Trojaner-Board - AKM 50€ Trojaner - OTL schon ausgeführt, was dann?

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - AKM 50€ Trojaner - OTL schon ausgeführt, was dann? (https://www.trojaner-board.de/111603-akm-50-trojaner-otl-schon-ausgefuehrt-dann.html)

Smiler12321

15.03.2012 19:03

AKM 50€ Trojaner - OTL schon ausgeführt, was dann?

Hallo,

ich hab schon 2 Tage jetzt versucht meinen Laptop wieder zu starten, leider ohne Erfolg.
Kenne mich mit Programmierung etc nicht so gut aus aber ich habe mich mit einem Fachmann ein bisschen kurzgeschlossen, der aber leider nicht so viel Zeit hat.
Die Beschreibung auf der AKM seite passt perfekt auf das was ich auf dem bildschirm gesehen habe, darum gehe ich davon aus dass es der AKM trojaner ist.
Als erstes habe ich die OTL datei runtergeladen und dann eine cd erstellt. Merhmals habe ich versucht dann von dieser cd aus zu booten, kurz vorm einloggen jedoch ist der computer dann (blauer bildschirm mit weißerschrift "crash dump" etc) abgestürzt. Habe shcon 2 fix.txt dateien ausprobiert und danach einen malwarebytes scan drüberlaufen lassen. das Mehrmals und er hat auch insgesamt um die 150 bis 200 dateien gefunden die ich dann gelöscht habe.
die cd habe ich überigens nie normal starten können sondern immer nur über "abgesicherter modus mit eingabeaufforderung" . an meine daten komme ich im notfall ran aber ich würde gerne haben wollen dass mein pc wieder läuft... logisch^^ auf jeden fall startet der pc immer wenn ich ihn normal ohne von der cd zu booten hochfahre normal (neuerdings) und nach 2 sekunden taucht wieder ein grauer bildshcirm auf mit der zahlungsaufforderung.
Habe mich nun viel durchgelesen aber bin mit meinem latein am ende... was soll cih nun tun? kann wer helfen?

LG :wtf:

Habe soeben das OTLPE.exe durchlaufen lassen:

cosinus

16.03.2012 18:11

Zitat:

und danach einen Malwarebytes scan drüberlaufen lassen. das Mehrmals und er hat auch insgesamt um die 150 bis 200 dateien gefunden die ich dann gelöscht habe.

Toll, und das Log wird wieder weggelassen :(
Alle Logs von Malwarebytes sind zu posten!

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Smiler12321

16.03.2012 21:27

so ich poste mal alle scans chronologisch:

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.01.31.07
 

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus)

Internet Explorer 8.0.7601.17514

Josefa :: JR_NOTEBOOK [Administrator]
 

Schutz: Deaktiviert
 

15.03.2012 19:07:56

mbam-log-2012-03-15 (19-07-56).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 390855

Laufzeit: 36 Minute(n), 34 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 37

HKCR\CLSID\{597A9974-8CB0-4f41-B61F-ED065738A397} (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

HKCR\CLSID\{25514C64-8321-494e-BD3E-3DBAB3F8CEBA} (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

HKCR\TypeLib\{60BE6B2E-F2F5-4404-AA1E-4381D4A6EEA2} (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

HKCR\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB} (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

HKCR\RewardsArcade.FBApi.1 (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

HKCR\RewardsArcade.FBApi (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

HKCR\RewardsArcade.BHO.1 (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{597A9974-8CB0-4F41-B61F-ED065738A397} (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{597A9974-8CB0-4F41-B61F-ED065738A397} (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{597A9974-8CB0-4F41-B61F-ED065738A397} (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RewardsArcade (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

HKCR\AppID\{D2083641-E57F-4eab-BB85-0582424F4A29} (Adware.HotBar.CP) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Typelib\{B035BA6B-57CD-4F72-B545-65BE465FCAF6} (Adware.ShoppingReport2) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Typelib\{D44FD6F0-9746-484E-B5C4-C66688393872} (Adware.ShoppingReport2) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C} (Adware.ShoppingReport2) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-CD68-4f36-8D02-8C43722EE5DA} (Adware.Hotbar) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ClickPotatoLiteAx.Info (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ClickPotatoLiteAx.Info.1 (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ClickPotatoLiteAX.UserProfiles (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ClickPotatoLiteAX.UserProfiles.1 (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\MenuButtonIE.ButtonIE (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\MenuButtonIE.ButtonIE.1 (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.HbAx (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.HbAx.1 (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.HbInfoBand (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.HbInfoBand.1 (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.IEButton (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.IEButton.1 (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.IEButtonA (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.IEButtonA.1 (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.RprtCtrl (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.RprtCtrl.1 (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\AppID\MenuButtonIE.DLL (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\clickpotatolitesa (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\ClickPotatoLite (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 2

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Hijack.Shell.Gen) -> Daten: C:\Users\Josefa\AppData\Roaming\flint4ytw.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Mozilla\Firefox\extensions|ClickPotatoLite@ClickPotatoLite.com (Adware.ClickPotato) -> Daten: C:\Program Files\ClickPotatoLite\bin\10.0.659.0\firefox\extensions -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 29

C:\Program Files\RewardsArcade (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498 (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Chrome (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\defaults (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\defaults\preferences (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\locale (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\locale\en-US (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\ClickPotatoLiteSA (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Roaming\ClickPotatoLite (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\ClickPotatoLite (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\ClickPotatoLite\bin (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\ClickPotatoLite\bin\10.0.659.0 (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\ClickPotatoLite\bin\10.0.659.0\firefox (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\ClickPotatoLite\bin\10.0.659.0\firefox\extensions (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\ClickPotatoLite\bin\10.0.659.0\firefox\extensions\plugins (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0} (Adware.QuestBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\chrome (Adware.QuestBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\defaults (Adware.QuestBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\defaults\preferences (Adware.QuestBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 63

C:\Program Files\RewardsArcade\RewardsArcade.dll (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\Downloads\nu__words_and_pictures.exe (PUP.BundleInstaller.MG) -> Keine Aktion durchgeführt.

C:\Program Files\RewardsArcade\fb.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Program Files\RewardsArcade\appAPIinternalWrapper.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Program Files\RewardsArcade\jquery.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Program Files\RewardsArcade\json.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Program Files\RewardsArcade\RewardsArcade.exe (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Program Files\RewardsArcade\Uninstall.exe (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Program Files\RewardsArcade\UserConfirmation.exe (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\uninstall.ico (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Chrome\rewardsarcade.crx (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome.manifest (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\install.rdf (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\background.html (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\browser.xul (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\crossrider.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\crossriderapi.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\manage-apps-style.css (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\manage-apps.html (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\messaging.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\options.xul (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\push.html (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\socialapi.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\update.html (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\utilityapi.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\workers_chain.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\faye-browser-min.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\jquery-1.4.2.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\facebox.css (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\facebox.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\b.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\bl.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\br.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\closelabel.gif (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\loading.gif (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\tl.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\tr.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\defaults\preferences\prefs.js (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\locale\en-US\translations.dtd (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\button1.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\button2.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\button3.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\button4.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\button5.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\crossrider_statusbar.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\icon24.png (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\skin.css (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\update.css (PUP.RewardsArcade) -> Keine Aktion durchgeführt.

C:\Users\Josefa\Downloads\setup.exe (Trojan.FakeVLC) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\Temp\0.9903500560555318.exe (Exploit.Drop.2) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA.dat (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAAbout.mht (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAau.dat (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAEULA.mht (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA_kyf_update.dat (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\ClickPotatoLite\bin\10.0.659.0\firefox\extensions\install.rdf (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\About Us.lnk (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\ClickPotato Customer Support.lnk (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\ClickPotato Uninstall Instructions.lnk (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\chrome.manifest (Adware.QuestBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\install.rdf (Adware.QuestBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\chrome\questbrowse.jar (Adware.QuestBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}\defaults\preferences\prefs.js (Adware.QuestBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.01.31.07
 

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus)

Internet Explorer 8.0.7601.17514

Josefa :: JR_NOTEBOOK [Administrator]
 

Schutz: Deaktiviert
 

15.03.2012 23:17:08

mbam-log-2012-03-15 (23-17-08).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 384380

Laufzeit: 35 Minute(n), 42 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 11

HKCR\CLSID\{597A9974-8CB0-4f41-B61F-ED065738A397} (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{25514C64-8321-494e-BD3E-3DBAB3F8CEBA} (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\TypeLib\{60BE6B2E-F2F5-4404-AA1E-4381D4A6EEA2} (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB} (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\RewardsArcade.FBApi.1 (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\RewardsArcade.FBApi (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\RewardsArcade.BHO.1 (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{597A9974-8CB0-4F41-B61F-ED065738A397} (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{597A9974-8CB0-4F41-B61F-ED065738A397} (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{597A9974-8CB0-4F41-B61F-ED065738A397} (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RewardsArcade (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 1

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Hijack.Shell.Gen) -> Daten: C:\Users\Josefa\AppData\Roaming\flint4ytw.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 15

C:\Program Files\RewardsArcade (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498 (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Chrome (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\defaults (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\defaults\preferences (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\locale (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\locale\en-US (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 48

C:\Program Files\RewardsArcade\RewardsArcade.dll (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\Downloads\nu__words_and_pictures.exe (PUP.BundleInstaller.MG) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\RewardsArcade\fb.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\RewardsArcade\appAPIinternalWrapper.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\RewardsArcade\jquery.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\RewardsArcade\json.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\RewardsArcade\RewardsArcade.exe (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\RewardsArcade\Uninstall.exe (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\RewardsArcade\UserConfirmation.exe (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\uninstall.ico (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Chrome\rewardsarcade.crx (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome.manifest (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\install.rdf (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\background.html (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\browser.xul (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\crossrider.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\crossriderapi.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\manage-apps-style.css (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\manage-apps.html (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\messaging.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\options.xul (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\push.html (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\socialapi.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\update.html (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\utilityapi.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\workers_chain.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\faye-browser-min.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\jquery-1.4.2.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\facebox.css (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\facebox.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\b.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\bl.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\br.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\closelabel.gif (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\loading.gif (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\tl.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\chrome\content\lib\facebox\Images\tr.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\defaults\preferences\prefs.js (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\locale\en-US\translations.dtd (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\button1.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\button2.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\button3.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\button4.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\button5.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\crossrider_statusbar.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\icon24.png (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\skin.css (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox\skin\update.css (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.01.31.07
 

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus)

Internet Explorer 8.0.7601.17514

Josefa :: JR_NOTEBOOK [Administrator]
 

Schutz: Deaktiviert
 

16.03.2012 00:15:44

mbam-log-2012-03-16 (00-15-44).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 1029

Laufzeit: 50 Sekunde(n) [Abgebrochen]
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.01.31.07
 

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus)

Internet Explorer 8.0.7601.17514

Josefa :: JR_NOTEBOOK [Administrator]
 

Schutz: Deaktiviert
 

16.03.2012 00:25:42

mbam-log-2012-03-16 (00-25-42).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 386882

Laufzeit: 35 Minute(n), 37 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 1

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Hijack.Shell.Gen) -> Daten: C:\Users\Josefa\AppData\Roaming\flint4ytw.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.01.31.07
 

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus)

Internet Explorer 8.0.7601.17514

Josefa :: JR_NOTEBOOK [Administrator]
 

Schutz: Deaktiviert
 

16.03.2012 02:57:35

mbam-log-2012-03-16 (02-57-35).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 386792

Laufzeit: 35 Minute(n), 50 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 30

HKCR\AppID\{D2083641-E57F-4eab-BB85-0582424F4A29} (Adware.HotBar.CP) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{597A9974-8CB0-4f41-B61F-ED065738A397} (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\TypeLib\{60BE6B2E-F2F5-4404-AA1E-4381D4A6EEA2} (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB} (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\RewardsArcade.BHO.1 (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{597A9974-8CB0-4F41-B61F-ED065738A397} (PUP.RewardsArcade) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Typelib\{B035BA6B-57CD-4F72-B545-65BE465FCAF6} (Adware.ShoppingReport2) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Typelib\{D44FD6F0-9746-484E-B5C4-C66688393872} (Adware.ShoppingReport2) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C} (Adware.ShoppingReport2) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-CD68-4f36-8D02-8C43722EE5DA} (Adware.Hotbar) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ClickPotatoLiteAx.Info (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ClickPotatoLiteAx.Info.1 (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ClickPotatoLiteAX.UserProfiles (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ClickPotatoLiteAX.UserProfiles.1 (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\MenuButtonIE.ButtonIE (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\MenuButtonIE.ButtonIE.1 (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.HbAx (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.HbAx.1 (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.HbInfoBand (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.HbInfoBand.1 (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.IEButton (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.IEButton.1 (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.IEButtonA (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.IEButtonA.1 (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.RprtCtrl (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ShoppingReport2.RprtCtrl.1 (Adware.ShopperReports) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\AppID\MenuButtonIE.DLL (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\ClickPotatoLite (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 2

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Hijack.Shell.Gen) -> Daten: C:\Users\Josefa\AppData\Roaming\flint4ytw.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Mozilla\Firefox\extensions|ClickPotatoLite@ClickPotatoLite.com (Adware.ClickPotato) -> Daten: C:\Program Files\ClickPotatoLite\bin\10.0.659.0\firefox\extensions -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.01.31.07
 

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus)

Internet Explorer 8.0.7601.17514

Josefa :: JR_NOTEBOOK [Administrator]
 

Schutz: Deaktiviert
 

16.03.2012 06:14:38

mbam-log-2012-03-16 (06-14-38).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 386906

Laufzeit: 36 Minute(n), 11 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 1

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Hijack.Shell.Gen) -> Daten: C:\Users\Josefa\AppData\Roaming\flint4ytw.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

soll ich die OTL dateien auch nochmal so schicken oder is das ok soweit?

LG

cosinus

17.03.2012 14:25

Zitat:

Datenbank Version: v2012.01.31.07

Du hast Malwarebytes vorher nicht aktualisiert. Bitte updaten und einen Vollscan machen.

Smiler12321

17.03.2012 21:43

hmm also ich hab die neueste Verion runtergeladen aber ich kann ja auf dem "kaputten" pc gar nicht updaten... wie soll ich denn das machen? im abgesicherten modus habe ich ja keinen internetzugang und anders komme ich gar nicht ran...

cosinus

19.03.2012 15:52

Dafür gibt es den abgesicherten Modus mit Netzwerktreibern!

Smiler12321

22.03.2012 21:29

so nach einigem hin und her jetzt mal upgedatet...

Code:



Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.03.22.04
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 8.0.7601.17514

Administrator :: JR_NOTEBOOK [Administrator]
 

Schutz: Aktiviert
 

22.03.2012 20:02:22

mbam-log-2012-03-22 (20-02-22).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 418448

Laufzeit: 1 Stunde(n), 3 Minute(n), 1 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Users\Josefa\AppData\Roaming\flint4ytw.exe (Spyware.Passwords) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

cosinus

23.03.2012 21:13

Führ bitte auch ESET aus, danach sehen wir weiter:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Smiler12321

24.03.2012 07:49

Code:


 

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=f08bee091869dc47a02b93c482dcd502

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-03-24 02:13:25

# local_time=2012-03-24 03:13:25 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=5893 16776574 100 94 28947615 84170548 0 0

# compatibility_mode=8192 67108863 100 0 5395 5395 0 0

# scanned=186759

# found=0

# cleaned=0

# scan_time=15848

wie schalte ich denn meine icons auf dem desktop wieder so dass ich sie sehen kann... auch das rechtsklickmenü erscheint nicht am desktop... startleiste is allerdings vorhanden und sichtbar...

cosinus

24.03.2012 18:26

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Smiler12321

25.03.2012 00:52

OTL.txt

OTL Logfile:

Code:

OTL logfile created on: 24.03.2012 19:34:51 - Run 1

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Josefa\Downloads

 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,18 Gb Total Physical Memory | 1,91 Gb Available Physical Memory | 60,20% Memory free

6,35 Gb Paging File | 4,95 Gb Available in Paging File | 77,93% Paging File free

Paging file location(s): c:\pagefile.sys 3253 5000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 97,56 Gb Total Space | 32,85 Gb Free Space | 33,67% Space Free | Partition Type: NTFS

Drive E: | 498,51 Gb Total Space | 138,68 Gb Free Space | 27,82% Space Free | Partition Type: NTFS

 

Computer Name: JR_NOTEBOOK | User Name: Josefa | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.03.24 19:29:19 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Josefa\Downloads\OTL.exe

PRC - [2012.03.13 05:37:52 | 003,331,872 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\Josefa\AppData\Local\Akamai\netsession_win.exe

PRC - [2012.03.04 22:48:40 | 000,934,752 | ---- | M] (Spigot, Inc.) -- C:\Programme\Common Files\Spigot\Search Settings\SearchSettings.exe

PRC - [2012.03.04 22:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe

PRC - [2012.02.15 00:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.01.13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe

PRC - [2011.07.07 08:08:30 | 000,216,064 | ---- | M] (Geek Software GmbH) -- E:\Program Files\PDF24\pdf24.exe

PRC - [2011.06.15 14:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe

PRC - [2011.04.27 14:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe

PRC - [2011.04.27 14:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe

PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.12.20 15:31:00 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Programme\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

PRC - [2010.12.20 15:30:31 | 001,493,608 | ---- | M] (Realtek Semiconductor) -- C:\Programme\Realtek\Audio\HDA\RtHDVBg.exe

PRC - [2010.12.20 15:30:30 | 002,320,920 | R--- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

PRC - [2010.12.20 15:30:27 | 000,268,824 | R--- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2010.11.20 13:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe

PRC - [2010.10.27 03:59:10 | 000,236,136 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2010.06.21 13:53:44 | 000,436,264 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\WButton.exe

PRC - [2010.03.03 20:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

PRC - [2010.03.03 20:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

PRC - [2009.11.07 03:46:52 | 000,020,480 | ---- | M] (X10) -- C:\Programme\Common Files\X10\Common\X10nets.exe

PRC - [2009.10.22 17:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\WisLMSvc.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.02.18 23:30:16 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\5be773440afa1e1f565f9021d8fd9730\IAStorUtil.ni.dll

MOD - [2012.02.18 23:24:59 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\42ae8760f0a74ab774e82a64368aa1f6\System.Web.ni.dll

MOD - [2012.02.18 23:24:53 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\a1c4a635721f85bef0ea4194b888b871\System.Runtime.Remoting.ni.dll

MOD - [2012.02.18 23:24:29 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll

MOD - [2012.02.18 23:24:23 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll

MOD - [2012.02.18 23:24:11 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\47b9e7f070271ff50f988f75ea68fa3e\WindowsBase.ni.dll

MOD - [2012.02.18 23:24:07 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll

MOD - [2012.02.18 23:24:02 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll

MOD - [2012.02.18 23:24:01 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll

MOD - [2012.01.08 14:41:12 | 000,093,696 | ---- | M] () -- E:\Program Files\FileZilla FTP Client\fzshellext.dll

MOD - [2011.10.15 15:20:32 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll

MOD - [2011.07.29 00:09:42 | 000,096,112 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll

MOD - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe

MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

MOD - [2010.11.13 00:19:04 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2009.07.14 09:47:11 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.03.04 22:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Programme\Application Updater\ApplicationUpdater.exe -- (Application Updater)

SRV - [2012.02.15 13:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.02.10 21:30:45 | 003,340,064 | ---- | M] () [Auto | Running] -- c:\program files\common files\akamai/netsession_win_7de0ed9.dll -- (Akamai)

SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.06.12 10:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)

SRV - [2011.04.27 14:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)

SRV - [2011.04.27 14:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)

SRV - [2011.02.19 14:08:43 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2011.02.19 12:36:06 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2010.12.20 15:30:30 | 002,320,920 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)

SRV - [2010.12.20 15:30:27 | 000,268,824 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)

SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2010.10.27 03:59:10 | 000,236,136 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2010.10.27 03:57:22 | 001,620,584 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2010.03.03 20:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)

SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

SRV - [2009.11.07 03:46:52 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)

SRV - [2009.10.22 17:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [On_Demand | Running] -- C:\Programme\Launch Manager\WisLMSvc.exe -- (WisLMSvc)

SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)

DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011.08.17 09:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)

DRV - [2011.08.17 09:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)

DRV - [2011.08.17 09:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)

DRV - [2011.04.27 14:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2011.04.18 12:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)

DRV - [2010.12.20 15:31:00 | 000,141,568 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nusb3xhc.sys -- (nusb3xhc)

DRV - [2010.12.20 15:31:00 | 000,061,824 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nusb3hub.sys -- (nusb3hub)

DRV - [2010.12.20 15:30:55 | 000,067,624 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)

DRV - [2010.12.20 15:30:54 | 000,193,056 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV - [2010.12.20 15:30:53 | 010,367,016 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2010.12.20 15:30:53 | 000,019,656 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvpciflt.sys -- (nvpciflt)

DRV - [2010.12.20 15:30:27 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (HECI) Intel(R)

DRV - [2010.11.20 13:30:17 | 000,296,064 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)

DRV - [2010.11.20 13:30:17 | 000,172,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)

DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)

DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)

DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)

DRV - [2010.11.20 11:50:38 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)

DRV - [2010.11.20 11:50:37 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)

DRV - [2010.11.20 11:50:37 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vpcuxd.sys -- (vpcuxd)

DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.11.20 11:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)

DRV - [2010.04.01 09:13:38 | 001,009,184 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8192se.sys -- (rtl8192se)

DRV - [2010.03.02 13:57:42 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)

DRV - [2010.03.02 13:57:42 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)

DRV - [2010.03.02 13:57:42 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)

DRV - [2010.02.22 09:06:42 | 000,009,216 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter)

DRV - [2009.07.14 01:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)

DRV - [2009.05.13 12:26:26 | 000,013,720 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DD 11 4C 27 20 D0 CB 01  [binary data]

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{719AFD7A-89B2-48DB-9C8D-495A78555DB0}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Search the web"

FF - prefs.js..browser.search.order.1: "Search the web"

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"

FF - prefs.js..browser.search.selectedEngine: "Search the web"

FF - prefs.js..extensions.enabledItems: {D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}:1.0

FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94

FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94

FF - prefs.js..extensions.enabledItems: ClickPotatoLite@ClickPotatoLite.com:10.0.659.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:4.3

FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3

FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

 

FF - user.js..browser.search.selectedEngine: "Search the web"

FF - user.js..browser.search.order.1: "Search the web"

FF - user.js..browser.search.defaultenginename: "Search the web"

FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Josefa\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\crossriderapp498@crossrider.com: C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.26 16:44:27 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.19 11:08:48 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.11 20:17:39 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components [2011.03.22 12:34:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\Mozilla Sunbird\plugins [2012.03.11 20:17:39 | 000,000,000 | ---D | M]

 

[2011.03.11 13:29:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Extensions

[2011.03.11 13:29:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}

[2012.03.23 00:45:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions

[2012.01.02 20:12:28 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.02.04 02:03:47 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}

[2012.02.26 16:15:11 | 000,000,000 | ---D | M] (toolplugin) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\welcome@toolmin.com

[2011.03.11 13:29:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Sunbird\Profiles\ganib2kj.default\extensions

[2012.03.15 20:32:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2012.02.28 18:13:13 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

() (No name found) -- C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI

[2012.02.19 11:08:48 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.01.06 19:32:22 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.01.06 19:32:22 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.01.06 19:32:22 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.01.06 19:32:22 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.26 16:15:11 | 000,000,158 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search the web.src

[2012.01.06 19:32:22 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.01.06 19:32:22 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2012.03.16 02:46:06 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Users\Josefa\AppData\Roaming\toolplugin\toolbar.dll ()

O3 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)

O4 - HKLM..\Run: [NUSB3MON] C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)

O4 - HKLM..\Run: [PDFPrint] E:\Program Files\PDF24\pdf24.exe (Geek Software GmbH)

O4 - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)

O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe (Wistron Corp.)

