Trojaner-Board - Bundespolizei-Trojaner - Systemwiederherstellung durchgeführt

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Bundespolizei-Trojaner - Systemwiederherstellung durchgeführt - Sytem sauber? logs inside (https://www.trojaner-board.de/118890-bundespolizei-trojaner-systemwiederherstellung-durchgefuehrt-sytem-sauber-logs-inside.html)

Bundespolizei-Trojaner - Systemwiederherstellung durchgeführt - Sytem sauber? logs inside

Hallo,

ich habe mir gestern den Bundespolizei-Trojaner eingefangen und dann einen Systemwiederherstellungspunkt vom Vortag ausgeführt. Der Trojaner scheint weg zu sein, aber ist mein System auch wirklich sicher? Bin mir sehr unsicher, z.B. geht Strg+Alt+Entf nicht mehr, oder auch Strg + v geht ebenso nicht mehr ... sind für mich komische Anzeichen.

Über Hilfe würde ich mich sehr freuen.

Vielen Dank

Gruß

----------------------------------------------------------------------

Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.08.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Myself :: MYSELF-PC [Administrator]

Schutz: Deaktiviert

08.07.2012 16:44:03
mbam-log-2012-07-08 (16-44-03).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 358140
Laufzeit: 58 Minute(n), 23 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

----------------------------------------------------------------------

OTL Logfile:

Code:

OTL logfile created on: 08.07.2012 17:50:14 - Run 1

OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\Myself\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,74 Gb Total Physical Memory | 6,36 Gb Available Physical Memory | 82,09% Memory free

15,49 Gb Paging File | 13,91 Gb Available in Paging File | 89,80% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 297,99 Gb Total Space | 167,13 Gb Free Space | 56,09% Space Free | Partition Type: NTFS

 

Computer Name: MYSELF-PC | User Name: Myself | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.07.07 16:47:53 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Myself\Desktop\OTL.exe

PRC - [2012.05.08 15:04:41 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.05.08 15:04:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.05.08 15:04:41 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.11.25 17:32:36 | 000,687,400 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe

PRC - [2010.10.01 15:44:58 | 000,280,120 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe

PRC - [2010.09.27 18:29:26 | 000,092,216 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

PRC - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2011.03.16 02:54:10 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2012.06.23 19:46:17 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.06.17 00:20:58 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.05.08 15:04:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.05.08 15:04:41 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.11.25 17:32:36 | 000,687,400 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) @C:\Program Files (x86)

SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)

SRV - [2010.10.01 15:44:58 | 000,280,120 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe -- (hpHotkeyMonitor)

SRV - [2010.09.27 18:29:26 | 000,092,216 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)

SRV - [2010.09.08 13:05:34 | 000,271,360 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Programme\IDT\WDM\stacsv64.exe -- (STacSV)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.03.02 13:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Programme\IDT\WDM\AESTSr64.exe -- (AESTFilters)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.05.08 15:04:41 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2012.05.08 15:04:41 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2012.02.24 11:14:42 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)

DRV:64bit: - [2012.02.24 11:14:42 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)

DRV:64bit: - [2012.02.12 15:34:39 | 000,503,352 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)

DRV:64bit: - [2012.02.12 12:46:20 | 003,063,360 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)

DRV:64bit: - [2011.12.15 16:00:00 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)

DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)

DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)

DRV:64bit: - [2011.03.16 03:14:36 | 006,862,848 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2011.03.16 02:20:10 | 000,264,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.02.08 12:03:24 | 002,374,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

DRV:64bit: - [2010.11.21 05:24:43 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.21 05:23:48 | 000,117,248 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tsusbhub.sys -- (tsusbhub)

DRV:64bit: - [2010.11.21 05:23:48 | 000,088,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Synth3dVsc.sys -- (Synth3dVsc)

DRV:64bit: - [2010.11.21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)

DRV:64bit: - [2010.11.21 05:23:48 | 000,034,816 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)

DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2010.11.17 09:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2010.09.08 13:05:34 | 000,515,584 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)

DRV:64bit: - [2010.06.03 20:18:56 | 001,379,376 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2010.06.02 16:08:38 | 000,025,912 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV:64bit: - [2010.05.03 15:44:02 | 000,331,880 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2010.03.09 23:03:52 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) AMD PCI Express (3GIO)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2010.07.01 19:11:24 | 000,012,352 | ---- | M] () [Kernel | Unavailable | Unknown] -- C:\Programme\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6A D4 1A B2 1C 5D CD 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.17 00:20:58 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.02.12 13:01:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Myself\AppData\Roaming\mozilla\Extensions

