN BURKHARDTT\Cookies\1WHX7DZH.txt [ Cookie:florian burkhardtt@smartadserver.com/ ]
        C:\USERS\FLORIAN BURKHARDTT\Cookies\OO1FKP1D.txt [ Cookie:florian burkhardtt@apmebf.com/ ]
        C:\USERS\FLORIAN BURKHARDTT\Cookies\R0OE63MW.txt [ Cookie:florian burkhardtt@mediaplex.com/ ]
        in.getclicky.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .getclicky.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .static.getclicky.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        media.antenne-bayern.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        fr.sitestat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        fr.sitestat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        uk.sitestat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        uk.sitestat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        wstat.wibiya.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .mediadesign.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .mediadesign.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ie-stat.bmmetrix.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .trafficmp.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .trafficmp.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .trafficmp.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .yieldmanager.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        counters.gigya.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .phg.hitbox.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .hitbox.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adxpose.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .pro-market.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        web4.realtracker.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .horyzon-media.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .horyzon-media.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .horyzon-media.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .horyzon-media.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        sitestats.ets.org [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .oncampusadvertising.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .oncampusadvertising.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .superstats.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        urbia.wwe-media.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .de.partypoker.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .de.partypoker.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .de.partypoker.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .aerlingus.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .vodafonegroup.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .msnportal.112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .germanwings.112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .trinitymirror.112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .guj.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .superrtl.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .paypal.112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .educationmanagementllc.112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .airtrade.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .opodo.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .budgetcarhire.112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.trafficmaxx.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        nedstat.hostelbookers.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        nedstat.hostelbookers.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tsleducation.112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        stats4.clicktracks.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        stats4.clicktracks.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        stats4.clicktracks.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        stats4.clicktracks.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .makheia.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .thechronicleofhighereducation.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .nextstat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .nextstat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .nextstat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .manpower.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        stats.manticoretechnology.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .allegis.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        zbox.zanox.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        educadultos.mforos.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .publicidad.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .publicidad.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .publicidad.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .publicidad.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .publicidad.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .publicidad.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .publicidad.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .publicidad.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .aka-cdn-ns.adtech.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .stepstone.112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad.adserver01.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        webtracker.educationconnection.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad1.emediate.dk [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad1.emediate.dk [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .ihg.db.advertising.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .leisure.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .eventbrite.122.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .wpni.112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ie-stat.bmmetrix.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .embassy-finder.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .embassy-finder.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        livestat.derstandard.at [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .efeducationfirst.112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .partnersearchmetrics.sbx1.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        articles.timesofindia.indiatimes.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .articles.timesofindia.indiatimes.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .articles.timesofindia.indiatimes.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .articles.timesofindia.indiatimes.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        articles.timesofindia.indiatimes.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        articles.timesofindia.indiatimes.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        articles.timesofindia.indiatimes.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        articles.timesofindia.indiatimes.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .hightraffic.hugoboss.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aekoelcpoao.stats.esomniture.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .stats.paypal.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad.dyntracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        stats.johanniter.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ads.publicidad.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www2.smartadserver.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.smartadserver.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        s4.trafficmaxx.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .aimfar.solution.weborama.fr [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .postclicktracking.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .nhhotelessa.112.2o7.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adserver.adtechus.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        aff.trafficjmp.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.trafficjmp.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .macromedia-fachhochschule.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .macromedia-fachhochschule.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        click.expandsearchanswers.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        xml.trafficengine.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .trafficengine.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .mediaevent.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .mediaevent.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .mediaevent.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.usenext.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        track.juzzweb.com [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FLORIAN BURKHARDTT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0CYY998L.DEFAULT\COOKIES.SQLITE ]

cosinus 06.03.2012 13:42
Das ist ok. In C:\Qoobox bzw. C:\_OTL (Q-Ordner von CF und OTL) sind die Schädlinge isoliert und gut aufgehoben. Gleiches gilt für den eigens angelegten Ordner C:\TB, den haben wir ja angelegt um die Datei da hin zu verschieben. Kann eigentlich alles weg.

Der Rest ist nur Cookies, weg damit. Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

floribu 08.03.2012 15:42
Hallo Arne,

danke für die Hilfe. Das System funktioniert nun eigentlich wieder einwandfrei. Der Abnow-Umleitungs-Blödsinn ist auch wieder verschwunden.

Wie genau entferne ich nun die auf die Seite geräumten Dateien? Einfach nur löschen oder sollte ich über die verschiedenen Programme löschen lassen?

cosinus 08.03.2012 15:51
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:27 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20