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [Akamai NetSession Interface] C:\Users\Josefa\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [Facebook Update] C:\Users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [K3aRyluP6SiCkoR] C:\Users\Josefa\AppData\Roaming\flint4ytw.exe File not found

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [MediaGet2] C:\Users\Josefa\AppData\Local\MediaGet2\mediaget.exe --minimized File not found

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - Startup: C:\Users\Josefa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Josefa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O13 - gopher Prefix: missing

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab (DLM Control)

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.158.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{077ED5A6-0BB6-4BCC-A1B2-0AE4632AF9B1}: NameServer = 194.48.124.202 194.48.124.200

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6A0BAC69-0D12-4FCE-B866-3F442DFF6449}: DhcpNameServer = 10.158.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{94AC04BF-4F2A-4D16-82A5-DCECFEBA9989}: DhcpNameServer = 193.170.110.64

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\Windows\system32\nvinit.dll) - C:\Windows\System32\nvinit.dll (NVIDIA Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: Shell - (C:\Users\Josefa\AppData\Roaming\flint4ytw.exe) -  File not found

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: UserInit - (C:\Users\Josefa\AppData\Roaming\flint4ytw.exe) -  File not found

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: UserInit - (C:\WINDOWS\System32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.02.19 13:55:07 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]

O33 - MountPoints2\{0cceed82-11fc-11e1-b70a-485d604687f4}\Shell - "" = AutoRun

O33 - MountPoints2\{0cceed82-11fc-11e1-b70a-485d604687f4}\Shell\AutoRun\command - "" = IomegaEncryptionSetup v1.3.exe

O33 - MountPoints2\{98cba69b-3c12-11e0-b022-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{98cba69b-3c12-11e0-b022-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Welcome.exe

O33 - MountPoints2\{ce1ff176-f671-11e0-8ea2-00262dc41cd4}\Shell - "" = AutoRun

O33 - MountPoints2\{ce1ff176-f671-11e0-8ea2-00262dc41cd4}\Shell\AutoRun\command - "" = F:\Autorun.exe

O33 - MountPoints2\F\Shell - "" = AutoRun

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Autorun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: HotkeyApp - hkey= - key= - C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)

MsConfig - StartUpReg: LMgrOSD - hkey= - key= -  File not found

MsConfig - StartUpReg: LMgrVolOSD - hkey= - key= - C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.)

MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)

MsConfig - StartUpReg: SearchSettings - hkey= - key= - C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)

MsConfig - State: "startup" - 2

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: MsMpSvc - C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: MsMpSvc - C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {170BC2CF-4B8F-E633-860B-5BC03CE3CEF7} - Microsoft Windows Media Player

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\System32\Microsoft

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45394181-28A0-ADC4-1E17-4CE49025A11C} - Microsoft Windows Media Player 12.0

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {695CE607-29F4-8EA4-8A51-DCF625C4AC57} - .NET Framework

ActiveX: {6BE484BB-1F36-551F-2F1D-C43808D3F1AF} - Internet Explorer

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - C:\Windows\System32\Microsoft

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {FB0EB00B-0E98-DD15-F6D5-7E9BBF41C28E} - Java (Sun)

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.03.23 22:19:22 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.03.23 00:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot

[2012.03.23 00:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\pdfforge Toolbar

[2012.03.23 00:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater

[2012.03.18 08:25:31 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.03.18 08:25:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.03.18 08:25:30 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.03.16 02:46:02 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.03.15 19:05:46 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Roaming\Malwarebytes

[2012.03.15 19:05:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.03.11 20:17:02 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.03.11 01:32:25 | 000,000,000 | ---D | C] -- C:\Users\Josefa\Desktop\BSP Buch

[2012.03.09 22:08:27 | 000,000,000 | ---D | C] -- C:\Users\Josefa\Desktop\Panorama

[2012.03.03 17:18:09 | 000,000,000 | ---D | C] -- C:\Users\Josefa\Documents\ZPS14

[2012.03.03 17:18:08 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Roaming\Zoner

[2012.03.03 17:18:08 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Local\Zoner

[2012.03.03 17:18:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Zoner

[2012.03.03 17:17:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zoner Photo Studio 14

[2012.03.03 17:17:39 | 000,000,000 | ---D | C] -- C:\Program Files\Zoner

[2012.02.28 18:13:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2012.02.28 18:13:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2012.02.26 18:50:35 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Local\DDMSettings

[2012.02.26 16:15:07 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Roaming\toolplugin

[2012.02.24 16:48:18 | 000,000,000 | ---D | C] -- C:\Users\Josefa\Desktop\Originals

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.03.24 18:08:01 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000UA.job

[2012.03.24 18:08:00 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000Core.job

[2012.03.24 16:50:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.03.24 07:44:23 | 000,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLet.DAT

[2012.03.23 23:33:21 | 000,722,736 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.03.23 23:33:21 | 000,661,510 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.03.23 23:33:21 | 000,157,244 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.03.23 23:33:21 | 000,129,150 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.03.23 00:45:12 | 000,013,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.23 00:45:12 | 000,013,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.23 00:37:28 | 2558,595,072 | -HS- | M] () -- C:\hiberfil.sys

[2012.03.22 19:55:45 | 000,485,016 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.03.21 21:30:39 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.18 06:24:12 | 000,002,243 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012.03.16 02:46:06 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

[2012.03.15 18:52:12 | 000,000,000 | ---- | M] () -- C:\Windows\ViewNX2.INI

[2012.03.15 18:48:11 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2012.03.15 18:48:11 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2012.03.13 16:10:56 | 313,256,741 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2012.03.12 12:39:39 | 001,711,984 | ---- | M] () -- C:\Users\Josefa\Desktop\Leno_individuell.pdf

[2012.03.12 12:39:08 | 002,513,666 | ---- | M] () -- C:\Users\Josefa\Desktop\brettstapelbau.pdf

[2012.03.11 02:27:16 | 000,000,600 | ---- | M] () -- C:\Users\Josefa\AppData\Local\PUTTY.RND

[2012.03.10 23:39:27 | 000,000,855 | ---- | M] () -- C:\Users\Public\Desktop\FileZilla Client.lnk

[2012.03.10 18:08:38 | 000,042,733 | ---- | M] () -- C:\Users\Josefa\Desktop\post2.jpg

[2012.03.10 17:34:18 | 001,647,628 | ---- | M] () -- C:\Users\Josefa\Desktop\DSC_0028x.jpg

[2012.03.10 13:26:47 | 000,032,649 | ---- | M] () -- C:\Users\Josefa\Desktop\post.jpg

[2012.03.06 22:08:49 | 026,774,240 | ---- | M] () -- C:\Users\Josefa\Desktop\Technische Mappe_Stand 09.2011_druck.pdf

[2012.03.03 20:03:34 | 000,002,726 | ---- | M] () -- C:\Users\Josefa\Desktop\P1020527.JPG

[2012.03.03 20:03:25 | 000,002,556 | ---- | M] () -- C:\Users\Josefa\Desktop\P1020528.JPG

[2012.03.03 17:17:51 | 000,002,035 | ---- | M] () -- C:\Users\Public\Desktop\Zoner Photo Studio 14 FREE.lnk

[2012.03.02 08:27:55 | 000,001,023 | ---- | M] () -- C:\Users\Josefa\Desktop\Dropbox.lnk

[2012.03.02 08:27:55 | 000,001,003 | ---- | M] () -- C:\Users\Josefa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

[2012.02.28 18:13:03 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.02.26 16:44:37 | 000,001,593 | ---- | M] () -- C:\Users\Josefa\Desktop\DivX Movies.lnk

[2012.02.26 16:43:49 | 000,001,086 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk

[2012.02.24 16:49:42 | 001,751,990 | ---- | M] () -- C:\Users\Josefa\Desktop\DSC_0309.JPG

 
 ========== Files Created - No Company Name ==========

 

[2012.03.18 08:25:31 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.15 18:52:12 | 000,000,000 | ---- | C] () -- C:\Windows\ViewNX2.INI

[2012.03.15 18:48:11 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS

[2012.03.15 18:48:11 | 000,000,000 | RHS- | C] () -- C:\IO.SYS

[2012.03.12 12:39:39 | 001,711,984 | ---- | C] () -- C:\Users\Josefa\Desktop\Leno_individuell.pdf

[2012.03.12 12:39:08 | 002,513,666 | ---- | C] () -- C:\Users\Josefa\Desktop\brettstapelbau.pdf

[2012.03.10 23:39:27 | 000,000,855 | ---- | C] () -- C:\Users\Public\Desktop\FileZilla Client.lnk

[2012.03.10 18:08:36 | 000,042,733 | ---- | C] () -- C:\Users\Josefa\Desktop\post2.jpg

[2012.03.10 17:33:57 | 001,647,628 | ---- | C] () -- C:\Users\Josefa\Desktop\DSC_0028x.jpg

[2012.03.10 13:26:44 | 000,032,649 | ---- | C] () -- C:\Users\Josefa\Desktop\post.jpg

[2012.03.06 22:08:47 | 026,774,240 | ---- | C] () -- C:\Users\Josefa\Desktop\Technische Mappe_Stand 09.2011_druck.pdf

[2012.03.03 20:03:33 | 000,002,726 | ---- | C] () -- C:\Users\Josefa\Desktop\P1020527.JPG

[2012.03.03 20:03:24 | 000,002,556 | ---- | C] () -- C:\Users\Josefa\Desktop\P1020528.JPG

[2012.03.03 17:17:51 | 000,002,035 | ---- | C] () -- C:\Users\Public\Desktop\Zoner Photo Studio 14 FREE.lnk

[2012.02.26 16:44:37 | 000,001,593 | ---- | C] () -- C:\Users\Josefa\Desktop\DivX Movies.lnk

[2012.02.26 16:43:49 | 000,001,086 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk

[2012.02.24 16:46:06 | 001,751,990 | ---- | C] () -- C:\Users\Josefa\Desktop\DSC_0309.JPG

[2012.02.09 11:54:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Rock

[2012.02.09 11:54:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Robot

[2012.02.09 11:54:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Reverb

[2012.02.09 11:54:12 | 000,000,268 | RH-- | C] () -- C:\Users\Josefa\AppData\Roaming\Repeat Routines

[2012.02.09 11:54:12 | 000,000,268 | RH-- | C] () -- C:\Users\Josefa\AppData\Roaming\Receipts

[2012.02.09 11:54:12 | 000,000,268 | RH-- | C] () -- C:\Users\Josefa\AppData\Roaming\Radio Sounds

[2012.02.09 11:54:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT

[2012.02.09 11:54:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT

[2012.02.09 11:54:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT

[2012.02.09 11:54:12 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Sound Effects

[2012.02.09 11:54:12 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Smooth Strings

[2012.02.09 11:54:12 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Services

[2011.08.13 13:31:15 | 000,065,793 | ---- | C] () -- C:\Windows\System32\esfwad.bin

[2011.05.14 15:25:54 | 000,000,600 | ---- | C] () -- C:\Users\Josefa\AppData\Local\PUTTY.RND

[2011.04.23 19:58:29 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe

[2011.04.23 19:56:52 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2011.03.30 18:17:59 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll

[2011.02.21 13:11:34 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2011.02.19 11:24:19 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe

[2011.02.19 11:24:18 | 000,149,504 | ---- | C] () -- C:\Windows\unwise32_setup.exe

[2011.02.19 11:20:11 | 000,451,072 | ---- | C] () -- C:\Windows\System32\ISSRemoveSP.exe

[2011.02.19 11:13:16 | 000,002,204 | R--- | C] () -- C:\Windows\System32\drivers\RtPCEE3.DAT

[2011.02.11 18:10:50 | 000,874,048 | ---- | C] () -- C:\Windows\System32\igkrng575.bin

[2011.02.11 17:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll

[2010.10.27 04:21:58 | 000,416,865 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin

[2010.10.27 04:21:58 | 000,408,168 | ---- | C] () -- C:\Windows\System32\easyUpdatusAPIU.dll

[2010.08.25 19:30:02 | 000,127,868 | ---- | C] () -- C:\Windows\System32\igcompkrng575.bin

[2010.08.25 19:30:00 | 000,104,796 | ---- | C] () -- C:\Windows\System32\igfcg575m.bin

[2010.08.25 18:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config

[2010.06.08 14:19:24 | 000,692,224 | ---- | C] () -- C:\Windows\System32\libeay32.dll

[2010.06.08 14:19:24 | 000,151,552 | ---- | C] () -- C:\Windows\System32\ssleay32.dll

[2010.04.20 15:31:43 | 000,936,832 | ---- | C] () -- C:\Windows\System32\M2ElevatedCalls.dll

 
 ========== LOP Check ==========

 

[2012.03.22 20:05:10 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\cadwork

[2011.09.09 16:40:34 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent

[2011.09.09 16:53:58 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent_Artlantis3

[2011.08.31 10:22:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Artisteer

[2011.04.16 16:18:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Autodesk

[2011.11.19 15:26:23 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Azureus

[2011.10.15 10:07:22 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\cadwork

[2012.03.23 00:44:33 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Dropbox

[2012.01.02 20:12:39 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoft

[2012.01.02 20:12:28 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.08.13 14:35:43 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\EPSON

[2012.03.11 14:24:00 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\FileZilla

[2011.03.15 21:25:10 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Graphisoft

[2011.04.26 19:18:59 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\JSGSoft.com

[2012.02.09 11:56:35 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Nikon

[2012.02.26 16:15:11 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\toolplugin

[2012.03.03 17:18:08 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Zoner

[2012.03.24 18:08:00 | 000,000,910 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000Core.job

[2012.03.24 18:08:01 | 000,000,932 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000UA.job

[2012.03.16 01:08:29 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.09.09 16:40:34 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent

[2011.09.09 16:53:58 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent_Artlantis3

[2011.03.04 11:34:53 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Adobe

[2011.08.31 10:22:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Apple Computer

[2011.08.31 10:22:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Artisteer

[2011.04.16 16:18:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Autodesk

[2011.11.19 15:26:23 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Azureus

[2011.10.15 10:07:22 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\cadwork

[2011.09.09 19:55:17 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DivX

[2011.02.19 14:27:52 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Download Manager

[2012.03.23 00:44:33 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Dropbox

[2012.01.02 20:12:39 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoft

[2012.01.02 20:12:28 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.08.13 14:35:43 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\EPSON

[2012.03.11 14:24:00 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\FileZilla

[2011.03.15 21:25:10 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Graphisoft

[2011.02.19 11:09:01 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Identities

[2011.02.19 11:11:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\InstallShield

[2011.02.19 11:26:30 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Intel Corporation

[2011.04.26 19:18:59 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\JSGSoft.com

[2011.02.21 11:51:21 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Macromedia

[2012.03.15 19:05:46 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Malwarebytes

[2009.07.14 09:56:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Media Center Programs

[2012.02.08 15:18:16 | 000,000,000 | --SD | M] -- C:\Users\Josefa\AppData\Roaming\Microsoft

[2011.03.11 13:29:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Mozilla

[2012.02.09 11:56:35 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Nikon

[2012.03.24 19:31:32 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Skype

[2011.07.14 11:20:55 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\skypePM

[2012.02.26 16:15:11 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\toolplugin

[2011.04.17 09:30:16 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\WinRAR

[2012.03.03 17:18:08 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Zoner

 
 < %APPDATA%\*.exe /s >

[2011.11.19 14:00:36 | 000,310,208 | ---- | M] (Georgia Institute of Technology) -- C:\Users\Josefa\AppData\Roaming\Azureus\plugins\mlab\ShaperProbeC.exe

[2012.02.15 00:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe

[2012.02.15 00:03:44 | 000,174,752 | ---- | M] (Dropbox, Inc.) -- C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Uninstall.exe

[2011.06.08 22:23:12 | 000,001,078 | R--- | M] () -- C:\Users\Josefa\AppData\Roaming\Microsoft\Installer\{0B15A52D-55B6-457A-8440-F0CE3B2FCDD1}\_2228C2973498FD04F23451.exe

[2011.06.08 22:23:12 | 000,001,078 | R--- | M] () -- C:\Users\Josefa\AppData\Roaming\Microsoft\Installer\{0B15A52D-55B6-457A-8440-F0CE3B2FCDD1}\_6FEFF9B68218417F98F549.exe

[2012.02.09 11:55:09 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Josefa\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

[2011.07.13 03:55:05 | 002,237,440 | R--- | M] (OldTimer Tools) -- C:\OTLPE.exe

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll

[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2010.03.03 19:33:26 | 000,435,736 | ---- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\Windows\System32\drivers\iaStor.sys

[2010.03.03 19:33:26 | 000,435,736 | ---- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_e8a55be84650e755\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys

[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys

[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys

[2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys

[2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys

[2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll

[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll

[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys

[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys

[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys

[2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys

[2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys

[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys

[2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll

[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll

[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe

[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe

[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

[2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2011.04.18 12:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\drivers\MpNWMon.sys

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2009.07.14 02:15:21 | 000,462,848 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\FirewallAPI.dll

[2009.07.14 02:15:36 | 000,226,816 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\LocationApi.dll
 

< End of report >

--- --- ---

Smiler12321

25.03.2012 00:54

Extras.Txt

OTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 24.03.2012 19:34:51 - Run 1

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Josefa\Downloads

 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,18 Gb Total Physical Memory | 1,91 Gb Available Physical Memory | 60,20% Memory free

6,35 Gb Paging File | 4,95 Gb Available in Paging File | 77,93% Paging File free

Paging file location(s): c:\pagefile.sys 3253 5000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 97,56 Gb Total Space | 32,85 Gb Free Space | 33,67% Space Free | Partition Type: NTFS

Drive E: | 498,51 Gb Total Space | 138,68 Gb Free Space | 27,82% Space Free | Partition Type: NTFS

 

Computer Name: JR_NOTEBOOK | User Name: Josefa | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{0079F91A-DC72-43AF-8DB0-4A229BE03097}" = cadwork

"{014CF29F-D3C0-4303-B3E9-CA10AD1E6085}" = Dlubal-Anwendungen RSTAB

"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware

"{07B22FB1-6A1E-41E7-8323-A9CA716026ED}" = bob internet

"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended

"{0B15A52D-55B6-457A-8440-F0CE3B2FCDD1}" = RuckZuck

"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack

"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode

"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 26

"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack

"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module

"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver

"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{5783F2D7-9001-0407-0002-0060B0CE6BBA}" = AutoCAD 2011 - Deutsch

"{5783F2D7-9001-0407-1002-0060B0CE6BBA}" = AutoCAD 2011 Language Pack - Deutsch

"{5E1375CB-6792-4464-8715-CC3EC83D48FA}" = VirtualDJ Home FREE

"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module

"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{782AE8DA-30DA-44bd-BA9A-9F23B8A4AC79}" = pdfforge Toolbar v5.1

"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159

"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 3.3.0

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010

"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010

"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010

"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010

"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010

"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010

"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010

"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PRJPROR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0407-0000-0000000FF1CE}_Office14.VISIOR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PRJPROR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0409-0000-0000000FF1CE}_Office14.VISIOR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PRJPROR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-040C-0000-0000000FF1CE}_Office14.VISIOR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010

"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PRJPROR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUSR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-001F-0410-0000-0000000FF1CE}_Office14.VISIOR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010

"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PRJPROR_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-002C-0407-0000-0000000FF1CE}_Office14.VISIOR_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010

"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2010

"{90140000-0054-0407-0000-0000000FF1CE}_Office14.VISIOR_{1FEAC070-BB09-4055-9BD0-48CF52023F92}" = Microsoft Office 2010 Language Pack Service Pack 1 (SP1)

"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010

"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PRJPROR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-006E-0407-0000-0000000FF1CE}_Office14.VISIOR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010

"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{90140000-00B4-0407-0000-0000000FF1CE}" = Microsoft Office Project MUI (German) 2010

"{90140000-00B4-0407-0000-0000000FF1CE}_Office14.PRJPROR_{86D01646-1942-4253-B11F-68F5ED259B17}" = Microsoft Project 2010 Service Pack 1 (SP1)

"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010

"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010

"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)

"{91140000-003B-0000-0000-0000000FF1CE}" = Microsoft Office Project Professional 2010