[2012.05.02 13:40:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Myself\AppData\Roaming\mozilla\Firefox\Profiles\7wj5tk5k.default\extensions

[2012.03.04 15:49:40 | 000,000,000 | ---D | M] (Complitly - Speed up your search with your personal search suggestions tool) -- C:\Users\Myself\AppData\Roaming\mozilla\Firefox\Profiles\7wj5tk5k.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}

[2012.03.18 09:59:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.06.17 00:20:58 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.02.08 19:36:16 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.08 19:36:16 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)

O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [QLBController] C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D5F06006-4B42-4C27-A6E8-D98FC5B3AF6F}: NameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DB50102F-D1ED-4138-B01E-BFAF302D09BA}: NameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.07.07 18:34:14 | 000,000,000 | ---D | C] -- C:\Users\Myself\AppData\Roaming\Malwarebytes

[2012.07.07 18:33:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.07.07 18:33:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.07.07 18:33:58 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.07.07 18:33:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.07.07 16:56:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.07.07 16:56:01 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.07.07 16:51:53 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Myself\Desktop\mbam-setup-1.61.0.1400.exe

[2012.07.07 16:50:23 | 003,889,704 | ---- | C] (Piriform Ltd) -- C:\Users\Myself\Desktop\ccsetup320.exe

[2012.07.07 16:47:50 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Myself\Desktop\OTL.exe

[2012.07.07 15:32:44 | 000,000,000 | ---D | C] -- C:\Users\Myself\AppData\Roaming\Xeibov

[2012.07.05 21:35:02 | 000,000,000 | ---D | C] -- C:\Users\Myself\Desktop\Wandern

[2012.06.30 18:29:41 | 000,000,000 | ---D | C] -- C:\Users\Myself\Desktop\Linking Park

[2012.06.18 11:08:14 | 000,000,000 | ---D | C] -- C:\Users\Myself\AppData\Local\Macromedia

[2012.06.11 13:58:28 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\System32

[1 C:\Users\Myself\Desktop\*.tmp files -> C:\Users\Myself\Desktop\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.07.08 17:54:22 | 001,507,342 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.07.08 17:54:22 | 000,657,910 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.07.08 17:54:22 | 000,619,146 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.07.08 17:54:22 | 000,131,250 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.07.08 17:54:22 | 000,107,466 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.07.08 17:54:21 | 000,028,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.07.08 17:54:21 | 000,028,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.07.08 17:46:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.07.08 17:46:47 | 1941,094,399 | -HS- | M] () -- C:\hiberfil.sys

[2012.07.08 17:46:03 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.07.08 17:45:16 | 000,000,020 | ---- | M] () -- C:\Users\Myself\defogger_reenable

[2012.07.07 18:33:59 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.07.07 18:17:14 | 000,050,477 | ---- | M] () -- C:\Users\Myself\Desktop\Defogger.exe

[2012.07.07 16:51:59 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Myself\Desktop\mbam-setup-1.61.0.1400.exe

[2012.07.07 16:50:26 | 003,889,704 | ---- | M] (Piriform Ltd) -- C:\Users\Myself\Desktop\ccsetup320.exe

[2012.07.07 16:47:53 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Myself\Desktop\OTL.exe

[2012.07.06 14:45:47 | 000,054,015 | ---- | M] () -- C:\Users\Myself\183071_105598086186381_3878415_n.jpg

[2012.07.06 10:52:00 | 000,000,655 | ---- | M] () -- C:\Users\Myself\Documents\ax_files.xml

[2012.07.04 09:49:10 | 000,001,531 | ---- | M] () -- C:\Windows\wininit.ini

[2012.06.29 19:26:07 | 1249,595,178 | ---- | M] () -- C:\Users\Myself\Desktop\lame.mkv

[2012.06.23 01:40:57 | 582,600,704 | ---- | M] () -- C:\Users\Myself\Desktop\take cd2.avi

[2012.06.23 01:38:15 | 609,087,488 | ---- | M] () -- C:\Users\Myself\Desktop\take cd1.avi

[2012.06.13 13:40:37 | 000,413,624 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[1 C:\Users\Myself\Desktop\*.tmp files -> C:\Users\Myself\Desktop\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.07.08 17:45:16 | 000,000,020 | ---- | C] () -- C:\Users\Myself\defogger_reenable