"{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}" = Microsoft Project 2010 Service Pack 1 (SP1)

"{91140000-0057-0000-0000-0000000FF1CE}" = Microsoft Office Visio 2010

"{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}" = Microsoft Visio 2010 Service Pack 1 (SP1)

"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195

"{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}" = FARO LS 1.1.406.58

"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader

"{975951E7-14D0-49AF-A630-89680D12D7F6}" = Autodesk Material Library 2011 Medium Image library

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9D3D8C60-A55F-4fed-B2B9-173F09590E16}" = REALTEK Wireless LAN Driver

"{9DEABCB6-B759-4D52-92F8-51B34A2B4D40}" = Autodesk Material Library 2011

"{A49BDCBE-590E-43A6-AB77-7C40E499B7C1}" = Autodesk Design Review 2012

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch

"{B014EE44-9197-4513-9613-71E6EB1B514E}" = Nikon Message Center 2

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call

"{B860298B-CE03-4DE2-B92E-422F2C20A2D8}_is1" = PDF-XChange Lite 4

"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver

"{CD1E078C-A6B9-47DA-B035-6365C85C7832}" = Autodesk Material Library 2011 Base Image library

"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C0}" = WinZip 15.0

"{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager

"{DDD62492-32A7-412B-8AF1-2CF032AD42E3}" = ViewNX 2

"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module

"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support

"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center

"001FFF1FFF14FF00FF0901F01F02F000-R1" = ArchiCAD 14 AUT

"8461-7759-5462-8226" = Vuze

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Akamai" = Akamai NetSession Interface Service

"Artisteer 3" = Artisteer 3

"Artlantis Studio 3" = Artlantis Studio 3.0.6

"AutoCAD 2011 - Deutsch" = AutoCAD 2011 - Deutsch

"Autodesk Design Review 2012" = Autodesk Design Review 2012

"bob internet" = bob internet

"cadwork" = cadwork

"DivX Setup" = DivX-Setup

"EPSON Scanner" = EPSON Scan

"ESET Online Scanner" = ESET Online Scanner v3

"FileZilla Client" = FileZilla Client 3.5.0

"FormelBaska 3_is1" = FormelBaska 3

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.15.1228

"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000

"Malz++Kassner CAD6 Pro" = Malz++Kassner CAD6 Studio Release 2011

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Microsoft Security Client" = Microsoft Security Essentials

"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)

"NVIDIA Display Control Panel" = NVIDIA Display Control Panel

"NVIDIA Drivers" = NVIDIA Drivers

"NVIDIA.Updatus" = NVIDIA Updatus

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"Office14.PRJPROR" = Microsoft Project Professional 2010

"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010

"Office14.VISIOR" = Microsoft Visio Professional 2010

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"toolplugin" = toolplugin

"Vuze_Remote Toolbar" = Vuze Remote Toolbar

"WinRAR archiver" = WinRAR 4.00 (32-Bit)

"X10Hardware" = X10 Hardware(TM)

"YTdetect" = Yahoo! Detect

"ZonerPhotoStudio14_EN_is1" = Zoner Photo Studio 14 FREE

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Akamai" = Akamai NetSession Interface

"Dropbox" = Dropbox

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 18.03.2012 01:33:26 | Computer Name = JR_Notebook | Source = Windows Search Service | ID = 7040

Description = 

 

Error - 18.03.2012 01:33:26 | Computer Name = JR_Notebook | Source = Windows Search Service | ID = 7042

Description = 

 

Error - 22.03.2012 00:26:18 | Computer Name = JR_Notebook | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: daemonu.exe, Version: 2.0.2.414, 

Zeitstempel: 0x4cc7e940  Name des fehlerhaften Moduls: daemonu.exe, Version: 2.0.2.414,

 Zeitstempel: 0x4cc7e940  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00047f51  ID des fehlerhaften

 Prozesses: 0x794  Startzeit der fehlerhaften Anwendung: 0x01cd07e3ec0fe0f5  Pfad der

 fehlerhaften Anwendung: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Berichtskennung:

 2b3ba961-73d7-11e1-98bf-485d604687f4

 

Error - 21.03.2012 16:33:44 | Computer Name = JR_Notebook | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: daemonu.exe, Version: 2.0.2.414, 

Zeitstempel: 0x4cc7e940  Name des fehlerhaften Moduls: daemonu.exe, Version: 2.0.2.414,

 Zeitstempel: 0x4cc7e940  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00047f51  ID des fehlerhaften

 Prozesses: 0xf08  Startzeit der fehlerhaften Anwendung: 0x01cd07a1e8d53dd7  Pfad der

 fehlerhaften Anwendung: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Berichtskennung:

 26ef4804-7395-11e1-abaa-00262dc41cd4

 

Error - 21.03.2012 18:12:26 | Computer Name = JR_Notebook | Source = SideBySide | ID = 16842824

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft

 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program

 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element

 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements

 angezeigt, das von dieser Windows-Version nicht unterstützt wird.

 

Error - 22.03.2012 14:47:35 | Computer Name = JR_Notebook | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: daemonu.exe, Version: 2.0.2.414, 

Zeitstempel: 0x4cc7e940  Name des fehlerhaften Moduls: daemonu.exe, Version: 2.0.2.414,

 Zeitstempel: 0x4cc7e940  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00047f51  ID des fehlerhaften

 Prozesses: 0xbcc  Startzeit der fehlerhaften Anwendung: 0x01cd085c3df49b59  Pfad der

 fehlerhaften Anwendung: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Berichtskennung:

 7ca23ad6-744f-11e1-a29d-485d604687f4

 

Error - 22.03.2012 14:57:55 | Computer Name = JR_Notebook | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: daemonu.exe, Version: 2.0.2.414, 

Zeitstempel: 0x4cc7e940  Name des fehlerhaften Moduls: daemonu.exe, Version: 2.0.2.414,

 Zeitstempel: 0x4cc7e940  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00047f51  ID des fehlerhaften

 Prozesses: 0x1e4  Startzeit der fehlerhaften Anwendung: 0x01cd085dae157653  Pfad der

 fehlerhaften Anwendung: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Berichtskennung:

 ee3ff1fc-7450-11e1-9bb2-00262dc41cd4

 

Error - 22.03.2012 16:10:12 | Computer Name = JR_Notebook | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: daemonu.exe, Version: 2.0.2.414, 

Zeitstempel: 0x4cc7e940  Name des fehlerhaften Moduls: daemonu.exe, Version: 2.0.2.414,

 Zeitstempel: 0x4cc7e940  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00047f51  ID des fehlerhaften

 Prozesses: 0x414  Startzeit der fehlerhaften Anwendung: 0x01cd0867c784c22e  Pfad der

 fehlerhaften Anwendung: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Berichtskennung:

 07787e31-745b-11e1-b3b0-00262dc41cd4

 

Error - 22.03.2012 17:11:12 | Computer Name = JR_Notebook | Source = SideBySide | ID = 16842824

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft

 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program

 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element

 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements

 angezeigt, das von dieser Windows-Version nicht unterstützt wird.

 

Error - 22.03.2012 19:39:56 | Computer Name = JR_Notebook | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: daemonu.exe, Version: 2.0.2.414, 

Zeitstempel: 0x4cc7e940  Name des fehlerhaften Moduls: daemonu.exe, Version: 2.0.2.414,

 Zeitstempel: 0x4cc7e940  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00047f51  ID des fehlerhaften

 Prozesses: 0x115c  Startzeit der fehlerhaften Anwendung: 0x01cd08851327a676  Pfad der

 fehlerhaften Anwendung: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

Berichtskennung:

 5468ca31-7478-11e1-8dc3-00262dc41cd4

 

[ Media Center Events ]

Error - 13.01.2012 19:51:36 | Computer Name = JR_Notebook | Source = MCUpdate | ID = 0

Description = 00:51:36 - Fehler beim Herstellen der Internetverbindung.  00:51:36 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 13.01.2012 19:51:41 | Computer Name = JR_Notebook | Source = MCUpdate | ID = 0

Description = 00:51:41 - Fehler beim Herstellen der Internetverbindung.  00:51:41 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 14.01.2012 19:10:38 | Computer Name = JR_Notebook | Source = MCUpdate | ID = 0

Description = 00:10:38 - Fehler beim Herstellen der Internetverbindung.  00:10:38 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 14.01.2012 19:11:13 | Computer Name = JR_Notebook | Source = MCUpdate | ID = 0

Description = 00:10:44 - Fehler beim Herstellen der Internetverbindung.  00:10:44 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 20.01.2012 13:20:57 | Computer Name = JR_Notebook | Source = MCUpdate | ID = 0

Description = 18:20:57 - Fehler beim Herstellen der Internetverbindung.  18:20:57 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 20.01.2012 13:21:07 | Computer Name = JR_Notebook | Source = MCUpdate | ID = 0

Description = 18:21:03 - Fehler beim Herstellen der Internetverbindung.  18:21:03 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 25.01.2012 05:26:59 | Computer Name = JR_Notebook | Source = MCUpdate | ID = 0

Description = 10:26:59 - Fehler beim Herstellen der Internetverbindung.  10:26:59 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 25.01.2012 05:27:09 | Computer Name = JR_Notebook | Source = MCUpdate | ID = 0

Description = 10:27:04 - Fehler beim Herstellen der Internetverbindung.  10:27:04 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 28.02.2012 13:03:42 | Computer Name = JR_Notebook | Source = MCUpdate | ID = 0

Description = 18:03:42 - Fehler beim Herstellen der Internetverbindung.  18:03:42 

-     Serververbindung konnte nicht hergestellt werden..  

 

Error - 28.02.2012 13:03:51 | Computer Name = JR_Notebook | Source = MCUpdate | ID = 0

Description = 18:03:47 - Fehler beim Herstellen der Internetverbindung.  18:03:47 

-     Serververbindung konnte nicht hergestellt werden..  

 

[ System Events ]

Error - 03.02.2012 20:51:16 | Computer Name = JR_Notebook | Source = DCOM | ID = 10016

Description = 

 

Error - 03.02.2012 21:22:56 | Computer Name = JR_Notebook | Source = EventLog | ID = 6008

Description = Das System wurde zuvor am ?04.?02.?2012 um 02:18:16 unerwartet heruntergefahren.

 

Error - 03.02.2012 21:20:07 | Computer Name = JR_Notebook | Source = Microsoft-Windows-Kernel-Power | ID = 86

Description = Das System wurde aufgrund eines kritischen thermischen Ereignisses

 heruntergefahren.                Zeit für das Herunterfahren = 2012-02-04T01:20:07.324820800Z
 

              ACPI-Thermozone = ACPI\ThermalZone\TZS0                _CRT = 359K

 

Error - 03.02.2012 21:20:07 | Computer Name = JR_Notebook | Source = Microsoft-Windows-Kernel-Power | ID = 86

Description = Das System wurde aufgrund eines kritischen thermischen Ereignisses

 heruntergefahren.                Zeit für das Herunterfahren = 2012-02-04T01:20:07.356020800Z
 

              ACPI-Thermozone = ACPI\ThermalZone\TZS0                _CRT = 359K

 

Error - 03.02.2012 21:20:09 | Computer Name = JR_Notebook | Source = Microsoft-Windows-Kernel-Power | ID = 86

Description = Das System wurde aufgrund eines kritischen thermischen Ereignisses

 heruntergefahren.                Zeit für das Herunterfahren = 2012-02-04T01:20:09.150024000Z
 

              ACPI-Thermozone = ACPI\ThermalZone\TZS0                _CRT = 359K

 

Error - 03.02.2012 21:24:08 | Computer Name = JR_Notebook | Source = DCOM | ID = 10016

Description = 

 

Error - 03.02.2012 21:25:58 | Computer Name = JR_Notebook | Source = Service Control Manager | ID = 7034

Description = Dienst "NVIDIA Update Service Daemon" wurde unerwartet beendet. Dies

 ist bereits 1 Mal passiert.

 

Error - 08.02.2012 06:14:49 | Computer Name = JR_Notebook | Source = Service Control Manager | ID = 7011

Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung

 von Dienst nvsvc erreicht.

 

Error - 09.02.2012 06:47:18 | Computer Name = JR_Notebook | Source = Service Control Manager | ID = 7011

Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung

 von Dienst nvsvc erreicht.

 

Error - 09.02.2012 06:47:18 | Computer Name = JR_Notebook | Source = Service Control Manager | ID = 7011

Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung

 von Dienst Netman erreicht.

 

 

< End of report >

--- --- ---

cosinus

25.03.2012 14:52

Zitat:

O2 - BHO: (DivX Plus Web Player HTML5 <video>)

Sagmal gehörst du auch zur der Fraktion, die sich Serien und Kinofilme über dubiose Portale anschaut?
Wenn ja: in Zukunft Finger weg, diese illegalen Portale verbreiten Malware und wenn du in Zukunft malwarefrei sein wilst, musst du auf legale Alternativen ausweichen und auf solche riskanten Streamingseiten verzichten!
Gerade solche Streamingseiten sind für die aktuelle Welle der Erpresserschädlinge verantwortlich, die Windows blockieren und 50 oder 100 EUR erpressen wollen!!

Smiler12321

25.03.2012 16:35

hmm ja ... ich merks mir... :daumenhoc

muss ich noch iwas machen an meinem computer? und wie mach ich das mit den icons dass das wieder geht...?

cosinus

25.03.2012 17:47

Ja, deinstallier DivX mal, für die allermeisten legalen Sachen braucht man das nicht :pfeiff:
Mach dann ein neues OTL-Log wie o.g. beschrieben

Smiler12321

25.03.2012 19:22

DivX gelöscht, und neues OTL file:

OTL Logfile:

Code:

OTL logfile created on: 25.03.2012 19:44:01 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Josefa\Downloads

 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,18 Gb Total Physical Memory | 1,41 Gb Available Physical Memory | 44,38% Memory free

6,35 Gb Paging File | 4,49 Gb Available in Paging File | 70,66% Paging File free

Paging file location(s): c:\pagefile.sys 3253 5000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 97,56 Gb Total Space | 32,82 Gb Free Space | 33,64% Space Free | Partition Type: NTFS

Drive E: | 498,51 Gb Total Space | 138,50 Gb Free Space | 27,78% Space Free | Partition Type: NTFS

 

Computer Name: JR_NOTEBOOK | User Name: Josefa | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.03.24 20:29:19 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Josefa\Downloads\OTL.exe

PRC - [2012.03.13 06:37:52 | 003,331,872 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\Josefa\AppData\Local\Akamai\netsession_win.exe

PRC - [2012.03.04 23:48:40 | 000,934,752 | ---- | M] (Spigot, Inc.) -- C:\Programme\Common Files\Spigot\Search Settings\SearchSettings.exe

PRC - [2012.03.04 23:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe

PRC - [2012.02.15 01:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2012.01.13 15:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.01.13 15:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.07.07 09:08:30 | 000,216,064 | ---- | M] (Geek Software GmbH) -- E:\Program Files\PDF24\pdf24.exe

PRC - [2011.06.15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe

PRC - [2011.04.27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe

PRC - [2011.04.27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe

PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.12.20 16:31:00 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Programme\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

PRC - [2010.12.20 16:30:31 | 001,493,608 | ---- | M] (Realtek Semiconductor) -- C:\Programme\Realtek\Audio\HDA\RtHDVBg.exe

PRC - [2010.12.20 16:30:30 | 002,320,920 | R--- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

PRC - [2010.12.20 16:30:27 | 000,268,824 | R--- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2010.11.20 14:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe

PRC - [2010.10.27 04:59:10 | 000,236,136 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2010.06.21 14:53:44 | 000,436,264 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\WButton.exe

PRC - [2010.03.03 21:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

PRC - [2010.03.03 21:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

PRC - [2009.11.07 04:46:52 | 000,020,480 | ---- | M] (X10) -- C:\Programme\Common Files\X10\Common\X10nets.exe

PRC - [2009.10.22 18:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\WisLMSvc.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.02.19 00:30:16 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\5be773440afa1e1f565f9021d8fd9730\IAStorUtil.ni.dll

MOD - [2012.02.19 00:24:59 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\42ae8760f0a74ab774e82a64368aa1f6\System.Web.ni.dll

MOD - [2012.02.19 00:24:53 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\a1c4a635721f85bef0ea4194b888b871\System.Runtime.Remoting.ni.dll

MOD - [2012.02.19 00:24:29 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll

MOD - [2012.02.19 00:24:23 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll

MOD - [2012.02.19 00:24:11 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\47b9e7f070271ff50f988f75ea68fa3e\WindowsBase.ni.dll

MOD - [2012.02.19 00:24:07 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll

MOD - [2012.02.19 00:24:02 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll

MOD - [2012.02.19 00:24:01 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll

MOD - [2012.01.08 15:41:12 | 000,093,696 | ---- | M] () -- E:\Program Files\FileZilla FTP Client\fzshellext.dll

MOD - [2011.10.15 16:20:32 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll

MOD - [2011.03.17 01:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

MOD - [2010.11.13 01:19:04 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2009.07.14 10:47:11 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.03.04 23:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Programme\Application Updater\ApplicationUpdater.exe -- (Application Updater)

SRV - [2012.02.15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.02.10 22:30:45 | 003,340,064 | ---- | M] () [Auto | Running] -- c:\program files\common files\akamai/netsession_win_7de0ed9.dll -- (Akamai)

SRV - [2012.01.13 15:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.06.12 11:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)

SRV - [2011.04.27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)

SRV - [2011.04.27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)

SRV - [2011.02.19 15:08:43 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2011.02.19 13:36:06 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2010.12.20 16:30:30 | 002,320,920 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)

SRV - [2010.12.20 16:30:27 | 000,268,824 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)

SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2010.10.27 04:59:10 | 000,236,136 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2010.10.27 04:57:22 | 001,620,584 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2010.03.03 21:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)

SRV - [2010.01.09 22:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2010.01.09 22:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

SRV - [2009.11.07 04:46:52 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)

SRV - [2009.10.22 18:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [On_Demand | Running] -- C:\Programme\Launch Manager\WisLMSvc.exe -- (WisLMSvc)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)

DRV - [2011.12.10 16:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011.08.17 10:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)

DRV - [2011.08.17 10:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)

DRV - [2011.08.17 10:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)

DRV - [2011.04.27 15:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2011.04.18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)

DRV - [2010.12.20 16:31:00 | 000,141,568 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nusb3xhc.sys -- (nusb3xhc)

DRV - [2010.12.20 16:31:00 | 000,061,824 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nusb3hub.sys -- (nusb3hub)

DRV - [2010.12.20 16:30:55 | 000,067,624 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)

DRV - [2010.12.20 16:30:54 | 000,193,056 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV - [2010.12.20 16:30:53 | 010,367,016 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2010.12.20 16:30:53 | 000,019,656 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvpciflt.sys -- (nvpciflt)

DRV - [2010.12.20 16:30:27 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (HECI) Intel(R)

DRV - [2010.11.20 14:30:17 | 000,296,064 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)

DRV - [2010.11.20 14:30:17 | 000,172,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)

DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)

DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)

DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)

DRV - [2010.11.20 12:50:38 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)

DRV - [2010.11.20 12:50:37 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)

DRV - [2010.11.20 12:50:37 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vpcuxd.sys -- (vpcuxd)

DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.11.20 12:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)

DRV - [2010.04.01 10:13:38 | 001,009,184 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8192se.sys -- (rtl8192se)

DRV - [2010.03.02 14:57:42 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)

DRV - [2010.03.02 14:57:42 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)

DRV - [2010.03.02 14:57:42 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)

DRV - [2010.02.22 10:06:42 | 000,009,216 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter)

DRV - [2009.07.14 02:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)

DRV - [2009.05.13 13:26:26 | 000,013,720 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DD 11 4C 27 20 D0 CB 01  [binary data]

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{719AFD7A-89B2-48DB-9C8D-495A78555DB0}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Search the web"

FF - prefs.js..browser.search.order.1: "Search the web"

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"

FF - prefs.js..browser.search.selectedEngine: "Search the web"

FF - prefs.js..extensions.enabledItems: {D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}:1.0

FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94

FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94

FF - prefs.js..extensions.enabledItems: ClickPotatoLite@ClickPotatoLite.com:10.0.659.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:4.3

FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3

FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

 

FF - user.js..browser.search.selectedEngine: "Search the web"

FF - user.js..browser.search.order.1: "Search the web"

FF - user.js..browser.search.defaultenginename: "Search the web"

FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Josefa\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\crossriderapp498@crossrider.com: C:\Users\Josefa\AppData\Local\RewardsArcade\498\Firefox

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.24 20:46:06 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.11 21:17:39 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components [2011.03.22 13:34:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\Mozilla Sunbird\plugins [2012.03.11 21:17:39 | 000,000,000 | ---D | M]

 

[2011.03.11 14:29:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Extensions

[2011.03.11 14:29:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}

[2012.03.25 17:35:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions

[2012.01.02 21:12:28 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.03.25 17:35:49 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}

[2012.02.26 17:15:11 | 000,000,000 | ---D | M] (toolplugin) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\welcome@toolmin.com

[2011.03.11 14:29:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Josefa\AppData\Roaming\mozilla\Sunbird\Profiles\ganib2kj.default\extensions

[2012.03.15 21:32:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2012.02.28 19:13:13 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

() (No name found) -- C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI

[2012.03.24 20:46:06 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.01.06 20:32:22 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.01.06 20:32:22 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.01.06 20:32:22 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.01.06 20:32:22 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.26 17:15:11 | 000,000,158 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search the web.src

[2012.01.06 20:32:22 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.01.06 20:32:22 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2012.03.16 03:46:06 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Users\Josefa\AppData\Roaming\toolplugin\toolbar.dll ()

O3 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)

O4 - HKLM..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)

O4 - HKLM..\Run: [NUSB3MON] C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)

O4 - HKLM..\Run: [PDFPrint] E:\Program Files\PDF24\pdf24.exe (Geek Software GmbH)

O4 - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)

O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe (Wistron Corp.)