[2012.07.07 18:33:59 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.07.07 18:17:14 | 000,050,477 | ---- | C] () -- C:\Users\Myself\Desktop\Defogger.exe

[2012.07.06 17:57:48 | 1249,595,178 | ---- | C] () -- C:\Users\Myself\Desktop\lame.mkv

[2012.07.06 14:45:44 | 000,054,015 | ---- | C] () -- C:\Users\Myself\183071_105598086186381_3878415_n.jpg

[2012.07.06 14:07:17 | 3741,417,471 | ---- | C] () -- C:\Users\Myself\Desktop\Wallander - DB.iso

[2012.07.05 21:28:50 | 4161,404,927 | ---- | C] () -- C:\Users\Myself\Desktop\Wallander - DF.iso

[2012.07.05 21:13:45 | 582,600,704 | ---- | C] () -- C:\Users\Myself\Desktop\take cd2.avi

[2012.07.05 21:13:28 | 609,087,488 | ---- | C] () -- C:\Users\Myself\Desktop\take cd1.avi

[2012.07.03 01:26:20 | 3422,036,053 | ---- | C] () -- C:\Users\Myself\Desktop\Der.Mann.mkv

[2012.06.11 10:41:39 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.02 19:03:29 | 000,001,531 | ---- | C] () -- C:\Windows\wininit.ini

[2012.02.12 17:36:29 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.02.12 12:14:06 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.03.02 07:57:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe

[2011.03.02 07:57:40 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll

[2011.03.02 07:57:40 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll

[2011.03.02 07:57:40 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll

[2011.03.02 07:57:40 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll

 
 ========== LOP Check ==========

 

[2012.03.13 21:16:55 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\IrfanView

[2012.02.12 16:37:03 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Leadertech

[2012.02.12 14:24:45 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Miranda Fusion

[2012.02.12 22:16:10 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\PacificPoker

[2012.03.13 20:58:59 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\PhotoFiltre

[2012.05.12 12:41:25 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Samsung

[2012.07.07 15:33:23 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Xeibov

[2012.05.11 14:45:45 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

----------------------------------------------------------------------

OTL Logfile:

Code:

OTL Extras logfile created on: 08.07.2012 17:50:14 - Run 1

OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\Myself\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,74 Gb Total Physical Memory | 6,36 Gb Available Physical Memory | 82,09% Memory free

15,49 Gb Paging File | 13,91 Gb Available in Paging File | 89,80% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 297,99 Gb Total Space | 167,13 Gb Free Space | 56,09% Space Free | Partition Type: NTFS

 

Computer Name: MYSELF-PC | User Name: Myself | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{23C301C7-BDA3-46FA-AE98-142DFBF2A85D}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{299D58E5-F116-4BFE-85EF-D7A2954AFDF7}" = lport=139 | protocol=6 | dir=in | app=system | 

"{311DEDE6-99BF-4FE9-B052-5C5A17E7C8D3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{729FD71D-9BB1-49B5-BCCE-1BBCF8A6A635}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{7EC3ED81-4F57-4925-8859-F851466B58FA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{86F36B87-E98D-473C-9980-5DB24A655484}" = lport=445 | protocol=6 | dir=in | app=system | 

"{93299D4B-2F12-45F8-878F-A85C3001F3F0}" = rport=445 | protocol=6 | dir=out | app=system | 

"{A02FD18C-0771-45BD-BBAD-D3826AEE49DD}" = rport=137 | protocol=17 | dir=out | app=system | 

"{A438C1D0-3FD9-41ED-9CC1-445A92852215}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A8C45F52-7D3A-46CE-8258-04D7048FB0C2}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{B4326025-9681-4FFD-B013-249F8D84E5BF}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{C743921E-D214-4414-9987-697807513704}" = lport=137 | protocol=17 | dir=in | app=system | 

"{CA394C06-6208-4E6F-A03A-E7014E143C50}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{D7429BF6-9FD3-49C2-BD8B-0861797020D7}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{DAF7030D-A5B9-4E17-A246-1B3626C2E16A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{DB88D2BE-F564-48F5-8F08-106271AABCB7}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{DD95602E-54EC-4126-8B5D-5908D568A615}" = rport=139 | protocol=6 | dir=out | app=system | 