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [Akamai NetSession Interface] C:\Users\Josefa\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [Facebook Update] C:\Users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [K3aRyluP6SiCkoR] C:\Users\Josefa\AppData\Roaming\flint4ytw.exe File not found

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [MediaGet2] C:\Users\Josefa\AppData\Local\MediaGet2\mediaget.exe --minimized File not found

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - Startup: C:\Users\Josefa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Josefa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O13 - gopher Prefix: missing

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab (DLM Control)

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.158.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{077ED5A6-0BB6-4BCC-A1B2-0AE4632AF9B1}: NameServer = 194.48.124.202 194.48.124.200

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6A0BAC69-0D12-4FCE-B866-3F442DFF6449}: DhcpNameServer = 10.158.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{94AC04BF-4F2A-4D16-82A5-DCECFEBA9989}: DhcpNameServer = 193.170.110.64

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\Windows\system32\nvinit.dll) - C:\Windows\System32\nvinit.dll (NVIDIA Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: Shell - (C:\Users\Josefa\AppData\Roaming\flint4ytw.exe) -  File not found

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: UserInit - (C:\Users\Josefa\AppData\Roaming\flint4ytw.exe) -  File not found

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: UserInit - (C:\WINDOWS\System32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.02.19 14:55:07 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]

O33 - MountPoints2\{0cceed82-11fc-11e1-b70a-485d604687f4}\Shell - "" = AutoRun

O33 - MountPoints2\{0cceed82-11fc-11e1-b70a-485d604687f4}\Shell\AutoRun\command - "" = IomegaEncryptionSetup v1.3.exe

O33 - MountPoints2\{98cba69b-3c12-11e0-b022-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{98cba69b-3c12-11e0-b022-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Welcome.exe

O33 - MountPoints2\{ce1ff176-f671-11e0-8ea2-00262dc41cd4}\Shell - "" = AutoRun

O33 - MountPoints2\{ce1ff176-f671-11e0-8ea2-00262dc41cd4}\Shell\AutoRun\command - "" = F:\Autorun.exe

O33 - MountPoints2\F\Shell - "" = AutoRun

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Autorun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: HotkeyApp - hkey= - key= - C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)

MsConfig - StartUpReg: LMgrOSD - hkey= - key= -  File not found

MsConfig - StartUpReg: LMgrVolOSD - hkey= - key= - C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.)

MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)

MsConfig - StartUpReg: SearchSettings - hkey= - key= - C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)

MsConfig - State: "startup" - 2

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: MsMpSvc - C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: MsMpSvc - C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {170BC2CF-4B8F-E633-860B-5BC03CE3CEF7} - Microsoft Windows Media Player

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\System32\Microsoft

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45394181-28A0-ADC4-1E17-4CE49025A11C} - Microsoft Windows Media Player 12.0

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {695CE607-29F4-8EA4-8A51-DCF625C4AC57} - .NET Framework

ActiveX: {6BE484BB-1F36-551F-2F1D-C43808D3F1AF} - Internet Explorer

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - C:\Windows\System32\Microsoft

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {FB0EB00B-0E98-DD15-F6D5-7E9BBF41C28E} - Java (Sun)

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.03.23 23:19:22 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.03.23 01:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot

[2012.03.23 01:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\pdfforge Toolbar

[2012.03.23 01:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater

[2012.03.18 09:25:31 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.03.18 09:25:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.03.18 09:25:30 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.03.16 03:46:02 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.03.15 20:05:46 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Roaming\Malwarebytes

[2012.03.15 20:05:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.03.11 21:17:02 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.03.11 02:32:25 | 000,000,000 | ---D | C] -- C:\Users\Josefa\Desktop\BSP Buch

[2012.03.09 23:08:27 | 000,000,000 | ---D | C] -- C:\Users\Josefa\Desktop\Panorama

[2012.03.03 18:18:09 | 000,000,000 | ---D | C] -- C:\Users\Josefa\Documents\ZPS14

[2012.03.03 18:18:08 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Roaming\Zoner

[2012.03.03 18:18:08 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Local\Zoner

[2012.03.03 18:18:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Zoner

[2012.03.03 18:17:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zoner Photo Studio 14

[2012.03.03 18:17:39 | 000,000,000 | ---D | C] -- C:\Program Files\Zoner

[2012.02.28 19:13:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2012.02.28 19:13:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2012.02.26 17:15:07 | 000,000,000 | ---D | C] -- C:\Users\Josefa\AppData\Roaming\toolplugin

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.03.25 19:43:00 | 000,013,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.25 19:43:00 | 000,013,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.25 19:32:30 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000UA.job

[2012.03.25 19:32:28 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000Core.job

[2012.03.25 19:32:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.03.25 17:32:42 | 000,722,736 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.03.25 17:32:42 | 000,661,510 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.03.25 17:32:42 | 000,157,244 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.03.25 17:32:42 | 000,129,150 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.03.24 08:44:23 | 000,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLet.DAT

[2012.03.23 01:37:28 | 2558,595,072 | -HS- | M] () -- C:\hiberfil.sys

[2012.03.22 20:55:45 | 000,485,016 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.03.21 22:30:39 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.18 07:24:12 | 000,002,243 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012.03.16 03:46:06 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

[2012.03.15 19:52:12 | 000,000,000 | ---- | M] () -- C:\Windows\ViewNX2.INI

[2012.03.15 19:48:11 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2012.03.15 19:48:11 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2012.03.13 17:10:56 | 313,256,741 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2012.03.12 13:39:39 | 001,711,984 | ---- | M] () -- C:\Users\Josefa\Desktop\Leno_individuell.pdf

[2012.03.12 13:39:08 | 002,513,666 | ---- | M] () -- C:\Users\Josefa\Desktop\brettstapelbau.pdf

[2012.03.11 03:27:16 | 000,000,600 | ---- | M] () -- C:\Users\Josefa\AppData\Local\PUTTY.RND

[2012.03.11 00:39:27 | 000,000,855 | ---- | M] () -- C:\Users\Public\Desktop\FileZilla Client.lnk

[2012.03.10 19:08:38 | 000,042,733 | ---- | M] () -- C:\Users\Josefa\Desktop\post2.jpg

[2012.03.10 18:34:18 | 001,647,628 | ---- | M] () -- C:\Users\Josefa\Desktop\DSC_0028x.jpg

[2012.03.10 14:26:47 | 000,032,649 | ---- | M] () -- C:\Users\Josefa\Desktop\post.jpg

[2012.03.06 23:08:49 | 026,774,240 | ---- | M] () -- C:\Users\Josefa\Desktop\Technische Mappe_Stand 09.2011_druck.pdf

[2012.03.03 21:03:34 | 000,002,726 | ---- | M] () -- C:\Users\Josefa\Desktop\P1020527.JPG

[2012.03.03 21:03:25 | 000,002,556 | ---- | M] () -- C:\Users\Josefa\Desktop\P1020528.JPG

[2012.03.03 18:17:51 | 000,002,035 | ---- | M] () -- C:\Users\Public\Desktop\Zoner Photo Studio 14 FREE.lnk

[2012.03.02 09:27:55 | 000,001,023 | ---- | M] () -- C:\Users\Josefa\Desktop\Dropbox.lnk

[2012.03.02 09:27:55 | 000,001,003 | ---- | M] () -- C:\Users\Josefa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

[2012.02.28 19:13:03 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2012.02.26 17:44:37 | 000,001,593 | ---- | M] () -- C:\Users\Josefa\Desktop\DivX Movies.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.03.18 09:25:31 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.03.15 19:52:12 | 000,000,000 | ---- | C] () -- C:\Windows\ViewNX2.INI

[2012.03.15 19:48:11 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS

[2012.03.15 19:48:11 | 000,000,000 | RHS- | C] () -- C:\IO.SYS

[2012.03.12 13:39:39 | 001,711,984 | ---- | C] () -- C:\Users\Josefa\Desktop\Leno_individuell.pdf

[2012.03.12 13:39:08 | 002,513,666 | ---- | C] () -- C:\Users\Josefa\Desktop\brettstapelbau.pdf

[2012.03.11 00:39:27 | 000,000,855 | ---- | C] () -- C:\Users\Public\Desktop\FileZilla Client.lnk

[2012.03.10 19:08:36 | 000,042,733 | ---- | C] () -- C:\Users\Josefa\Desktop\post2.jpg

[2012.03.10 18:33:57 | 001,647,628 | ---- | C] () -- C:\Users\Josefa\Desktop\DSC_0028x.jpg

[2012.03.10 14:26:44 | 000,032,649 | ---- | C] () -- C:\Users\Josefa\Desktop\post.jpg

[2012.03.06 23:08:47 | 026,774,240 | ---- | C] () -- C:\Users\Josefa\Desktop\Technische Mappe_Stand 09.2011_druck.pdf

[2012.03.03 21:03:33 | 000,002,726 | ---- | C] () -- C:\Users\Josefa\Desktop\P1020527.JPG

[2012.03.03 21:03:24 | 000,002,556 | ---- | C] () -- C:\Users\Josefa\Desktop\P1020528.JPG

[2012.03.03 18:17:51 | 000,002,035 | ---- | C] () -- C:\Users\Public\Desktop\Zoner Photo Studio 14 FREE.lnk

[2012.02.26 17:44:37 | 000,001,593 | ---- | C] () -- C:\Users\Josefa\Desktop\DivX Movies.lnk

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Rock

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Robot

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Reverb

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\Users\Josefa\AppData\Roaming\Repeat Routines

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\Users\Josefa\AppData\Roaming\Receipts

[2012.02.09 12:54:12 | 000,000,268 | RH-- | C] () -- C:\Users\Josefa\AppData\Roaming\Radio Sounds

[2012.02.09 12:54:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT

[2012.02.09 12:54:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT

[2012.02.09 12:54:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT

[2012.02.09 12:54:12 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Sound Effects

[2012.02.09 12:54:12 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Smooth Strings

[2012.02.09 12:54:12 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Services

[2011.08.13 14:31:15 | 000,065,793 | ---- | C] () -- C:\Windows\System32\esfwad.bin

[2011.05.14 16:25:54 | 000,000,600 | ---- | C] () -- C:\Users\Josefa\AppData\Local\PUTTY.RND

[2011.04.23 20:58:29 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe

[2011.04.23 20:56:52 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2011.03.30 19:17:59 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll

[2011.02.21 14:11:34 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2011.02.19 12:24:19 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe

[2011.02.19 12:24:18 | 000,149,504 | ---- | C] () -- C:\Windows\unwise32_setup.exe

[2011.02.19 12:20:11 | 000,451,072 | ---- | C] () -- C:\Windows\System32\ISSRemoveSP.exe

[2011.02.19 12:13:16 | 000,002,204 | R--- | C] () -- C:\Windows\System32\drivers\RtPCEE3.DAT

[2011.02.11 19:10:50 | 000,874,048 | ---- | C] () -- C:\Windows\System32\igkrng575.bin

[2011.02.11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll

[2010.10.27 05:21:58 | 000,416,865 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin

[2010.10.27 05:21:58 | 000,408,168 | ---- | C] () -- C:\Windows\System32\easyUpdatusAPIU.dll

[2010.08.25 20:30:02 | 000,127,868 | ---- | C] () -- C:\Windows\System32\igcompkrng575.bin

[2010.08.25 20:30:00 | 000,104,796 | ---- | C] () -- C:\Windows\System32\igfcg575m.bin

[2010.08.25 19:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config

[2010.06.08 15:19:24 | 000,692,224 | ---- | C] () -- C:\Windows\System32\libeay32.dll

[2010.06.08 15:19:24 | 000,151,552 | ---- | C] () -- C:\Windows\System32\ssleay32.dll

[2010.04.20 16:31:43 | 000,936,832 | ---- | C] () -- C:\Windows\System32\M2ElevatedCalls.dll

 
 ========== LOP Check ==========

 

[2012.03.22 21:05:10 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\cadwork

[2011.09.09 17:40:34 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent

[2011.09.09 17:53:58 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent_Artlantis3

[2011.08.31 11:22:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Artisteer

[2011.04.16 17:18:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Autodesk

[2011.11.19 16:26:23 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Azureus

[2011.10.15 11:07:22 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\cadwork

[2012.03.23 01:44:33 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Dropbox

[2012.01.02 21:12:39 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoft

[2012.01.02 21:12:28 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.08.13 15:35:43 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\EPSON

[2012.03.11 15:24:00 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\FileZilla

[2011.03.15 22:25:10 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Graphisoft

[2011.04.26 20:18:59 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\JSGSoft.com

[2012.02.09 12:56:35 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Nikon

[2012.02.26 17:15:11 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\toolplugin

[2012.03.03 18:18:08 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Zoner

[2012.03.25 19:32:28 | 000,000,910 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000Core.job

[2012.03.25 19:32:30 | 000,000,932 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000UA.job

[2012.03.16 02:08:29 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.09.09 17:40:34 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent

[2011.09.09 17:53:58 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Abvent_Artlantis3

[2011.03.04 12:34:53 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Adobe

[2011.08.31 11:22:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Apple Computer

[2011.08.31 11:22:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Artisteer

[2011.04.16 17:18:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Autodesk

[2011.11.19 16:26:23 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Azureus

[2011.10.15 11:07:22 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\cadwork

[2011.09.09 20:55:17 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DivX

[2011.02.19 15:27:52 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Download Manager

[2012.03.23 01:44:33 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Dropbox

[2012.01.02 21:12:39 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoft

[2012.01.02 21:12:28 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.08.13 15:35:43 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\EPSON

[2012.03.11 15:24:00 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\FileZilla

[2011.03.15 22:25:10 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Graphisoft

[2011.02.19 12:09:01 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Identities

[2011.02.19 12:11:49 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\InstallShield

[2011.02.19 12:26:30 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Intel Corporation

[2011.04.26 20:18:59 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\JSGSoft.com

[2011.02.21 12:51:21 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Macromedia

[2012.03.15 20:05:46 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Malwarebytes

[2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Media Center Programs

[2012.02.08 16:18:16 | 000,000,000 | --SD | M] -- C:\Users\Josefa\AppData\Roaming\Microsoft

[2011.03.11 14:29:41 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Mozilla

[2012.02.09 12:56:35 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Nikon

[2012.03.24 20:31:32 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Skype

[2011.07.14 12:20:55 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\skypePM

[2012.02.26 17:15:11 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\toolplugin

[2011.04.17 10:30:16 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\WinRAR

[2012.03.03 18:18:08 | 000,000,000 | ---D | M] -- C:\Users\Josefa\AppData\Roaming\Zoner

 
 < %APPDATA%\*.exe /s >

[2011.11.19 15:00:36 | 000,310,208 | ---- | M] (Georgia Institute of Technology) -- C:\Users\Josefa\AppData\Roaming\Azureus\plugins\mlab\ShaperProbeC.exe

[2012.02.15 01:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe

[2012.02.15 01:03:44 | 000,174,752 | ---- | M] (Dropbox, Inc.) -- C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Uninstall.exe

[2011.06.08 23:23:12 | 000,001,078 | R--- | M] () -- C:\Users\Josefa\AppData\Roaming\Microsoft\Installer\{0B15A52D-55B6-457A-8440-F0CE3B2FCDD1}\_2228C2973498FD04F23451.exe

[2011.06.08 23:23:12 | 000,001,078 | R--- | M] () -- C:\Users\Josefa\AppData\Roaming\Microsoft\Installer\{0B15A52D-55B6-457A-8440-F0CE3B2FCDD1}\_6FEFF9B68218417F98F549.exe

[2012.02.09 12:55:09 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Josefa\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

[2011.07.13 04:55:05 | 002,237,440 | R--- | M] (OldTimer Tools) -- C:\OTLPE.exe

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2010.03.03 20:33:26 | 000,435,736 | ---- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\Windows\System32\drivers\iaStor.sys

[2010.03.03 20:33:26 | 000,435,736 | ---- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_e8a55be84650e755\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys

[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys

[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys

[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys

[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys

[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys

[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys

[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys

[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys

[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll

[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2012.01.13 15:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2011.04.18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\drivers\MpNWMon.sys

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2009.07.14 03:15:19 | 000,016,896 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\eventcls.dll

[2009.07.14 03:15:21 | 000,462,848 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\FirewallAPI.dll

[2009.07.14 03:15:36 | 000,226,816 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\LocationApi.dll

 
 <           >
 

< End of report >

--- --- ---

[/code]

cosinus

26.03.2012 12:41

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

PRC - [2012.03.04 23:48:40 | 000,934,752 | ---- | M] (Spigot, Inc.) -- C:\Programme\Common Files\Spigot\Search Settings\SearchSettings.exe

PRC - [2012.03.04 23:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe

IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DD 11 4C 27 20 D0 CB 01  [binary data]

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{719AFD7A-89B2-48DB-9C8D-495A78555DB0}: "URL" = http://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>

FF - prefs.js..browser.search.defaultenginename: "Search the web"

FF - prefs.js..browser.search.order.1: "Search the web"

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"

FF - prefs.js..browser.search.selectedEngine: "Search the web"

FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:4.3

FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3

FF - prefs.js..keyword.URL: "http://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

FF - user.js..browser.search.selectedEngine: "Search the web"

FF - user.js..browser.search.order.1: "Search the web"

FF - user.js..browser.search.defaultenginename: "Search the web"

FF - user.js..keyword.URL: "http://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

[2012.03.25 17:35:49 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}

[2012.02.26 17:15:11 | 000,000,000 | ---D | M] (toolplugin) -- C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\welcome@toolmin.com

O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)

O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Users\Josefa\AppData\Roaming\toolplugin\toolbar.dll ()

O3 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Programme\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

O4 - HKLM..\Run: []  File not found

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [K3aRyluP6SiCkoR] C:\Users\Josefa\AppData\Roaming\flint4ytw.exe File not found

O4 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000..\Run: [MediaGet2] C:\Users\Josefa\AppData\Local\MediaGet2\mediaget.exe --minimized File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: Shell - (C:\Users\Josefa\AppData\Roaming\flint4ytw.exe) -  File not found

O20 - HKU\S-1-5-21-3033605226-1836221928-3340961897-1000 Winlogon: UserInit - (C:\Users\Josefa\AppData\Roaming\flint4ytw.exe) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2011.02.19 14:55:07 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]

O33 - MountPoints2\{0cceed82-11fc-11e1-b70a-485d604687f4}\Shell - "" = AutoRun

:Files

C:\Program Files\Common Files\Spigot

C:\Program Files\pdfforge Toolbar

C:\Program Files\Application Updater

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Smiler12321

26.03.2012 16:52

ergebnis:

Code:



All processes killed

========== OTL ==========

No active process named SearchSettings.exe was found!

Process ApplicationUpdater.exe killed successfully!

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ deleted successfully.

C:\Programme\Vuze_Remote\prxtbVuze.dll moved successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.

HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!

HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!

HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{B922D405-6D13-4A2B-AE89-08A030DA4402} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ deleted successfully.

C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll moved successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ not found.

File C:\Programme\Vuze_Remote\prxtbVuze.dll not found.

HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\SearchScopes\{719AFD7A-89B2-48DB-9C8D-495A78555DB0}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{719AFD7A-89B2-48DB-9C8D-495A78555DB0}\ not found.

Registry key HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.

HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKU\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

Prefs.js: "Search the web" removed from browser.search.defaultenginename

Prefs.js: "Search the web" removed from browser.search.order.1

Prefs.js: "chr-greentree_ff&type=827316" removed from browser.search.param.yahoo-fr

Prefs.js: "Search the web" removed from browser.search.selectedEngine

Prefs.js: pdfforge@mybrowserbar.com:4.3 removed from extensions.enabledItems

Prefs.js: wtxpcom@mybrowserbar.com:4.3 removed from extensions.enabledItems

Prefs.js: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" removed from keyword.URL

C:\Users\Josefa\AppData\Roaming\Mozilla\FireFox\Profiles\2t5b1ba2.default\user.js moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\searchplugin folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\modules folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\META-INF folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\defaults folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\chrome folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\welcome@toolmin.com\chrome\content folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\welcome@toolmin.com\chrome folder moved successfully.

C:\Users\Josefa\AppData\Roaming\mozilla\Firefox\Profiles\2t5b1ba2.default\extensions\welcome@toolmin.com folder moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.

File C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ not found.

File C:\Programme\Vuze_Remote\prxtbVuze.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{B922D405-6D13-4A2B-AE89-08A030DA4402} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.

File C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc}\ not found.

File C:\Programme\Vuze_Remote\prxtbVuze.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{DFEFCDEE-CF1A-4FC8-89AF-189327213627} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-89AF-189327213627}\ deleted successfully.

C:\Users\Josefa\AppData\Roaming\toolplugin\toolbar.dll moved successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BA14329E-9550-4989-B3F2-9732E92D17CC} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA14329E-9550-4989-B3F2-9732E92D17CC}\ not found.

File C:\Programme\Vuze_Remote\prxtbVuze.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Run\\K3aRyluP6SiCkoR deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\Software\Microsoft\Windows\CurrentVersion\Run\\MediaGet2 deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Josefa\AppData\Roaming\flint4ytw.exe deleted successfully.

Registry value HKEY_USERS\S-1-5-21-3033605226-1836221928-3340961897-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\Users\Josefa\AppData\Roaming\flint4ytw.exe deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

File  not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0cceed82-11fc-11e1-b70a-485d604687f4}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0cceed82-11fc-11e1-b70a-485d604687f4}\ not found.

========== FILES ==========

C:\Program Files\Common Files\Spigot\wtxpcom\components folder moved successfully.

C:\Program Files\Common Files\Spigot\wtxpcom folder moved successfully.

C:\Program Files\Common Files\Spigot\Search Settings\Res folder moved successfully.

C:\Program Files\Common Files\Spigot\Search Settings\Lang folder moved successfully.

C:\Program Files\Common Files\Spigot\Search Settings folder moved successfully.

C:\Program Files\Common Files\Spigot folder moved successfully.

C:\Program Files\pdfforge Toolbar\Res\Lang folder moved successfully.

C:\Program Files\pdfforge Toolbar\Res folder moved successfully.