"{EF0CE250-9646-43B7-879E-23E00A8A7D01}" = rport=138 | protocol=17 | dir=out | app=system | 

"{F5E8A6E5-2F64-4648-8D2E-7EB0D350566B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{F68168C5-E7EA-4177-8887-A42ED984F82E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{F79BC302-0C8C-4FF0-BECA-8C23CD0CDE71}" = lport=138 | protocol=17 | dir=in | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{015C7763-F93D-4231-AF6E-A54123FDB549}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{088A792D-BB36-4B08-B847-81F008FCAF0E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{0AB61115-BF6E-4D59-A3DC-AC35E7ACF05A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{0D0B7441-63F8-4595-B8AD-1B309437E4D3}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{10332853-18A8-4E17-A744-D2D4B0EE763F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{4AD11F93-4E6E-4C0A-9642-3A3DE4631666}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{6F2FBEEC-41C5-4664-A37F-8675199BC89B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{714ADD09-CD1E-432C-8A44-E2EFB70BFFB7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{72F16791-F959-4C91-A512-4A5FCA232A56}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{743E21E7-23BF-46A1-9C0B-DDF7BD8522EA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{871AB04D-7CAC-4B14-A679-C152C5A4C3EB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{90D9E07C-022D-44D7-80D3-259A404CE655}" = protocol=6 | dir=out | app=system | 

"{97663165-3C2B-4538-9C92-FB841DA685E1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{9A031E13-45EA-497F-92A5-37BC9B025F90}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{A89B6BB1-B059-490B-9FA8-FAB295D487C3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{A9F66BC9-C311-44AD-9721-070A7EAA26EA}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{E27381F8-9A51-4360-A12F-4B2E78F5DF30}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{F2182E00-5A21-4E94-93F5-74D352491C0C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{FF7B6F95-89C9-4174-B121-0BB755FCF7AB}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{014C6C60-4916-48F7-916E-E8048E12E9F1}" = HP HotKey Support

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{8FCB2935-2D33-166F-CCF3-0BFC02419983}" = ccc-utility64

"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007

"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007

"{9DFEC455-86B1-95C7-3189-B922131869E0}" = WMV9/VC-1 Video Playback

"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones

"{D6120CE6-6591-A00E-E7EA-02CC3F47BF11}" = ATI Catalyst Install Manager

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Broadcom 802.11 Wireless LAN Adapter" = Broadcom 802.11 Wireless LAN Adapter

"CCleaner" = CCleaner

"EPSON SX110 Series" = Druckerdeinstallation für EPSON SX110 Series

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"sp6" = Logitech SetPoint 6.32

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"Unlocker" = Unlocker 1.9.1-x64

"WinRAR archiver" = WinRAR 4.10 (64-Bit)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00789D75-DD2A-CC46-AC78-06A845E785AF}" = CCC Help Finnish

"{01E9B2FF-DAF4-4529-9CC9-2101625517C7}" = nero.prerequisites.msi

"{034DCAF9-96E7-4936-9A07-712F80B5181E}" = Nero RescueAgent 11

"{0E9A5816-8E92-577D-9BC8-2CCBD1D1C46D}" = CCC Help Polish

"{0EA30CC1-C0FA-036E-9F2E-50CDDDF47ED0}" = CCC Help Spanish

"{11D3EF85-63E1-4AE4-A7C1-9241BDB16B51}" = Nero ControlCenter 11

"{19BE5A8D-9390-3019-653B-840757E69F9B}" = Catalyst Control Center Localization All

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31

"{31B86234-2E65-A855-8A14-47C253C38FD9}" = CCC Help Dutch

"{3C87C43B-0693-6941-8AFE-CD6011C73D5A}" = CCC Help Thai

"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg

"{40B8FAC4-BB82-5F03-D15B-BD2D355D8F8A}" = CCC Help Swedish

"{41DEF013-805A-8D82-B72E-6D1496ED3150}" = CCC Help Chinese Standard

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{53F7746A-96AA-49A5-86B8-59989680DAC5}" = Nero Burning ROM 11 Help (CHM)

"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module

"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update

"{700E89B8-C157-34B5-E68C-6017823E6424}" = CCC Help Korean

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{712B481B-96DD-0065-6B14-57497730995D}" = CCC Help French