C:\Program Files\pdfforge Toolbar\IE\5.1 folder moved successfully.

C:\Program Files\pdfforge Toolbar\IE folder moved successfully.

C:\Program Files\pdfforge Toolbar\FF\chrome folder moved successfully.

C:\Program Files\pdfforge Toolbar\FF folder moved successfully.

C:\Program Files\pdfforge Toolbar folder moved successfully.

C:\Program Files\Application Updater folder moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrator

->Temp folder emptied: 448569 bytes

->Temporary Internet Files folder emptied: 19801009 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 50164846 bytes

->Flash cache emptied: 954 bytes

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Josefa

->Temp folder emptied: 1385229 bytes

->Temporary Internet Files folder emptied: 1198898 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 76203586 bytes

->Flash cache emptied: 689 bytes

 

User: Public

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 291572 bytes

RecycleBin emptied: 3478164856 bytes

 

Total Files Cleaned = 3.460,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.39.2 log created on 03262012_174223
 

Files\Folders moved on Reboot...
 

Registry entries deleted on Reboot...

cosinus

26.03.2012 18:31

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Smiler12321

26.03.2012 19:09

wiedermal brav alles befolgt, oh großer meister^^ :heilig:

Code:



20:00:37.0161 2892        TDSS rootkit removing tool 2.7.23.0 Mar 26 2012 13:40:18

20:00:37.0405 2892        ============================================================

20:00:37.0406 2892        Current date / time: 2012/03/26 20:00:37.0405

20:00:37.0406 2892        SystemInfo:

20:00:37.0406 2892        

20:00:37.0406 2892        OS Version: 6.1.7601 ServicePack: 1.0

20:00:37.0406 2892        Product type: Workstation

20:00:37.0406 2892        ComputerName: JR_NOTEBOOK

20:00:37.0407 2892        UserName: Josefa

20:00:37.0407 2892        Windows directory: C:\Windows

20:00:37.0407 2892        System windows directory: C:\Windows

20:00:37.0407 2892        Processor architecture: Intel x86

20:00:37.0407 2892        Number of processors: 4

20:00:37.0407 2892        Page size: 0x1000

20:00:37.0407 2892        Boot type: Normal boot

20:00:37.0407 2892        ============================================================

20:00:38.0066 2892        Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

20:00:38.0067 2892        \Device\Harddisk0\DR0:

20:00:38.0068 2892        MBR used

20:00:38.0068 2892        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

20:00:38.0068 2892        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xC31E000

20:00:38.0068 2892        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xC350800, BlocksNum 0x3E506800

20:00:38.0174 2892        Initialize success

20:00:38.0174 2892        ============================================================

20:04:20.0251 4268        ============================================================

20:04:20.0251 4268        Scan started

20:04:20.0251 4268        Mode: Manual; SigCheck; TDLFS; 

20:04:20.0251 4268        ============================================================

20:04:20.0704 4268        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys

20:04:20.0844 4268        1394ohci - ok

20:04:20.0860 4268        ACPI            (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys

20:04:20.0906 4268        ACPI - ok

20:04:20.0938 4268        AcpiPmi         (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys

20:04:21.0016 4268        AcpiPmi - ok

20:04:21.0140 4268        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

20:04:21.0187 4268        AdobeARMservice - ok

20:04:21.0343 4268        adp94xx         (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys

20:04:21.0390 4268        adp94xx - ok

20:04:21.0406 4268        adpahci         (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys

20:04:21.0437 4268        adpahci - ok

20:04:21.0452 4268        adpu320         (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys

20:04:21.0484 4268        adpu320 - ok

20:04:21.0530 4268        AeLookupSvc     (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll

20:04:21.0640 4268        AeLookupSvc - ok

20:04:21.0671 4268        AFD             (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys

20:04:21.0796 4268        AFD - ok

20:04:21.0858 4268        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys

20:04:21.0905 4268        agp440 - ok

20:04:21.0952 4268        aic78xx         (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys

20:04:21.0998 4268        aic78xx - ok

20:04:22.0201 4268        Akamai          (31bd294dc6ddbc0f16356d958d0743a4) c:\program files\common files\akamai/netsession_win_7de0ed9.dll

20:04:22.0201 4268        Suspicious file (Hidden): c:\program files\common files\akamai/netsession_win_7de0ed9.dll. md5: 31bd294dc6ddbc0f16356d958d0743a4

20:04:22.0201 4268        Akamai ( HiddenFile.Multi.Generic ) - warning

20:04:22.0201 4268        Akamai - detected HiddenFile.Multi.Generic (1)

20:04:22.0326 4268        ALG             (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe

20:04:22.0420 4268        ALG - ok

20:04:22.0482 4268        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys

20:04:22.0498 4268        aliide - ok

20:04:22.0544 4268        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys

20:04:22.0576 4268        amdagp - ok

20:04:22.0591 4268        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys

20:04:22.0607 4268        amdide - ok

20:04:22.0638 4268        AmdK8           (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys

20:04:22.0716 4268        AmdK8 - ok

20:04:22.0747 4268        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys

20:04:22.0810 4268        AmdPPM - ok

20:04:22.0841 4268        amdsata         (d320bf87125326f996d4904fe24300fc) C:\Windows\system32\drivers\amdsata.sys

20:04:22.0903 4268        amdsata - ok

20:04:22.0934 4268        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys

20:04:22.0997 4268        amdsbs - ok

20:04:23.0028 4268        amdxata         (46387fb17b086d16dea267d5be23a2f2) C:\Windows\system32\drivers\amdxata.sys

20:04:23.0044 4268        amdxata - ok

20:04:23.0075 4268        AppID           (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys

20:04:23.0215 4268        AppID - ok

20:04:23.0324 4268        AppIDSvc        (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll

20:04:23.0387 4268        AppIDSvc - ok

20:04:23.0434 4268        Appinfo         (fb1959012294d6ad43e5304df65e3c26) C:\Windows\System32\appinfo.dll

20:04:23.0512 4268        Appinfo - ok

20:04:23.0558 4268        Application Updater - ok

20:04:23.0621 4268        AppMgmt         (a45d184df6a8803da13a0b329517a64a) C:\Windows\System32\appmgmts.dll

20:04:23.0699 4268        AppMgmt - ok

20:04:23.0777 4268        arc             (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys

20:04:23.0808 4268        arc - ok

20:04:23.0824 4268        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys

20:04:23.0855 4268        arcsas - ok

20:04:23.0980 4268        aspnet_state    (776acefa0ca9df0faa51a5fb2f435705) C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

20:04:24.0011 4268        aspnet_state - ok

20:04:24.0058 4268        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys

20:04:24.0182 4268        AsyncMac - ok

20:04:24.0292 4268        atapi           (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys

20:04:24.0323 4268        atapi - ok

20:04:24.0416 4268        AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll

20:04:24.0526 4268        AudioEndpointBuilder - ok

20:04:24.0526 4268        Audiosrv        (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll

20:04:24.0572 4268        Audiosrv - ok

20:04:24.0635 4268        AxInstSV        (6e30d02aac9cac84f421622e3a2f6178) C:\Windows\System32\AxInstSV.dll

20:04:24.0728 4268        AxInstSV - ok

20:04:24.0822 4268        b06bdrv         (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys

20:04:24.0900 4268        b06bdrv - ok

20:04:24.0931 4268        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys

20:04:25.0025 4268        b57nd60x - ok

20:04:25.0072 4268        BDESVC          (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll

20:04:25.0134 4268        BDESVC - ok

20:04:25.0150 4268        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys

20:04:25.0196 4268        Beep - ok

20:04:25.0290 4268        BFE             (1e2bac209d184bb851e1a187d8a29136) C:\Windows\System32\bfe.dll

20:04:25.0384 4268        BFE - ok

20:04:25.0446 4268        BITS            (e585445d5021971fae10393f0f1c3961) C:\Windows\System32\qmgr.dll

20:04:25.0508 4268        BITS - ok

20:04:25.0555 4268        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys

20:04:25.0602 4268        blbdrive - ok

20:04:25.0649 4268        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys

20:04:25.0727 4268        bowser - ok

20:04:25.0742 4268        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys

20:04:25.0836 4268        BrFiltLo - ok

20:04:25.0852 4268        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys

20:04:25.0914 4268        BrFiltUp - ok

20:04:25.0976 4268        Browser         (6e11f33d14d020f58d5e02e4d67dfa19) C:\Windows\System32\browser.dll

20:04:26.0054 4268        Browser - ok

20:04:26.0086 4268        Brserid         (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys

20:04:26.0179 4268        Brserid - ok

20:04:26.0195 4268        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys

20:04:26.0242 4268        BrSerWdm - ok

20:04:26.0288 4268        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys

20:04:26.0304 4268        BrUsbMdm - ok

20:04:26.0320 4268        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys

20:04:26.0366 4268        BrUsbSer - ok

20:04:26.0398 4268        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys

20:04:26.0429 4268        BTHMODEM - ok

20:04:26.0476 4268        bthserv         (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll

20:04:26.0554 4268        bthserv - ok

20:04:26.0600 4268        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys

20:04:26.0694 4268        cdfs - ok

20:04:26.0756 4268        cdrom           (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\DRIVERS\cdrom.sys

20:04:26.0819 4268        cdrom - ok

20:04:26.0881 4268        CertPropSvc     (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll

20:04:26.0959 4268        CertPropSvc - ok

20:04:26.0990 4268        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys

20:04:27.0037 4268        circlass - ok

20:04:27.0068 4268        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys

20:04:27.0131 4268        CLFS - ok

20:04:27.0193 4268        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

20:04:27.0240 4268        clr_optimization_v2.0.50727_32 - ok

20:04:27.0302 4268        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

20:04:27.0334 4268        clr_optimization_v4.0.30319_32 - ok

20:04:27.0412 4268        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys

20:04:27.0490 4268        CmBatt - ok

20:04:27.0521 4268        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys

20:04:27.0568 4268        cmdide - ok

20:04:27.0614 4268        CNG             (6427525d76f61d0c519b008d3680e8e7) C:\Windows\system32\Drivers\cng.sys

20:04:27.0661 4268        CNG - ok

20:04:27.0708 4268        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys

20:04:27.0724 4268        Compbatt - ok

20:04:27.0802 4268        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys

20:04:27.0880 4268        CompositeBus - ok

20:04:27.0895 4268        COMSysApp - ok

20:04:27.0911 4268        crcdisk         (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys

20:04:27.0942 4268        crcdisk - ok

20:04:27.0989 4268        CryptSvc        (a585bebf7d054bd9618eda0922d5484a) C:\Windows\system32\cryptsvc.dll

20:04:28.0098 4268        CryptSvc - ok

20:04:28.0145 4268        CSC             (3c2177a897b4ca2788c6fb0c3fd81d4b) C:\Windows\system32\drivers\csc.sys

20:04:28.0238 4268        CSC - ok

20:04:28.0254 4268        CscService      (15f93b37f6801943360d9eb42485d5d3) C:\Windows\System32\cscsvc.dll

20:04:28.0301 4268        CscService - ok

20:04:28.0332 4268        DcomLaunch      (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll

20:04:28.0410 4268        DcomLaunch - ok

20:04:28.0441 4268        defragsvc       (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll

20:04:28.0504 4268        defragsvc - ok

20:04:28.0566 4268        DfsC            (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys

20:04:28.0660 4268        DfsC - ok

20:04:28.0738 4268        Dhcp            (e9e01eb683c132f7fa27cd607b8a2b63) C:\Windows\system32\dhcpcore.dll

20:04:28.0831 4268        Dhcp - ok

20:04:28.0862 4268        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys

20:04:28.0925 4268        discache - ok

20:04:28.0972 4268        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys

20:04:29.0018 4268        Disk - ok

20:04:29.0128 4268        Dnscache        (33ef4861f19a0736b11314aad9ae28d0) C:\Windows\System32\dnsrslvr.dll

20:04:29.0206 4268        Dnscache - ok

20:04:29.0252 4268        dot3svc         (366ba8fb4b7bb7435e3b9eacb3843f67) C:\Windows\System32\dot3svc.dll

20:04:29.0315 4268        dot3svc - ok

20:04:29.0346 4268        DPS             (8ec04ca86f1d68da9e11952eb85973d6) C:\Windows\system32\dps.dll

20:04:29.0424 4268        DPS - ok

20:04:29.0486 4268        drmkaud         (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys

20:04:29.0533 4268        drmkaud - ok

20:04:29.0564 4268        DXGKrnl         (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys

20:04:29.0611 4268        DXGKrnl - ok

20:04:29.0642 4268        EapHost         (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll

20:04:29.0705 4268        EapHost - ok

20:04:29.0814 4268        ebdrv           (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys

20:04:29.0939 4268        ebdrv - ok

20:04:30.0001 4268        EFS             (81951f51e318aecc2d68559e47485cc4) C:\Windows\System32\lsass.exe

20:04:30.0079 4268        EFS - ok

20:04:30.0142 4268        ehRecvr         (a8c362018efc87beb013ee28f29c0863) C:\Windows\ehome\ehRecvr.exe

20:04:30.0235 4268        ehRecvr - ok

20:04:30.0266 4268        ehSched         (d389bff34f80caede417bf9d1507996a) C:\Windows\ehome\ehsched.exe

20:04:30.0360 4268        ehSched - ok

20:04:30.0454 4268        elxstor         (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys

20:04:30.0500 4268        elxstor - ok

20:04:30.0532 4268        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys

20:04:30.0563 4268        ErrDev - ok

20:04:30.0610 4268        EventSystem     (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll

20:04:30.0672 4268        EventSystem - ok

20:04:30.0719 4268        exfat           (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys

20:04:30.0781 4268        exfat - ok

20:04:30.0812 4268        fastfat         (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys

20:04:30.0859 4268        fastfat - ok

20:04:30.0906 4268        Fax             (967ea5b213e9984cbe270205df37755b) C:\Windows\system32\fxssvc.exe

20:04:31.0000 4268        Fax - ok

20:04:31.0046 4268        fdc             (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys

20:04:31.0093 4268        fdc - ok

20:04:31.0124 4268        fdPHost         (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll

20:04:31.0202 4268        fdPHost - ok

20:04:31.0218 4268        FDResPub        (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll

20:04:31.0265 4268        FDResPub - ok

20:04:31.0280 4268        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys

20:04:31.0312 4268        FileInfo - ok

20:04:31.0327 4268        Filetrace       (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys

20:04:31.0390 4268        Filetrace - ok

20:04:31.0483 4268        FLEXnet Licensing Service (d60ef46dc0e757fe5eb579db95b88954) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

20:04:31.0608 4268        FLEXnet Licensing Service - ok

20:04:31.0733 4268        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys

20:04:31.0780 4268        flpydisk - ok

20:04:31.0811 4268        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys

20:04:31.0842 4268        FltMgr - ok

20:04:31.0904 4268        FontCache       (b3a5ec6b6b6673db7e87c2bcdbddc074) C:\Windows\system32\FntCache.dll

20:04:31.0982 4268        FontCache - ok

20:04:32.0076 4268        FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

20:04:32.0123 4268        FontCache3.0.0.0 - ok

20:04:32.0170 4268        FsDepends       (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys

20:04:32.0201 4268        FsDepends - ok

20:04:32.0232 4268        Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys

20:04:32.0248 4268        Fs_Rec - ok

20:04:32.0279 4268        fvevol          (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys

20:04:32.0326 4268        fvevol - ok

20:04:32.0357 4268        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys

20:04:32.0419 4268        gagp30kx - ok

20:04:32.0466 4268        gpsvc           (e897eaf5ed6ba41e081060c9b447a673) C:\Windows\System32\gpsvc.dll

20:04:32.0544 4268        gpsvc - ok

20:04:32.0560 4268        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys

20:04:32.0731 4268        hcw85cir - ok

20:04:32.0794 4268        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys

20:04:32.0840 4268        HdAudAddService - ok

20:04:32.0872 4268        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys

20:04:32.0934 4268        HDAudBus - ok

20:04:32.0981 4268        HECI            (a88485dc6a7136c10d9a6c7e38fdfe3c) C:\Windows\system32\DRIVERS\HECI.sys

20:04:33.0043 4268        HECI - ok

20:04:33.0059 4268        HidBatt         (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys

20:04:33.0106 4268        HidBatt - ok

20:04:33.0137 4268        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys

20:04:33.0168 4268        HidBth - ok

20:04:33.0184 4268        HidIr           (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys

20:04:33.0230 4268        HidIr - ok

20:04:33.0246 4268        hidserv         (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\system32\hidserv.dll

20:04:33.0308 4268        hidserv - ok

20:04:33.0371 4268        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\DRIVERS\hidusb.sys

20:04:33.0418 4268        HidUsb - ok

20:04:33.0449 4268        hkmsvc          (196b4e3f4cccc24af836ce58facbb699) C:\Windows\system32\kmsvc.dll

20:04:33.0496 4268        hkmsvc - ok

20:04:33.0527 4268        HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\Windows\system32\ListSvc.dll

20:04:33.0589 4268        HomeGroupListener - ok

20:04:33.0636 4268        HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\Windows\system32\provsvc.dll

20:04:33.0698 4268        HomeGroupProvider - ok

20:04:33.0761 4268        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys

20:04:33.0792 4268        HpSAMD - ok

20:04:33.0854 4268        HTTP            (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys

20:04:33.0948 4268        HTTP - ok

20:04:34.0010 4268        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys

20:04:34.0042 4268        hwpolicy - ok

20:04:34.0120 4268        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys

20:04:34.0182 4268        i8042prt - ok

20:04:34.0213 4268        iaStor          (26541a068572f650a2fa490726fe81be) C:\Windows\system32\DRIVERS\iaStor.sys

20:04:34.0276 4268        iaStor - ok

20:04:34.0354 4268        IAStorDataMgrSvc (31a0e93cdf29007d6c6fffb632f375ed) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

20:04:34.0369 4268        IAStorDataMgrSvc - ok

20:04:34.0400 4268        iaStorV         (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys

20:04:34.0463 4268        iaStorV - ok

20:04:34.0541 4268        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

20:04:34.0588 4268        IDriverT ( UnsignedFile.Multi.Generic ) - warning

20:04:34.0588 4268        IDriverT - detected UnsignedFile.Multi.Generic (1)

20:04:34.0697 4268        idsvc           (c521d7eb6497bb1af6afa89e322fb43c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

20:04:34.0790 4268        idsvc - ok

20:04:35.0056 4268        igfx            (dce0b53570703cce580d066f89ef58cd) C:\Windows\system32\DRIVERS\igdkmd32.sys

20:04:35.0336 4268        igfx - ok

20:04:35.0446 4268        iirsp           (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys

20:04:35.0477 4268        iirsp - ok

20:04:35.0524 4268        IKEEXT          (f95622f161474511b8d80d6b093aa610) C:\Windows\System32\ikeext.dll

20:04:35.0617 4268        IKEEXT - ok

20:04:35.0726 4268        IntcAzAudAddService (eef55e4de66fd16f636c26a8883c27f7) C:\Windows\system32\drivers\RTKVHDA.sys

20:04:35.0820 4268        IntcAzAudAddService - ok

20:04:35.0914 4268        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys

20:04:35.0945 4268        intelide - ok

20:04:35.0992 4268        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys

20:04:36.0054 4268        intelppm - ok

20:04:36.0085 4268        IPBusEnum       (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll

20:04:36.0148 4268        IPBusEnum - ok

20:04:36.0179 4268        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys

20:04:36.0241 4268        IpFilterDriver - ok

20:04:36.0288 4268        iphlpsvc        (4d65a07b795d6674312f879d09aa7663) C:\Windows\System32\iphlpsvc.dll

20:04:36.0366 4268        iphlpsvc - ok

20:04:36.0397 4268        IPMIDRV         (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys

20:04:36.0460 4268        IPMIDRV - ok

20:04:36.0491 4268        IPNAT           (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys

20:04:36.0522 4268        IPNAT - ok

20:04:36.0569 4268        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys

20:04:36.0616 4268        IRENUM - ok

20:04:36.0647 4268        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys

20:04:36.0694 4268        isapnp - ok

20:04:36.0725 4268        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys

20:04:36.0787 4268        iScsiPrt - ok

20:04:36.0803 4268        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys

20:04:36.0834 4268        kbdclass - ok

20:04:36.0881 4268        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys

20:04:36.0912 4268        kbdhid - ok

20:04:36.0959 4268        KeyIso          (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

20:04:37.0006 4268        KeyIso - ok

20:04:37.0021 4268        KSecDD          (f4647bb23db9038a7536cf6b68f4207f) C:\Windows\system32\Drivers\ksecdd.sys

20:04:37.0052 4268        KSecDD - ok

20:04:37.0068 4268        KSecPkg         (e73cae53bbb72ba26918492c6b4c229d) C:\Windows\system32\Drivers\ksecpkg.sys

20:04:37.0115 4268        KSecPkg - ok

20:04:37.0146 4268        KtmRm           (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll

20:04:37.0208 4268        KtmRm - ok

20:04:37.0271 4268        L1C             (4566fd5f4416e7fef3600e4b30d086c3) C:\Windows\system32\DRIVERS\L1C62x86.sys

20:04:37.0318 4268        L1C - ok

20:04:37.0364 4268        LanmanServer    (d64af876d53eca3668bb97b51b4e70ab) C:\Windows\system32\srvsvc.dll

20:04:37.0427 4268        LanmanServer - ok

20:04:37.0474 4268        LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\Windows\System32\wkssvc.dll

20:04:37.0552 4268        LanmanWorkstation - ok

20:04:37.0614 4268        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys

20:04:37.0692 4268        lltdio - ok

20:04:37.0723 4268        lltdsvc         (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll

20:04:37.0801 4268        lltdsvc - ok

20:04:37.0817 4268        lmhosts         (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll

20:04:37.0864 4268        lmhosts - ok

20:04:37.0942 4268        LMS             (1e2f802846eb944e0333efee7c9532a8) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

20:04:38.0051 4268        LMS - ok

20:04:38.0113 4268        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys

20:04:38.0176 4268        LSI_FC - ok

20:04:38.0191 4268        LSI_SAS         (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys

20:04:38.0222 4268        LSI_SAS - ok

20:04:38.0254 4268        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys

20:04:38.0269 4268        LSI_SAS2 - ok

20:04:38.0300 4268        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys

20:04:38.0332 4268        LSI_SCSI - ok

20:04:38.0363 4268        luafv           (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys

20:04:38.0441 4268        luafv - ok

20:04:38.0488 4268        massfilter      (0b058116d3d4ecca7ded38f16e0581b2) C:\Windows\system32\drivers\massfilter.sys

20:04:38.0550 4268        massfilter - ok

20:04:38.0581 4268        MBAMProtector   (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys

20:04:38.0612 4268        MBAMProtector - ok

20:04:38.0675 4268        MBAMService     (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

20:04:38.0768 4268        MBAMService - ok

20:04:38.0800 4268        Mcx2Svc         (bfb9ee8ee977efe85d1a3105abef6dd1) C:\Windows\system32\Mcx2Svc.dll

20:04:38.0831 4268        Mcx2Svc - ok

20:04:38.0893 4268        megasas         (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys

20:04:38.0909 4268        megasas - ok

20:04:38.0956 4268        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys

20:04:38.0987 4268        MegaSR - ok

20:04:39.0065 4268        Microsoft SharePoint Workspace Audit Service - ok

20:04:39.0096 4268        MMCSS           (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll

20:04:39.0158 4268        MMCSS - ok

20:04:39.0174 4268        Modem           (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys

20:04:39.0221 4268        Modem - ok

20:04:39.0252 4268        monitor         (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys

20:04:39.0299 4268        monitor - ok

20:04:39.0346 4268        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys

20:04:39.0377 4268        mouclass - ok

20:04:39.0408 4268        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys

20:04:39.0455 4268        mouhid - ok

20:04:39.0486 4268        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys

20:04:39.0548 4268        mountmgr - ok

20:04:39.0611 4268        MpFilter        (fee0baded54222e9f1dae9541212aab1) C:\Windows\system32\DRIVERS\MpFilter.sys

20:04:39.0689 4268        MpFilter - ok

20:04:39.0720 4268        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys

20:04:39.0767 4268        mpio - ok

20:04:39.0892 4268        MpKslc3445e54   (a69630d039c38018689190234f866d77) C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B3E55C7C-D4D4-4414-98FB-B246A0AF9BAC}\MpKslc3445e54.sys

20:04:39.0923 4268        MpKslc3445e54 - ok

20:04:39.0938 4268        MpNWMon         (2c3489660d4a8d514c123c3f0d67df46) C:\Windows\system32\DRIVERS\MpNWMon.sys

20:04:39.0970 4268        MpNWMon - ok

20:04:40.0001 4268        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys

20:04:40.0048 4268        mpsdrv - ok

20:04:40.0110 4268        MpsSvc          (9835584e999d25004e1ee8e5f3e3b881) C:\Windows\system32\mpssvc.dll

20:04:40.0204 4268        MpsSvc - ok

20:04:40.0235 4268        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys

20:04:40.0282 4268        MRxDAV - ok

20:04:40.0328 4268        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys

20:04:40.0375 4268        mrxsmb - ok

20:04:40.0422 4268        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys

20:04:40.0500 4268        mrxsmb10 - ok

20:04:40.0531 4268        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys

20:04:40.0594 4268        mrxsmb20 - ok

20:04:40.0625 4268        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys

20:04:40.0640 4268        msahci - ok

20:04:40.0687 4268        msdsm           (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys

20:04:40.0703 4268        msdsm - ok

20:04:40.0734 4268        MSDTC           (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe

20:04:40.0781 4268        MSDTC - ok

20:04:40.0828 4268        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys

20:04:40.0859 4268        Msfs - ok

20:04:40.0874 4268        mshidkmdf       (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys

20:04:40.0921 4268        mshidkmdf - ok

20:04:40.0952 4268        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys

20:04:40.0968 4268        msisadrv - ok

20:04:41.0015 4268        MSiSCSI         (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll

20:04:41.0062 4268        MSiSCSI - ok

20:04:41.0077 4268        msiserver - ok

20:04:41.0124 4268        MSKSSRV         (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys

20:04:41.0186 4268        MSKSSRV - ok

20:04:41.0296 4268        MsMpSvc         (cfce43b70ca0cc4dcc8adb62b792b173) C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

20:04:41.0327 4268        MsMpSvc - ok

20:04:41.0342 4268        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys

20:04:41.0405 4268        MSPCLOCK - ok

20:04:41.0420 4268        MSPQM           (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys

20:04:41.0452 4268        MSPQM - ok

20:04:41.0483 4268        MsRPC           (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys

20:04:41.0530 4268        MsRPC - ok

20:04:41.0561 4268        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys

20:04:41.0608 4268        mssmbios - ok

20:04:41.0623 4268        MSTEE           (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys

20:04:41.0654 4268        MSTEE - ok

20:04:41.0670 4268        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys

20:04:41.0732 4268        MTConfig - ok

20:04:41.0764 4268        Mup             (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys

20:04:41.0795 4268        Mup - ok

20:04:41.0826 4268        napagent        (61d57a5d7c6d9afe10e77dae6e1b445e) C:\Windows\system32\qagentRT.dll

20:04:41.0873 4268        napagent - ok

20:04:41.0920 4268        NativeWifiP     (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys

20:04:41.0951 4268        NativeWifiP - ok

20:04:42.0013 4268        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys

20:04:42.0060 4268        NDIS - ok

20:04:42.0091 4268        NdisCap         (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys

20:04:42.0154 4268        NdisCap - ok

20:04:42.0185 4268        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys

20:04:42.0232 4268        NdisTapi - ok

20:04:42.0278 4268        Ndisuio         (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys

20:04:42.0341 4268        Ndisuio - ok

20:04:42.0372 4268        NdisWan         (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys

20:04:42.0434 4268        NdisWan - ok

20:04:42.0481 4268        NDProxy         (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys

20:04:42.0544 4268        NDProxy - ok

20:04:42.0575 4268        NetBIOS         (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys

20:04:42.0622 4268        NetBIOS - ok

20:04:42.0653 4268        NetBT           (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys

20:04:42.0731 4268        NetBT - ok

20:04:42.0778 4268        Netlogon        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

20:04:42.0824 4268        Netlogon - ok

20:04:42.0871 4268        Netman          (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll

20:04:42.0949 4268        Netman - ok

20:04:43.0043 4268        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

20:04:43.0074 4268        NetMsmqActivator - ok

20:04:43.0074 4268        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

20:04:43.0090 4268        NetPipeActivator - ok

20:04:43.0105 4268        netprofm        (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll

20:04:43.0168 4268        netprofm - ok

20:04:43.0183 4268        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

20:04:43.0214 4268        NetTcpActivator - ok

20:04:43.0214 4268        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

20:04:43.0230 4268        NetTcpPortSharing - ok

20:04:43.0308 4268        nfrd960         (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys

20:04:43.0355 4268        nfrd960 - ok

20:04:43.0386 4268        NisDrv          (7b01c6172cfd0b10116175e09200d4b4) C:\Windows\system32\DRIVERS\NisDrvWFP.sys

20:04:43.0402 4268        NisDrv - ok

20:04:43.0511 4268        NisSrv          (a5cb074f34bbd89948e34a630d459c0c) C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

20:04:43.0573 4268        NisSrv - ok

20:04:43.0604 4268        NlaSvc          (912084381d30d8b89ec4e293053f4710) C:\Windows\System32\nlasvc.dll

20:04:43.0667 4268        NlaSvc - ok

20:04:43.0745 4268        nmwcd           (b0a67de1a128389aea4d42c5a56215fd) C:\Windows\system32\drivers\ccdcmb.sys

20:04:43.0823 4268        nmwcd - ok

20:04:43.0948 4268        nmwcdc          (025c54f9f8c8bc1894ea38529c742c54) C:\Windows\system32\drivers\ccdcmbo.sys

20:04:44.0010 4268        nmwcdc - ok

20:04:44.0041 4268        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys

20:04:44.0104 4268        Npfs - ok

20:04:44.0135 4268        nsi             (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll

20:04:44.0213 4268        nsi - ok

20:04:44.0228 4268        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys

20:04:44.0291 4268        nsiproxy - ok

20:04:44.0384 4268        Ntfs            (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys

20:04:44.0540 4268        Ntfs - ok

20:04:44.0634 4268        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys

20:04:44.0696 4268        Null - ok

20:04:44.0743 4268        nusb3hub        (ff6d3248e791e7a897bd8ea2fbacbcff) C:\Windows\system32\DRIVERS\nusb3hub.sys

20:04:44.0806 4268        nusb3hub - ok

20:04:44.0837 4268        nusb3xhc        (b5eb7e275f2967026c6031897624bc51) C:\Windows\system32\DRIVERS\nusb3xhc.sys

20:04:44.0868 4268        nusb3xhc - ok

20:04:45.0071 4268        nvlddmkm        (ac8c39fe0f9551087ed0d40239a9db52) C:\Windows\system32\DRIVERS\nvlddmkm.sys

20:04:45.0398 4268        nvlddmkm - ok

20:04:45.0492 4268        nvpciflt        (6b050791d479c338ec464213cdffaf4a) C:\Windows\system32\DRIVERS\nvpciflt.sys

20:04:45.0539 4268        nvpciflt - ok

20:04:45.0586 4268        nvraid          (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys

20:04:45.0632 4268        nvraid - ok

20:04:45.0648 4268        nvstor          (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys

20:04:45.0695 4268        nvstor - ok

20:04:45.0742 4268        nvsvc           (cb45c7ed5220546107f154572db6202d) C:\Windows\system32\nvvsvc.exe

20:04:45.0804 4268        nvsvc - ok

20:04:45.0898 4268        nvUpdatusService (c9f1aa3cea686f8f966c0b4dadf67994) C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

20:04:46.0022 4268        nvUpdatusService - ok

20:04:46.0147 4268        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys

20:04:46.0178 4268        nv_agp - ok

20:04:46.0225 4268        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys

20:04:46.0288 4268        ohci1394 - ok

20:04:46.0366 4268        ose             (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

20:04:46.0428 4268        ose - ok

20:04:46.0553 4268        osppsvc         (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

20:04:46.0834 4268        osppsvc - ok

20:04:46.0927 4268        p2pimsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll

20:04:47.0005 4268        p2pimsvc - ok

20:04:47.0052 4268        p2psvc          (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll

20:04:47.0083 4268        p2psvc - ok

20:04:47.0146 4268        Parport         (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys

20:04:47.0177 4268        Parport - ok

20:04:47.0224 4268        partmgr         (bf8f6af06da75b336f07e23aef97d93b) C:\Windows\system32\drivers\partmgr.sys

20:04:47.0255 4268        partmgr - ok

20:04:47.0286 4268        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys

20:04:47.0302 4268        Parvdm - ok

20:04:47.0333 4268        PcaSvc          (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll

20:04:47.0395 4268        PcaSvc - ok

20:04:47.0442 4268        pci             (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys

20:04:47.0473 4268        pci - ok

20:04:47.0504 4268        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys

20:04:47.0551 4268        pciide - ok

20:04:47.0582 4268        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys

20:04:47.0614 4268        pcmcia - ok

20:04:47.0629 4268        pcw             (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys

20:04:47.0645 4268        pcw - ok

20:04:47.0676 4268        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys

20:04:47.0738 4268        PEAUTH - ok

20:04:47.0801 4268        PeerDistSvc     (af4d64d2a57b9772cf3801950b8058a6) C:\Windows\system32\peerdistsvc.dll

20:04:47.0910 4268        PeerDistSvc - ok

20:04:48.0019 4268        pla             (414bba67a3ded1d28437eb66aeb8a720) C:\Windows\system32\pla.dll

20:04:48.0128 4268        pla - ok

20:04:48.0222 4268        PlugPlay        (ec7bc28d207da09e79b3e9faf8b232ca) C:\Windows\system32\umpnpmgr.dll

20:04:48.0316 4268        PlugPlay - ok

20:04:48.0347 4268        PNRPAutoReg     (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll

20:04:48.0394 4268        PNRPAutoReg - ok

20:04:48.0425 4268        PNRPsvc         (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll

20:04:48.0456 4268        PNRPsvc - ok

20:04:48.0534 4268        PolicyAgent     (53946b69ba0836bd95b03759530c81ec) C:\Windows\System32\ipsecsvc.dll

20:04:48.0628 4268        PolicyAgent - ok

20:04:48.0659 4268        Power           (f87d30e72e03d579a5199ccb3831d6ea) C:\Windows\system32\umpo.dll

20:04:48.0752 4268        Power - ok

20:04:48.0815 4268        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys

20:04:48.0893 4268        PptpMiniport - ok

20:04:48.0924 4268        Processor       (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys

20:04:48.0955 4268        Processor - ok

20:04:48.0986 4268        ProfSvc         (43ca4ccc22d52fb58e8988f0198851d0) C:\Windows\system32\profsvc.dll

20:04:49.0049 4268        ProfSvc - ok

20:04:49.0064 4268        ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

20:04:49.0096 4268        ProtectedStorage - ok

20:04:49.0127 4268        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys

20:04:49.0174 4268        Psched - ok

20:04:49.0236 4268        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys

20:04:49.0298 4268        ql2300 - ok

20:04:49.0314 4268        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys

20:04:49.0361 4268        ql40xx - ok

20:04:49.0376 4268        QWAVE           (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll

20:04:49.0439 4268        QWAVE - ok

20:04:49.0454 4268        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys

20:04:49.0501 4268        QWAVEdrv - ok

20:04:49.0517 4268        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys

20:04:49.0564 4268        RasAcd - ok

20:04:49.0610 4268        RasAgileVpn     (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys

20:04:49.0688 4268        RasAgileVpn - ok

20:04:49.0720 4268        RasAuto         (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll

20:04:49.0798 4268        RasAuto - ok

20:04:49.0829 4268        Rasl2tp         (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys

20:04:49.0922 4268        Rasl2tp - ok

20:04:49.0954 4268        RasMan          (cb9e04dc05eacf5b9a36ca276d475006) C:\Windows\System32\rasmans.dll

20:04:50.0016 4268        RasMan - ok

20:04:50.0032 4268        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys

20:04:50.0078 4268        RasPppoe - ok

20:04:50.0125 4268        RasSstp         (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys

20:04:50.0188 4268        RasSstp - ok

20:04:50.0234 4268        rdbss           (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys

20:04:50.0297 4268        rdbss - ok

20:04:50.0312 4268        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys

20:04:50.0344 4268        rdpbus - ok

20:04:50.0375 4268        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys

20:04:50.0453 4268        RDPCDD - ok

20:04:50.0484 4268        RDPDR           (b973fcfc50dc1434e1970a146f7e3885) C:\Windows\system32\drivers\rdpdr.sys

20:04:50.0531 4268        RDPDR - ok

20:04:50.0562 4268        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys

20:04:50.0593 4268        RDPENCDD - ok

20:04:50.0624 4268        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys

20:04:50.0656 4268        RDPREFMP - ok

20:04:50.0702 4268        RdpVideoMiniport (68a0387f58e226deee23d9715955572a) C:\Windows\system32\drivers\rdpvideominiport.sys

20:04:50.0765 4268        RdpVideoMiniport - ok

20:04:50.0796 4268        RDPWD           (244c83332f44589ae98fc347f11b2693) C:\Windows\system32\drivers\RDPWD.sys

20:04:50.0936 4268        RDPWD - ok

20:04:50.0983 4268        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys

20:04:51.0046 4268        rdyboost - ok

20:04:51.0092 4268        RemoteAccess    (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll

20:04:51.0155 4268        RemoteAccess - ok

20:04:51.0186 4268        RemoteRegistry  (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll

20:04:51.0248 4268        RemoteRegistry - ok

20:04:51.0248 4268        RpcEptMapper    (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll

20:04:51.0295 4268        RpcEptMapper - ok

20:04:51.0311 4268        RpcLocator      (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe

20:04:51.0358 4268        RpcLocator - ok

20:04:51.0389 4268        RpcSs           (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll

20:04:51.0451 4268        RpcSs - ok

20:04:51.0514 4268        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys

20:04:51.0607 4268        rspndr - ok

20:04:51.0654 4268        RSUSBSTOR       (0340a381b920a6e68178b832889f33f8) C:\Windows\system32\Drivers\RtsUStor.sys

20:04:51.0701 4268        RSUSBSTOR - ok

20:04:51.0748 4268        rtl8192se       (b5e9979fbb26fc059bd87a81f763d5da) C:\Windows\system32\DRIVERS\rtl8192se.sys

20:04:51.0810 4268        rtl8192se - ok

20:04:51.0826 4268        s3cap           (7fa7f2e249a5dcbb7970630e15e1f482) C:\Windows\system32\drivers\vms3cap.sys

20:04:51.0872 4268        s3cap - ok

20:04:51.0904 4268        SamSs           (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

20:04:51.0919 4268        SamSs - ok

20:04:51.0966 4268        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys

20:04:51.0997 4268        sbp2port - ok

20:04:52.0028 4268        SCardSvr        (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll

20:04:52.0091 4268        SCardSvr - ok

20:04:52.0122 4268        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys

20:04:52.0200 4268        scfilter - ok

20:04:52.0231 4268        Schedule        (a04bb13f8a72f8b6e8b4071723e4e336) C:\Windows\system32\schedsvc.dll

20:04:52.0340 4268        Schedule - ok

20:04:52.0372 4268        SCPolicySvc     (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll

20:04:52.0418 4268        SCPolicySvc - ok

20:04:52.0434 4268        SDRSVC          (08236c4bce5edd0a0318a438af28e0f7) C:\Windows\System32\SDRSVC.dll

20:04:52.0496 4268        SDRSVC - ok

20:04:52.0559 4268        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

20:04:52.0621 4268        secdrv - ok

20:04:52.0652 4268        seclogon        (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll

20:04:52.0715 4268        seclogon - ok

20:04:52.0730 4268        SENS            (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\System32\sens.dll

20:04:52.0793 4268        SENS - ok

20:04:52.0824 4268        SensrSvc        (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll

20:04:52.0886 4268        SensrSvc - ok

20:04:52.0949 4268        Serenum         (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys

20:04:52.0996 4268        Serenum - ok

20:04:53.0011 4268        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys

20:04:53.0074 4268        Serial - ok

20:04:53.0105 4268        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys

20:04:53.0152 4268        sermouse - ok

20:04:53.0198 4268        SessionEnv      (4ae380f39a0032eab7dd953030b26d28) C:\Windows\system32\sessenv.dll

20:04:53.0261 4268        SessionEnv - ok

20:04:53.0292 4268        sffdisk         (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys

20:04:53.0308 4268        sffdisk - ok

20:04:53.0339 4268        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys

20:04:53.0401 4268        sffp_mmc - ok

20:04:53.0417 4268        sffp_sd         (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys

20:04:53.0448 4268        sffp_sd - ok

20:04:53.0479 4268        sfloppy         (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys

20:04:53.0510 4268        sfloppy - ok

20:04:53.0557 4268        SharedAccess    (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll

20:04:53.0698 4268        SharedAccess - ok

20:04:53.0744 4268        ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\Windows\System32\shsvcs.dll

20:04:53.0791 4268        ShellHWDetection - ok

20:04:53.0869 4268        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys

20:04:53.0900 4268        sisagp - ok

20:04:53.0947 4268        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys

20:04:53.0963 4268        SiSRaid2 - ok

20:04:53.0994 4268        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys

20:04:54.0025 4268        SiSRaid4 - ok

20:04:54.0072 4268        SkypeUpdate     (db0405d9aad62f0762e0876ac142b7e1) C:\Program Files\Skype\Updater\Updater.exe

20:04:54.0197 4268        SkypeUpdate - ok

20:04:54.0244 4268        Smb             (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys

20:04:54.0322 4268        Smb - ok

20:04:54.0368 4268        SNMPTRAP        (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe

20:04:54.0431 4268        SNMPTRAP - ok

20:04:54.0462 4268        spldr           (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys

20:04:54.0478 4268        spldr - ok

20:04:54.0524 4268        Spooler         (866a43013535dc8587c258e43579c764) C:\Windows\System32\spoolsv.exe

20:04:54.0602 4268        Spooler - ok

20:04:54.0712 4268        sppsvc          (cf87a1de791347e75b98885214ced2b8) C:\Windows\system32\sppsvc.exe

20:04:54.0868 4268        sppsvc - ok

20:04:54.0946 4268        sppuinotify     (b0180b20b065d89232a78a40fe56eaa6) C:\Windows\system32\sppuinotify.dll

20:04:55.0024 4268        sppuinotify - ok

20:04:55.0086 4268        srv             (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys

20:04:55.0133 4268        srv - ok

20:04:55.0164 4268        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys

20:04:55.0211 4268        srv2 - ok

20:04:55.0226 4268        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys

20:04:55.0258 4268        srvnet - ok

20:04:55.0289 4268        SSDPSRV         (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll

20:04:55.0336 4268        SSDPSRV - ok

20:04:55.0351 4268        SstpSvc         (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll

20:04:55.0429 4268        SstpSvc - ok

20:04:55.0507 4268        Stereo Service  (47a0a473ad1822e9e6c76e519bd0a023) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

20:04:55.0616 4268        Stereo Service - ok

20:04:55.0663 4268        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys

20:04:55.0710 4268        stexstor - ok

20:04:55.0757 4268        StiSvc          (e1fb3706030fb4578a0d72c2fc3689e4) C:\Windows\System32\wiaservc.dll

20:04:55.0788 4268        StiSvc - ok

20:04:55.0835 4268        storflt         (472af0311073dceceaa8fa18ba2bdf89) C:\Windows\system32\drivers\vmstorfl.sys

20:04:55.0850 4268        storflt - ok

20:04:55.0882 4268        storvsc         (dcaffd62259e0bdb433dd67b5bb37619) C:\Windows\system32\drivers\storvsc.sys

20:04:55.0897 4268        storvsc - ok

20:04:55.0928 4268        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys

20:04:55.0944 4268        swenum - ok

20:04:55.0975 4268        swprv           (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll

20:04:56.0038 4268        swprv - ok

20:04:56.0069 4268        Synth3dVsc - ok

20:04:56.0116 4268        SynTP           (d776eb85a20696d9d43129ccf6e703e2) C:\Windows\system32\DRIVERS\SynTP.sys

20:04:56.0147 4268        SynTP - ok

20:04:56.0194 4268        SysMain         (36650d618ca34c9d357dfd3d89b2c56f) C:\Windows\system32\sysmain.dll

20:04:56.0272 4268        SysMain - ok

20:04:56.0303 4268        TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\Windows\System32\TabSvc.dll

20:04:56.0365 4268        TabletInputService - ok

20:04:56.0412 4268        TapiSrv         (613bf4820361543956909043a265c6ac) C:\Windows\System32\tapisrv.dll

20:04:56.0474 4268        TapiSrv - ok

20:04:56.0506 4268        TBS             (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll

20:04:56.0584 4268        TBS - ok

20:04:56.0677 4268        Tcpip           (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\drivers\tcpip.sys

20:04:56.0740 4268        Tcpip - ok

20:04:56.0864 4268        TCPIP6          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\DRIVERS\tcpip.sys

20:04:56.0927 4268        TCPIP6 - ok

20:04:56.0974 4268        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys

20:04:57.0036 4268        tcpipreg - ok

20:04:57.0067 4268        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys

20:04:57.0145 4268        TDPIPE - ok

20:04:57.0192 4268        TDTCP           (2c2c5afe7ee4f620d69c23c0617651a8) C:\Windows\system32\drivers\tdtcp.sys

20:04:57.0223 4268        TDTCP - ok

20:04:57.0270 4268        tdx             (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys

20:04:57.0317 4268        tdx - ok

20:04:57.0348 4268        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys

20:04:57.0379 4268        TermDD - ok

20:04:57.0426 4268        TermService     (382c804c92811be57829d8e550a900e2) C:\Windows\System32\termsrv.dll

20:04:57.0488 4268        TermService - ok

20:04:57.0504 4268        Themes          (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll

20:04:57.0551 4268        Themes - ok

20:04:57.0582 4268        THREADORDER     (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll

20:04:57.0629 4268        THREADORDER - ok

20:04:57.0644 4268        TrkWks          (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll

20:04:57.0691 4268        TrkWks - ok

20:04:57.0738 4268        TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\Windows\servicing\TrustedInstaller.exe

20:04:57.0816 4268        TrustedInstaller - ok

20:04:57.0878 4268        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys

20:04:57.0925 4268        tssecsrv - ok

20:04:57.0972 4268        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys

20:04:58.0050 4268        TsUsbFlt - ok

20:04:58.0050 4268        tsusbhub - ok

20:04:58.0097 4268        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys

20:04:58.0144 4268        tunnel - ok

20:04:58.0190 4268        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys

20:04:58.0237 4268        uagp35 - ok

20:04:58.0284 4268        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys

20:04:58.0331 4268        udfs - ok

20:04:58.0378 4268        UI0Detect       (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe

20:04:58.0424 4268        UI0Detect - ok

20:04:58.0471 4268        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys

20:04:58.0502 4268        uliagpkx - ok

20:04:58.0534 4268        umbus           (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys

20:04:58.0580 4268        umbus - ok

20:04:58.0612 4268        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys

20:04:58.0643 4268        UmPass - ok

20:04:58.0674 4268        UmRdpService    (409994a8eaceee4e328749c0353527a0) C:\Windows\System32\umrdp.dll

20:04:58.0736 4268        UmRdpService - ok

20:04:58.0877 4268        UNS             (af905f4966cfc8b973623ab150cd4b2b) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

20:04:59.0064 4268        UNS - ok

20:04:59.0142 4268        upnphost        (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll

20:04:59.0220 4268        upnphost - ok

20:04:59.0267 4268        usbccgp         (bd9c55d7023c5de374507acc7a14e2ac) C:\Windows\system32\DRIVERS\usbccgp.sys

20:04:59.0329 4268        usbccgp - ok

20:04:59.0360 4268        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys

20:04:59.0407 4268        usbcir - ok

20:04:59.0438 4268        usbehci         (f92de757e4b7ce9c07c5e65423f3ae3b) C:\Windows\system32\drivers\usbehci.sys

20:04:59.0516 4268        usbehci - ok

20:04:59.0532 4268        usbhub          (8dc94aec6a7e644a06135ae7506dc2e9) C:\Windows\system32\DRIVERS\usbhub.sys

20:04:59.0579 4268        usbhub - ok

20:04:59.0610 4268        usbohci         (e185d44fac515a18d9deddc23c2cdf44) C:\Windows\system32\drivers\usbohci.sys

20:04:59.0672 4268        usbohci - ok

20:04:59.0704 4268        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys

20:04:59.0750 4268        usbprint - ok

20:04:59.0797 4268        usbscan         (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys

20:04:59.0844 4268        usbscan - ok

20:04:59.0906 4268        usbser          (31181de6190b39fc8007dffd1a48ffd6) C:\Windows\system32\drivers\usbser.sys

20:04:59.0969 4268        usbser - ok

20:04:59.0984 4268        UsbserFilt      (4f8fbc51a1c0a17310846b417a447f91) C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys

20:05:00.0016 4268        UsbserFilt - ok

20:05:00.0047 4268        USBSTOR         (f991ab9cc6b908db552166768176896a) C:\Windows\system32\DRIVERS\USBSTOR.SYS

20:05:00.0109 4268        USBSTOR - ok

20:05:00.0140 4268        usbuhci         (68df884cf41cdada664beb01daf67e3d) C:\Windows\system32\drivers\usbuhci.sys

20:05:00.0172 4268        usbuhci - ok

20:05:00.0234 4268        usbvideo        (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\Windows\System32\Drivers\usbvideo.sys

20:05:00.0281 4268        usbvideo - ok

20:05:00.0312 4268        UxSms           (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll

20:05:00.0374 4268        UxSms - ok

20:05:00.0390 4268        VaultSvc        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe

20:05:00.0421 4268        VaultSvc - ok

20:05:00.0452 4268        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys

20:05:00.0468 4268        vdrvroot - ok

20:05:00.0515 4268        vds             (c3cd30495687c2a2f66a65ca6fd89be9) C:\Windows\System32\vds.exe

20:05:00.0577 4268        vds - ok

20:05:00.0593 4268        vga             (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys

20:05:00.0624 4268        vga - ok

20:05:00.0655 4268        VgaSave         (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys

20:05:00.0718 4268        VgaSave - ok

20:05:00.0718 4268        VGPU - ok

20:05:00.0749 4268        vhdmp           (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys

20:05:00.0780 4268        vhdmp - ok

20:05:00.0811 4268        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys

20:05:00.0842 4268        viaagp - ok

20:05:00.0858 4268        ViaC7           (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys

20:05:00.0889 4268        ViaC7 - ok

20:05:00.0936 4268        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys

20:05:00.0967 4268        viaide - ok

20:05:00.0998 4268        vmbus           (c2f2911156fdc7817c52829c86da494e) C:\Windows\system32\drivers\vmbus.sys

20:05:01.0030 4268        vmbus - ok

20:05:01.0045 4268        VMBusHID        (d4d77455211e204f370d08f4963063ce) C:\Windows\system32\drivers\VMBusHID.sys

20:05:01.0076 4268        VMBusHID - ok

20:05:01.0108 4268        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys

20:05:01.0139 4268        volmgr - ok

20:05:01.0186 4268        volmgrx         (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys

20:05:01.0217 4268        volmgrx - ok

20:05:01.0232 4268        volsnap         (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys

20:05:01.0264 4268        volsnap - ok

20:05:01.0310 4268        vpcbus          (b26536add1d748cda104d856c979ae79) C:\Windows\system32\DRIVERS\vpchbus.sys

20:05:01.0342 4268        vpcbus - ok

20:05:01.0388 4268        vpcnfltr        (a0f7e923a6261760130f22b85df9040e) C:\Windows\system32\DRIVERS\vpcnfltr.sys

20:05:01.0466 4268        vpcnfltr - ok

20:05:01.0498 4268        vpcusb          (5f4b55e91ce7e2523c9e1e0ece858869) C:\Windows\system32\DRIVERS\vpcusb.sys

20:05:01.0560 4268        vpcusb - ok

20:05:01.0607 4268        vpcuxd          (c35c2c888aff276e95ad3db3b7a8d003) C:\Windows\system32\DRIVERS\vpcuxd.sys

20:05:01.0638 4268        vpcuxd - ok

20:05:01.0716 4268        vpcvmm          (b487191fe18d6863381a1ac55482469a) C:\Windows\system32\drivers\vpcvmm.sys

20:05:01.0778 4268        vpcvmm - ok

20:05:01.0810 4268        vsmraid         (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys

20:05:01.0856 4268        vsmraid - ok

20:05:01.0903 4268        VSS             (209a3b1901b83aeb8527ed211cce9e4c) C:\Windows\system32\vssvc.exe

20:05:01.0997 4268        VSS - ok

20:05:02.0090 4268        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys

20:05:02.0137 4268        vwifibus - ok

20:05:02.0153 4268        vwififlt        (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys

20:05:02.0200 4268        vwififlt - ok

20:05:02.0231 4268        vwifimp         (a3f04cbea6c2a10e6cb01f8b47611882) C:\Windows\system32\DRIVERS\vwifimp.sys

20:05:02.0262 4268        vwifimp - ok

20:05:02.0309 4268        W32Time         (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll

20:05:02.0387 4268        W32Time - ok

20:05:02.0402 4268        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys

20:05:02.0434 4268        WacomPen - ok

20:05:02.0496 4268        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys

20:05:02.0558 4268        WANARP - ok

20:05:02.0574 4268        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys

20:05:02.0621 4268        Wanarpv6 - ok

20:05:02.0699 4268        WatAdminSvc     (353a04c273ec58475d8633e75ccd5604) C:\Windows\system32\Wat\WatAdminSvc.exe

20:05:03.0011 4268        WatAdminSvc - ok

20:05:03.0104 4268        wbengine        (691e3285e53dca558e1a84667f13e15a) C:\Windows\system32\wbengine.exe

20:05:03.0214 4268        wbengine - ok

20:05:03.0292 4268        WbioSrvc        (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll

20:05:03.0338 4268        WbioSrvc - ok

20:05:03.0385 4268        wcncsvc         (34eee0dfaadb4f691d6d5308a51315dc) C:\Windows\System32\wcncsvc.dll

20:05:03.0463 4268        wcncsvc - ok

20:05:03.0494 4268        WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll

20:05:03.0541 4268        WcsPlugInService - ok

20:05:03.0604 4268        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys

20:05:03.0635 4268        Wd - ok

20:05:03.0650 4268        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys

20:05:03.0682 4268        Wdf01000 - ok

20:05:03.0697 4268        WdiServiceHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll

20:05:03.0806 4268        WdiServiceHost - ok

20:05:03.0806 4268        WdiSystemHost   (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll

20:05:03.0838 4268        WdiSystemHost - ok

20:05:03.0884 4268        WebClient       (a9d880f97530d5b8fee278923349929d) C:\Windows\System32\webclnt.dll

20:05:03.0931 4268        WebClient - ok

20:05:03.0978 4268        Wecsvc          (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll

20:05:04.0025 4268        Wecsvc - ok

20:05:04.0040 4268        wercplsupport   (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll

20:05:04.0103 4268        wercplsupport - ok

20:05:04.0118 4268        WerSvc          (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll

20:05:04.0181 4268        WerSvc - ok

20:05:04.0243 4268        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys

20:05:04.0321 4268        WfpLwf - ok

20:05:04.0337 4268        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys

20:05:04.0368 4268        WIMMount - ok

20:05:04.0446 4268        WinDefend       (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll

20:05:04.0508 4268        WinDefend - ok

20:05:04.0508 4268        WinHttpAutoProxySvc - ok

20:05:04.0555 4268        Winmgmt         (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll

20:05:04.0618 4268        Winmgmt - ok

20:05:04.0696 4268        WinRM           (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\Windows\system32\WsmSvc.dll

20:05:04.0789 4268        WinRM - ok

20:05:04.0914 4268        WinUsb          (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\DRIVERS\WinUsb.sys

20:05:04.0961 4268        WinUsb - ok

20:05:05.0039 4268        WisLMSvc        (4c69a8e2e159c1c59bc4b688e9dd7f8c) C:\Program Files\Launch Manager\WisLMSvc.exe

20:05:05.0086 4268        WisLMSvc - ok

20:05:05.0148 4268        Wlansvc         (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll

20:05:05.0210 4268        Wlansvc - ok

20:05:05.0288 4268        WmiAcpi         (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys

20:05:05.0335 4268        WmiAcpi - ok

20:05:05.0382 4268        wmiApSrv        (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe

20:05:05.0444 4268        wmiApSrv - ok

20:05:05.0538 4268        WMPNetworkSvc   (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe

20:05:05.0632 4268        WMPNetworkSvc - ok

20:05:05.0710 4268        WPCSvc          (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll

20:05:05.0772 4268        WPCSvc - ok

20:05:05.0803 4268        WPDBusEnum      (aa53356d60af47eacc85bc617a4f3f66) C:\Windows\system32\wpdbusenum.dll

20:05:05.0866 4268        WPDBusEnum - ok

20:05:05.0928 4268        ws2ifsl         (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys

20:05:05.0990 4268        ws2ifsl - ok

20:05:06.0022 4268        wscsvc          (6f5d49efe0e7164e03ae773a3fe25340) C:\Windows\System32\wscsvc.dll

20:05:06.0084 4268        wscsvc - ok

20:05:06.0131 4268        WSDPrintDevice  (553f6ccd7c58eb98d4a8fbdaf283d7a9) C:\Windows\system32\DRIVERS\WSDPrint.sys

20:05:06.0193 4268        WSDPrintDevice - ok

20:05:06.0193 4268        WSearch - ok

20:05:06.0271 4268        wuauserv        (3026418a50c5b4761befa632cedb7406) C:\Windows\system32\wuaueng.dll

20:05:06.0365 4268        wuauserv - ok

20:05:06.0458 4268        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys

20:05:06.0521 4268        WudfPf - ok

20:05:06.0568 4268        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys

20:05:06.0630 4268        WUDFRd - ok

20:05:06.0661 4268        wudfsvc         (8d1e1e529a2c9e9b6a85b55a345f7629) C:\Windows\System32\WUDFSvc.dll

20:05:06.0708 4268        wudfsvc - ok

20:05:06.0739 4268        WwanSvc         (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll

20:05:06.0786 4268        WwanSvc - ok

20:05:06.0817 4268        X10Hid          (1f93fcb5bab3a921ecba522f63586f4a) C:\Windows\system32\Drivers\x10hid.sys

20:05:06.0833 4268        X10Hid - ok

20:05:06.0880 4268        x10nets         (5a0c788c5bc5f2c993cb60940adcf95e) C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

20:05:06.0911 4268        x10nets ( UnsignedFile.Multi.Generic ) - warning

20:05:06.0911 4268        x10nets - detected UnsignedFile.Multi.Generic (1)

20:05:06.0958 4268        ZTEusbmdm6k     (46686fe8915bd8b2feb3a876e367010c) C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys

20:05:07.0020 4268        ZTEusbmdm6k - ok

20:05:07.0036 4268        ZTEusbnmea      (46686fe8915bd8b2feb3a876e367010c) C:\Windows\system32\DRIVERS\ZTEusbnmea.sys

20:05:07.0067 4268        ZTEusbnmea - ok

20:05:07.0082 4268        ZTEusbser6k     (46686fe8915bd8b2feb3a876e367010c) C:\Windows\system32\DRIVERS\ZTEusbser6k.sys

20:05:07.0114 4268        ZTEusbser6k - ok

20:05:07.0145 4268        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

20:05:07.0270 4268        \Device\Harddisk0\DR0 - ok

20:05:07.0270 4268        Boot (0x1200)   (e3cf23f62799f2f5b996aaa22ced8712) \Device\Harddisk0\DR0\Partition0

20:05:07.0270 4268        \Device\Harddisk0\DR0\Partition0 - ok

20:05:07.0301 4268        Boot (0x1200)   (2ac1f28c6cb498c26c1932a76dde7db9) \Device\Harddisk0\DR0\Partition1

20:05:07.0301 4268        \Device\Harddisk0\DR0\Partition1 - ok

20:05:07.0316 4268        Boot (0x1200)   (86878ed15004ac11e4c21bde858abba2) \Device\Harddisk0\DR0\Partition2

20:05:07.0316 4268        \Device\Harddisk0\DR0\Partition2 - ok

20:05:07.0316 4268        ============================================================

20:05:07.0316 4268        Scan finished

20:05:07.0316 4268        ============================================================

20:05:07.0332 4336        Detected object count: 3

20:05:07.0332 4336        Actual detected object count: 3

20:05:57.0408 4336        Akamai ( HiddenFile.Multi.Generic ) - skipped by user

20:05:57.0408 4336        Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip 

20:05:57.0408 4336        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

20:05:57.0408 4336        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 

20:05:57.0408 4336        x10nets ( UnsignedFile.Multi.Generic ) - skipped by user

20:05:57.0408 4336        x10nets ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus

26.03.2012 20:49

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Smiler12321

29.03.2012 20:12

Code:



Combofix Logfile:
 

        Code:


        
ComboFix 12-03-29.02 - Josefa 29.03.2012  20:49:08.1.4 - x86

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.3253.2018 [GMT 2:00]

ausgeführt von:: c:\users\Josefa\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\Services

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-02-28 bis 2012-03-29  ))))))))))))))))))))))))))))))

.

.

2012-03-29 18:53 . 2012-03-29 18:53        --------        d-----w-        c:\users\Josefa\AppData\Local\temp

2012-03-29 18:45 . 2012-03-29 18:45        29904        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{54F4A8B5-DA87-4CCC-B6BA-474F3E57D07F}\MpKsl57b03096.sys

2012-03-29 17:39 . 2012-03-13 18:15        6582328        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{54F4A8B5-DA87-4CCC-B6BA-474F3E57D07F}\mpengine.dll

2012-03-24 18:46 . 2012-03-24 18:46        592824        ----a-w-        c:\program files\Mozilla Firefox\gkmedias.dll

2012-03-24 18:46 . 2012-03-24 18:46        44472        ----a-w-        c:\program files\Mozilla Firefox\mozglue.dll

2012-03-23 21:19 . 2012-03-23 21:19        --------        d-----w-        c:\program files\ESET

2012-03-22 18:49 . 2011-11-19 14:50        3968368        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-03-22 18:49 . 2011-11-19 14:50        3913584        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-03-21 18:58 . 2012-02-03 03:54        2343424        ----a-w-        c:\windows\system32\win32k.sys

2012-03-21 18:58 . 2012-02-10 05:38        1077248        ----a-w-        c:\windows\system32\DWrite.dll

2012-03-21 18:30 . 2012-02-17 05:34        919040        ----a-w-        c:\windows\system32\rdpcorets.dll

2012-03-21 18:30 . 2012-02-17 05:34        826880        ----a-w-        c:\windows\system32\rdpcore.dll

2012-03-21 18:30 . 2012-02-17 04:13        24576        ----a-w-        c:\windows\system32\drivers\tdtcp.sys

2012-03-21 18:29 . 2012-02-17 04:14        183808        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-03-21 18:29 . 2012-01-25 05:32        58880        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-03-21 18:29 . 2012-01-25 05:32        129536        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-03-21 18:29 . 2012-01-25 05:27        8192        ----a-w-        c:\windows\system32\rdrmemptylst.exe

2012-03-18 07:25 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-03-18 07:25 . 2012-03-21 20:31        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-03-18 07:12 . 2012-03-22 04:24        --------        d-----w-        c:\users\Administrator

2012-03-16 01:46 . 2012-03-16 01:46        --------        d-----w-        C:\_OTL

2012-03-15 18:05 . 2012-03-15 18:05        --------        d-----w-        c:\users\Josefa\AppData\Roaming\Malwarebytes

2012-03-15 18:05 . 2012-03-15 18:05        --------        d-----w-        c:\programdata\Malwarebytes

2012-03-03 16:18 . 2012-03-03 16:18        --------        d-----w-        c:\users\Josefa\AppData\Roaming\Zoner

2012-03-03 16:18 . 2012-03-03 16:18        --------        d-----w-        c:\users\Josefa\AppData\Local\Zoner

2012-03-03 16:18 . 2012-03-03 16:18        --------        d-----w-        c:\programdata\Zoner

2012-03-03 16:17 . 2012-03-03 16:17        --------        d-----w-        c:\program files\Zoner

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-03-13 18:15 . 2011-02-19 11:02        6582328        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-02-28 20:39 . 2012-01-14 00:52        2300696        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll

2012-02-28 20:39 . 2012-01-14 00:52        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll

2012-02-28 20:39 . 2012-01-04 21:55        1236816        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2012-02-11 14:07 . 2012-02-11 14:07        713784        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C29FAD29-96F0-4CDF-B4F7-026F8E62CBAB}\gapaengine.dll

2012-02-09 10:55 . 2012-02-09 10:55        57344        ----a-r-        c:\users\Josefa\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe

2012-02-09 10:54 . 2012-02-09 10:54        106496        ----a-w-        c:\windows\system32\ATL71.DLL

2012-01-31 12:44 . 2011-02-19 10:35        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-01-25 10:28 . 2012-01-04 21:55        2300696        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll

2012-01-25 10:28 . 2012-01-04 21:55        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll

2012-01-25 10:27 . 2012-01-14 00:52        1236816        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll

2012-01-04 19:51 . 2011-08-12 09:46        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-01-04 08:58 . 2012-02-15 15:10        442880        ----a-w-        c:\windows\system32\ntshrui.dll

2012-03-24 18:46 . 2011-05-05 16:13        97208        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Josefa\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Josefa\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Josefa\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

"Facebook Update"="c:\users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-09-29 137536]

"Akamai NetSession Interface"="c:\users\Josefa\AppData\Local\Akamai\netsession_win.exe" [2012-03-13 3331872]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-12-20 9726568]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RtHDVBg.exe" [2010-12-20 1493608]

"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2010-06-21 436264]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-12-20 1594664]

"NUSB3MON"="c:\program files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-12-20 113288]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]

"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"PDFPrint"="e:\program files\PDF24\pdf24.exe" [2011-07-07 216064]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"Nikon Message Center 2"="c:\program files\Nikon\Nikon Message Center 2\NkMC2.exe" [2010-05-25 619008]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]

.

c:\users\Josefa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\nvinit.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotkeyApp]

2009-12-14 10:25        200704        ----a-w-        c:\program files\Launch Manager\HotkeyApp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LMgrVolOSD]

2009-12-11 14:18        348960        ----a-w-        c:\program files\Launch Manager\OSD.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-29 16:38        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe

.

R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-10-27 1620584]

R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-02-15 158856]

R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2010-02-22 9216]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-12-20 193056]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 vpcuxd;USB-Virtualisierungsstubdienst;c:\windows\system32\DRIVERS\vpcuxd.sys [2010-11-20 12800]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-02-19 1343400]

R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-12-20 19656]

S1 MpKsl57b03096;MpKsl57b03096;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{54F4A8B5-DA87-4CCC-B6BA-474F3E57D07F}\MpKsl57b03096.sys [2012-03-29 29904]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-27 236136]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2320920]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-12-20 67624]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-20 61824]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-20 141568]

S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-04-01 1009184]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2009-10-22 118560]

S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2009-05-13 13720]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - MPKSL57B03096

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai        REG_MULTI_SZ           Akamai

.

Inhalt des "geplante Tasks" Ordners

.

2012-03-29 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000Core.job

- c:\users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-29 16:03]

.

2012-03-29 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000UA.job

- c:\users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-29 16:03]

.

.

------- Zusätzlicher Suchlauf -------

.

uInternet Settings,ProxyOverride = <local>

IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105

IE: Free YouTube to MP3 Converter - c:\users\Josefa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 10.158.0.1

TCP: Interfaces\{077ED5A6-0BB6-4BCC-A1B2-0AE4632AF9B1}: NameServer = 194.48.124.202 194.48.124.200

TCP: Interfaces\{94AC04BF-4F2A-4D16-82A5-DCECFEBA9989}: DhcpNameServer = 193.170.110.64

TCP: Interfaces\{94AC04BF-4F2A-4D16-82A5-DCECFEBA9989}\4656661657C647: DhcpNameServer = 192.168.1.2

TCP: Interfaces\{94AC04BF-4F2A-4D16-82A5-DCECFEBA9989}\A4F637566616: DhcpNameServer = 213.153.32.129 213.153.32.1

FF - ProfilePath - c:\users\Josefa\AppData\Roaming\Mozilla\Firefox\Profiles\2t5b1ba2.default\

FF - prefs.js: browser.search.selectedEngine - Google

.

.

------- Dateityp-Verknüpfung -------

.

.scr=AutoCADScriptFile

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-SearchSettings - c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe

MSConfigStartUp-LMgrOSD - c:\program files\Launch Manager\OSDCtrl.exe

MSConfigStartUp-SearchSettings - c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe

AddRemove-toolplugin - c:\users\Josefa\AppData\Local\Temp\WZSE0.TMP\setup.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files\common files\akamai/netsession_win_6c825ce.dll"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DbgagD\1*]

"value"="?\0b\06\13\0d\00\02g"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-03-29  20:54:47

ComboFix-quarantined-files.txt  2012-03-29 18:54

.

Vor Suchlauf: 11 Verzeichnis(se), 40.429.539.328 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 40.361.558.016 Bytes frei

.

- - End Of File - - D16775A9B0A9C2EAD400ED58FC9C976E

 
--- --- ---

cosinus

29.03.2012 20:41

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Smiler12321

30.03.2012 00:21

gmer:

Code:



GMER Logfile:
 

        Code:


        
GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-03-30 00:43:12

Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AJ1

Running: 1g1ktdkg.exe; Driver: C:\Users\Josefa\AppData\Local\Temp\ugdiipog.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwSaveKey + 13C1            82E883D9 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2   82EC1D52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0  Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
 

Device          \Driver\ACPI_HAL \Device\00000050        halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1   fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2   fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3   fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

 
--- --- ---

Osam:

Code:



OSAM Logfile:
 

        Code:


        
Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 00:55:19 on 30.03.2012
 

OS: Windows 7 Ultimate Edition Service Pack 1 (Build 7601), 32-bit

Default Browser: Mozilla Corporation Firefox 11.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000Core.job" - "Facebook Inc." - C:\Users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe

"FacebookUpdateTaskUserS-1-5-21-3033605226-1836221928-3340961897-1000UA.job" - "Facebook Inc." - C:\Users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl

"odbccp32.cpl" - "Microsoft Corporation" - C:\Windows\system32\odbccp32.cpl

"plotman.cpl" - "Autodesk, Inc." - C:\Windows\system32\plotman.cpl

"styleman.cpl" - "Autodesk, Inc." - C:\Windows\system32\styleman.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\MLCFG32.CPL

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%SystemRoot%\system32\drivers\tsusbhub.sys,-1" (tsusbhub) - ? - C:\Windows\System32\drivers\tsusbhub.sys  (File not found)

"catchme" (catchme) - ? - C:\Users\Josefa\AppData\Local\Temp\catchme.sys  (File not found)

"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys

"Synth3dVsc" (Synth3dVsc) - ? - C:\Windows\System32\drivers\synth3dvsc.sys  (File not found)

"VGPU" (VGPU) - ? - C:\Windows\System32\drivers\rdvgkmd.sys  (File not found)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{8A0BC933-7552-42E2-A228-3BE055777227} "AcColumnHandler" - "Autodesk" - C:\Program Files\Common Files\Autodesk Shared\AcShellEx\AcShellExtension.dll

{FC66F851-FFAB-11D1-B226-0000C01A73E9} "Graphisoft Shell Extension 3.0" - "Graphisoft R&D" - C:\Program Files\Graphisoft\ArchiCAD 14\GSShellX32.dll

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{8A0BC933-7552-42E2-A228-3BE055777227} "AcColumnHandler" - "Autodesk" - C:\Program Files\Common Files\Autodesk Shared\AcShellEx\AcShellExtension.dll

{4B392032-A759-43ED-9469-377C80A4472D} "AcDgnImageExtractor" - "Autodesk" - C:\Program Files\Common Files\Autodesk Shared\AcDgnCOM18.dll

{5800AD5B-72C1-477B-9A08-CA112DF06D97} "AcInfoTipHandler" - "Autodesk" - C:\Program Files\Common Files\Autodesk Shared\AcShellEx\AcShellExtension.dll

{36A21736-36C2-4C11-8ACB-D4136F2B57BD} "AcSignIcon" - "Autodesk, Inc." - C:\Windows\system32\AcSignIcon.dll

{AC1DB655-4F9A-4c39-8AD2-A65324A4C446} "ACTHUMBNAIL" - "Autodesk, Inc." - C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll

{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} "Arbeitsbereiche" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{27887764-0D0A-4C3C-B0C6-91A332FFF6A7} "DWFVShellExt Class" - "Autodesk, Inc." - C:\Program Files\Common Files\Autodesk Shared\DWF Common\DWF_VShell.dll

{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A} "Enterprise-Projekte" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL

{09A47860-11B0-4DA5-AFA5-26D86198A780} "EPP" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\shellext.dll

{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll

{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL

{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\MLSHEXT.DLL

{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C} "NvAppShExt Class" - "NVIDIA Corporation" - C:\Windows\system32\nv3dappshext.dll

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{E97DEC16-A50D-49bb-AE24-CF682282E08D} "OpenGLShExt Class" - "NVIDIA Corporation" - C:\Windows\system32\nv3dappshext.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

{E0D79304-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

{E0D79305-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

{E0D79306-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

{E0D79307-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{4871A87A-BFDD-4106-8153-FFDE2BAC2967} "DLM Control" - "Akamai Technologies, Inc." - C:\Windows\DOWNLO~1\DOWNLO~1.OCX / hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10m.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

{67DABFBF-D0AB-41FA-9C46-CC0F21721616} "{67DABFBF-D0AB-41FA-9C46-CC0F21721616}" - ? -   (File not found | COM-object registry key not found) / hxxp://download.divx.com/player/DivXBrowserPlugin.cab

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Josefa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Dropbox.lnk" - "Dropbox, Inc." - C:\Users\Josefa\AppData\Roaming\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Akamai NetSession Interface" - "Akamai Technologies, Inc" - "C:\Users\Josefa\AppData\Local\Akamai\netsession_win.exe"

"Facebook Update" - "Facebook Inc." - "C:\Users\Josefa\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"BCSSync" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices

"IAStorIcon" - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

"MSC" - "Microsoft Corporation" - "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

"Nikon Message Center 2" - "Nikon Corporation" - C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe -s

"NUSB3MON" - "Renesas Electronics Corporation" - "C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

"PDFPrint" - "Geek Software GmbH" - E:\Program Files\PDF24\pdf24.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

"Wbutton" - "Wistron Corp." - "C:\Program Files\Launch Manager\Wbutton.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"PDF-XChange4" - "Tracker Software Products Ltd." - C:\Windows\system32\pxc40pm.dll

"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

"PrintingScout Language Monitor for Xerox Phaser 6140 XPS" - "Xerox Co., Ltd." - C:\Windows\system32\XRMSNL00.DLL
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

"Akamai NetSession Interface" (Akamai) - ? - c:\program files\common files\akamai\netsession_win_6c825ce.dll  (File found, but it contains no detailed information)

"Application Updater" (Application Updater) - ? - "C:\Program Files\Application Updater\ApplicationUpdater.exe"  (File not found)

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\GROOVE.EXE

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

"NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files\Skype\Updater\Updater.exe

"WisLMSvc" (WisLMSvc) - "Wistron Corp." - C:\Program Files\Launch Manager\WisLMSvc.exe

"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
 

===[ Logfile end ]=========================================[ Logfile end ]===

 
--- --- ---
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus

30.03.2012 10:44

Wo ist das Log von aswMBR?

Smiler12321

30.03.2012 11:52

habs 2 mal probiert und is immer wieder abgestürzt... werde es heute naqchmittag nochmal versuchen...

cosinus

30.03.2012 15:04

Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Smiler12321

30.03.2012 19:38

habe das jetzt über den administatoraccount gemacht

Code:



aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-03-30 20:12:41

-----------------------------

20:12:41.766    OS Version: Windows 6.1.7601 Service Pack 1

20:12:41.766    Number of processors: 4 586 0x2505

20:12:41.766    ComputerName: JR_NOTEBOOK  UserName: 

20:12:42.296    Initialize success

20:26:36.831    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

20:26:36.847    Disk 0 Vendor: SAMSUNG_ 2AJ1 Size: 610480MB BusType: 3

20:26:37.221    Disk 0 MBR read successfully

20:26:37.221    Disk 0 MBR scan

20:26:37.221    Disk 0 Windows 7 default MBR code

20:26:37.237    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

20:26:37.253    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        99900 MB offset 206848

20:26:37.268    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       510477 MB offset 204802048

20:26:37.299    Disk 0 scanning sectors +1250258944

20:26:37.377    Disk 0 scanning C:\Windows\system32\drivers

20:26:45.957    Service scanning

20:26:52.104    Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32

20:27:00.653    Modules scanning

20:27:09.155    Disk 0 trace - called modules:

20:27:09.669    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll 

20:27:09.685    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87fa4030]

20:27:09.685    3 CLASSPNP.SYS[8c19359e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x863fc028]

20:27:09.701    Scan finished successfully

20:27:53.084    Disk 0 MBR has been saved successfully to "C:\MBR.dat"

20:27:53.147    The log file has been saved successfully to "C:\aswMBR.txt"

nach deiner anweisung auf (none) umgeshclaten... dnan gings... :)

Code:



aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-03-30 20:39:23

-----------------------------

20:39:23.468    OS Version: Windows 6.1.7601 Service Pack 1

20:39:23.468    Number of processors: 4 586 0x2505

20:39:23.468    ComputerName: JR_NOTEBOOK  UserName: Josefa

20:39:23.873    Initialize success

20:39:27.336    AVAST engine defs: 12032901

20:39:32.048    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

20:39:32.048    Disk 0 Vendor: SAMSUNG_ 2AJ1 Size: 610480MB BusType: 3

20:39:32.110    Disk 0 MBR read successfully

20:39:32.110    Disk 0 MBR scan

20:39:32.110    Disk 0 Windows 7 default MBR code

20:39:32.141    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

20:39:32.157    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        99900 MB offset 206848

20:39:32.172    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       510477 MB offset 204802048

20:39:32.204    Disk 0 scanning sectors +1250258944

20:39:32.344    Disk 0 scanning C:\Windows\system32\drivers

20:39:56.805    Service scanning

20:40:07.460    Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32

20:40:20.907    Modules scanning

20:40:36.148    Disk 0 trace - called modules:

20:40:36.179    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll 

20:40:36.179    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87fa4030]

20:40:36.195    3 CLASSPNP.SYS[8c19359e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x863fc028]

20:40:36.195    Scan finished successfully

20:40:47.177    Disk 0 MBR has been saved successfully to "C:\Users\Josefa\Desktop\MBR.dat"

20:40:47.177    The log file has been saved successfully to "C:\Users\Josefa\Desktop\aswMBR.txt"

cosinus

30.03.2012 20:20

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Smiler12321

31.03.2012 08:33

teil 1: scan mit malwarebytes... teil 2 folgt noch...

Code:



Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.03.31.03
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 8.0.7601.17514

Josefa :: JR_NOTEBOOK [Administrator]
 

Schutz: Aktiviert
 

31.03.2012 08:21:01

mbam-log-2012-03-31 (08-21-01).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 423170

Laufzeit: 1 Stunde(n), 5 Minute(n), 41 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Smiler12321

02.04.2012 23:32

so nun endlich mal (hab endlich wieder internet zum posten :) ) teil 2:

Code:



SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 04/03/2012 at 00:27 AM
 

Application Version : 5.0.1146
 

Core Rules Database Version : 8402

Trace Rules Database Version: 6214
 

Scan type       : Complete Scan

Total Scan Time : 01:06:48
 

Operating System Information

Windows 7 Ultimate 32-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Limited User
 

Memory items scanned      : 689

Memory threats detected   : 0

Registry items scanned    : 36625

Registry threats detected : 0

File items scanned        : 168529

File threats detected     : 404
 

Adware.Tracking Cookie

        C:\Users\Josefa\AppData\Roaming\Microsoft\Windows\Cookies\LXX7B4ID.txt [ /atdmt.com ]

        C:\Users\Josefa\AppData\Roaming\Microsoft\Windows\Cookies\88TG2ZLN.txt [ /c.atdmt.com ]

        C:\USERS\ADMINISTRATOR\AppData\Roaming\Microsoft\Windows\Cookies\0KXP09B7.txt [ Cookie:administrator@revsci.net/ ]

        C:\USERS\ADMINISTRATOR\AppData\Roaming\Microsoft\Windows\Cookies\1QLHR9C2.txt [ Cookie:administrator@doubleclick.net/ ]

        C:\USERS\ADMINISTRATOR\AppData\Roaming\Microsoft\Windows\Cookies\3KH7DSMX.txt [ Cookie:administrator@ad.yieldmanager.com/ ]

        C:\USERS\ADMINISTRATOR\Cookies\0KXP09B7.txt [ Cookie:administrator@revsci.net/ ]

        C:\USERS\ADMINISTRATOR\Cookies\1QLHR9C2.txt [ Cookie:administrator@doubleclick.net/ ]

        C:\USERS\ADMINISTRATOR\Cookies\3KH7DSMX.txt [ Cookie:administrator@ad.yieldmanager.com/ ]

        C:\USERS\JOSEFA\Cookies\LXX7B4ID.txt [ Cookie:josefa@atdmt.com/ ]

        C:\USERS\JOSEFA\Cookies\88TG2ZLN.txt [ Cookie:josefa@c.atdmt.com/ ]

        .atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        eas4.emediate.eu [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        eas4.emediate.eu [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .eyewonder.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .msnportal.112.2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .specificclick.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .a.revenuemax.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .legolas-media.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .eyewonder.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adxpose.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .gostats.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .estat.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .conrad.122.2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        stat.onestat.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        stat.onestat.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .questionmarket.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .questionmarket.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.zanox-affiliate.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        adserver.adreactor.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .advert-layer.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .advert-layer.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        wmedia.rotator.hadj7.adjuggler.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        wmedia.rotator.hadj7.adjuggler.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ads.247activemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        adsrv1.admediate.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .gostats.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .aim4media.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .yieldmanager.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .game-advertising-online.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ads.adxvalue.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ads.adxvalue.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ads.adxvalue.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ads.adxvalue.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .trackalyzer.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .ru4.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .4fuckr.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .4fuckr.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.adition.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.adition.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .wolverineworldwide.112.2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .pro-market.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .hightraffic.hugoboss.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        partners.webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.usenext.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .xm.xtendmedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .velmedia.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .my-adserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .my-adserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adsrv1.admediate.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .guj.122.2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .myhammer.122.2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .getclicky.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .static.getclicky.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        in.getclicky.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        banner.supralift.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .ad.velmedia.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .ad.velmedia.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .technoratimedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        adserver.yopi.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        adserver.yopi.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.active-tracking.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.active-tracking.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.active-tracking.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tribalfusion.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adform.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.adserver01.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .findmeatune.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .findmeatune.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        stat.onestat.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.mediamarkt.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        banner.testberichte.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        eas4.emediate.eu [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .4stats.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .4stats.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        banner.lesarion.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        track.webtrekk.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.traffective-tracking.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.traffective-tracking.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .mmstat.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .kontera.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .legolas-media.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .legolas-media.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .at.atwola.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .ru4.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .mediafire.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .lucidmedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .mediafire.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .mediafire.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        fidelity.rotator.hadj7.adjuggler.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        fidelity.rotator.hadj7.adjuggler.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        tracking1.aleadpay.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .yadro.ru [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        openx1.overadmedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        7.rotator.wigetmedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.dyntracker.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .blogads.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .blogads.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        studivz.adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        studivz.adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .statcounter.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad4.adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .content.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .bshg.122.2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .clickfuse.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        nedstat.hostelbookers.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        nedstat.hostelbookers.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webresint.122.2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        adserver.plus.ag [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .quartermedia.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .solar-tracking.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .solar-tracking.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad1.adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .c1.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .c1.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        butlers.traffective-tracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .azjmp.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .azjmp.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        tracking1.aleadpay.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        7.rotator.wigetmedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .findhe.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        tracking.hostgator.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .content.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        zeroadserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .overture.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .overture.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .overture.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .sp-adhitcounter.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        trekmedia.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        trekmedia.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .myroitracking.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .clicksor.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .clicksor.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.trekmedia.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .clicksor.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .clicksor.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .clicksor.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        trekmedia.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        easyonlinebuxxx.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .kaspersky.122.2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .clickfuse.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        statse.webtrendslive.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ww251.smartadserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .h.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .h.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .h.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .h.atdmt.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.dyntracker.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        www.zanox-affiliate.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .zanox-affiliate.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.dyntracker.de [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        banner.lesarion.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad3.adfarm1.adition.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\JOSEFA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2T5B1BA2.DEFAULT\COOKIES.SQLITE ]
 

Adware.Toolbar-Dealio

        C:\_OTL\MOVEDFILES\03262012_174223\C_PROGRAM FILES\APPLICATION UPDATER\APPLICATIONUPDATER.EXE

        C:\_OTL\MOVEDFILES\03262012_174223\C_PROGRAM FILES\COMMON FILES\SPIGOT\SEARCH SETTINGS\SEARCHSETTINGS.EXE

cosinus

03.04.2012 15:45

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Smiler12321

03.04.2012 16:02

soll ich das alles löschen lassen was da gefunden wurde? neben den cookies is ja noch die eine toolbar gefunden worden...

bisher hab ich auch keinerlei icons aufm desktop... sons läuft alles wieder super :taenzer:

cosinus

03.04.2012 18:29

Ja die Cookies können weg

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

cosinus

03.04.2012 18:29

Smiler12321

12.04.2012 13:52

hey arne...
ich habe nachdem was du geschrieben hast alles das gemacht und dann secunia installiert... hat dann auch alles upgedatet... auch alle updates die von windows gefordert sind... bis auf eines...
programm: Microsoft Windows 7
securitypatch: KB2633171
die einstufung wie sicher mein system ist liegt bei 2 von 5 sternen... habe auch schon mrt drüberlaufen lassen, was auch 3 dateien gefunden hat, eine sogar mit namen trojaner*** ... eine log datei vom mrt hab ich nicht gefunden...
habe dann auch versucht den patch von der microsoft seite runterzuladen aber hat dann auch nix geholfen als ich das dann doppelt angeklickt hab...

hast du ne ahnung was ich machen kann?

lg

achso und nachm update kommt immer ein fehlercode...

Code 8007065E

cosinus

12.04.2012 15:43

Seit wann verteilt Secunia Sterne - die System Score in Prozent angegeben!

Zum Patch kann das evtl weiterhelfen Windows Update: Update Installation bricht immer ab - Probleme mit Patches und Windows Update

Alle Zeitangaben in WEZ +1. Es ist jetzt 16:40 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131