"{71CDBB06-7EB2-576E-F8EF-46A58F151E4E}" = CCC Help English

"{74443BC6-ED97-9A1B-52C4-B23D400D8255}" = CCC Help Italian

"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"{7CAC2022-01CD-4FFD-4A29-089A676261CD}" = CCC Help Portuguese

"{7F292B05-7C7E-F016-6A7A-6FF74838B149}" = CCC Help Russian

"{90120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007

"{90120000-0014-0000-0000-0000000FF1CE}_PRO_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0015-0407-0000-0000000FF1CE}_PRO_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_PRO_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_PRO_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}_PRO_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}_PRO_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_PRO_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_PRO_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_PRO_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_PRO_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_PRO_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-002A-0000-1000-0000000FF1CE}_PRO_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-002A-0407-1000-0000000FF1CE}_PRO_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_PRO_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{9135F223-3ED1-C424-93F9-3F4FB3F80C2F}" = CCC Help Danish

"{95140000-0080-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector

"{9596B7FA-9226-02D9-E417-C4CF064E5BEF}" = ccc-core-static

"{96E3AED5-3D0B-4BB0-84C2-1EDADB204487}" = FlashFXP v4.1

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch

"{ACE3B3C3-2063-BBAD-BD77-DFEE4E5034B9}" = CCC Help Turkish

"{B1846721-A8E6-46C7-83B6-0DCF7ADB4267}" = Nero Burning ROM 11

"{B2D3F27F-1602-195B-A546-13A288D24F32}" = CCC Help German

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components 11

"{C34B71C9-08A9-C73D-026B-D0D9AED1E0A2}" = CCC Help Norwegian

"{C4C73A45-1D4D-5875-A5C6-F3DAA8A75D8D}" = Catalyst Control Center InstallProxy

"{CF01D4F2-D8B0-2CD5-11F4-778A074255E7}" = CCC Help Hungarian

"{D01CE99A-8802-483C-A79F-298B691EB432}" = Nero RescueAgent 11 Help (CHM)

"{D4D66270-9147-4BDF-9946-FCA2B303AA8F}" = Nero ControlCenter 11 Help (CHM)

"{D5E3F9E2-FB26-F760-41BC-A9D6244C128E}" = CCC Help Chinese Traditional

"{DA9660B6-F1DD-41D3-BA3C-E7F7BF9921B2}" = Catalyst Control Center - Branding

"{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}" = LightScribe System Software

"{E220706D-CBD0-EA07-4175-081A1C10E161}" = CCC Help Greek

"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio

"{E72EC29C-9853-4CC2-1F18-3A288C9A1FA8}" = CCC Help Czech

"{EFE4AB7D-4E94-441B-9A86-98E69E37567B}" = Nero Burning ROM 11

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{F5A538B0-42B0-6F7E-3BC9-B8F5B032FA09}" = CCC Help Japanese

"{F5F16745-6FCB-4134-83F9-2688ACFF5DC9}" = HP ESU for Microsoft Windows 7

"{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}" = Realtek Ethernet Controller All-In-One Windows Driver

"888poker" = 888poker

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Avira AntiVir Desktop" = Avira Free Antivirus

"Betfair Poker_is1" = Betfair Poker 1.0.0

"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"IrfanView" = IrfanView (remove only)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400

"MirandaFusion" = Miranda Fusion 3.1.15.1

"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"PKR" = PKR

"Poker Heaven " = Poker Heaven

"PokerStars" = PokerStars

"PRO" = Microsoft Office Professional 2007

"SopCast" = SopCast 3.5.0

"Veetle TV" = Veetle TV

"VLC media player" = VLC media player 2.0.1

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"FoxTab FLV Player" = FoxTab FLV Player

"PhotoFiltre" = PhotoFiltre

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 28.06.2012 03:30:02 | Computer Name = Myself-PC | Source = Microsoft-Windows-EapHost | ID = 2002

Description = Überspringen: Eap method DLL path name Fehler bei der Überprüfung.

 Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

 

Error - 28.06.2012 03:30:09 | Computer Name = Myself-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 28.06.2012 18:35:12 | Computer Name = Myself-PC | Source = Microsoft-Windows-EapHost | ID = 2002

Description = Überspringen: Eap method DLL path name Fehler bei der Überprüfung.

 Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

 

Error - 28.06.2012 18:35:19 | Computer Name = Myself-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 29.06.2012 04:11:02 | Computer Name = Myself-PC | Source = Microsoft-Windows-EapHost | ID = 2002

Description = Überspringen: Eap method DLL path name Fehler bei der Überprüfung.

 Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

 

Error - 29.06.2012 04:11:09 | Computer Name = Myself-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 30.06.2012 04:16:47 | Computer Name = Myself-PC | Source = Microsoft-Windows-EapHost | ID = 2002

Description = Überspringen: Eap method DLL path name Fehler bei der Überprüfung.

 Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

 

Error - 30.06.2012 04:16:54 | Computer Name = Myself-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 01.07.2012 03:42:13 | Computer Name = Myself-PC | Source = Microsoft-Windows-EapHost | ID = 2002

Description = Überspringen: Eap method DLL path name Fehler bei der Überprüfung.

 Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

 

Error - 01.07.2012 03:42:20 | Computer Name = Myself-PC | Source = WinMgmt | ID = 10

Description = 

 

[ OSession Events ]

Error - 25.03.2012 09:26:38 | Computer Name = Myself-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 20914

 seconds with 120 seconds of active time.  This session ended with a crash.

 

Error - 22.05.2012 15:10:39 | Computer Name = Myself-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 23931

 seconds with 240 seconds of active time.  This session ended with a crash.

 

[ System Events ]

Error - 07.07.2012 09:48:20 | Computer Name = Myself-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "SMB-Miniredirector-Wrapper und -Modul" ist vom Dienst 

"Umgeleitetes Puffersubsystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet

 wurde:   %%31

 

Error - 07.07.2012 09:48:20 | Computer Name = Myself-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "SMB 1.x-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper

 und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 07.07.2012 09:48:20 | Computer Name = Myself-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "SMB 2.0-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper

 und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 07.07.2012 09:48:20 | Computer Name = Myself-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst"

 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 07.07.2012 09:48:20 | Computer Name = Myself-PC | Source = Service Control Manager | ID = 7026

Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:

   AFD  avipbb  avkmgr  CSC  DfsC  discache  NetBIOS  NetBT  nsiproxy  Psched  rdbss  spldr  sptd  tdx  vwififlt

Wanarpv6

WfpLwf

 

Error - 07.07.2012 10:17:05 | Computer Name = Myself-PC | Source = Service Control Manager | ID = 7024

Description = Der Dienst "Avira Echtzeit Scanner" wurde mit folgendem dienstspezifischem

 Fehler beendet: %%306.

 

Error - 07.07.2012 10:17:41 | Computer Name = Myself-PC | Source = Service Control Manager | ID = 7024

Description = Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem

 Fehler beendet: %%-2147023143.

 

Error - 07.07.2012 10:26:43 | Computer Name = Myself-PC | Source = Service Control Manager | ID = 7024

Description = Der Dienst "Avira Echtzeit Scanner" wurde mit folgendem dienstspezifischem

 Fehler beendet: %%306.

 

Error - 08.07.2012 09:46:34 | Computer Name = Myself-PC | Source = Service Control Manager | ID = 7024

Description = Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem

 Fehler beendet: %%-2147023143.

 

Error - 08.07.2012 11:47:30 | Computer Name = Myself-PC | Source = Service Control Manager | ID = 7024

Description = Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem

 Fehler beendet: %%-2147023143.

 

 

< End of report >

--- --- ---

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Ja, da ist noch ein Log, den hatte ich vorher gemacht aber das war nur ein Quick Scan ...

Malwarebytes Anti-Malware (Test) 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.07.07.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Myself :: MYSELF-PC [Administrator]

Schutz: Aktiviert

07.07.2012 18:35:16
mbam-log-2012-07-07 (18-35-16).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 226657
Laufzeit: 1 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\Myself\AppData\Roaming\logs.dat (Bifrose.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Führ bitte auch ESET aus, danach sehen wir weiter.

Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden.

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.

Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen
Dein Anti-Virus-Programm während des Scans deaktivieren.

Button http://img695.imageshack.us/img695/1599/eset1l.jpg (<< klick) drücken.
- Firefox-User:
  Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
- IE-User:
  müssen das Installieren eines ActiveX Elements erlauben.
Setze den einen Haken bei Yes, i accept the Terms of Use.
Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
Warte bis die Komponenten herunter geladen wurden.
Setze einen Haken bei "Scan archives".
Gehe sicher das bei Remove Found Threats kein Hacken gesetzt ist.
http://img707.imageshack.us/img707/687/starteg.jpg drücken.
Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.

Wenn der Scan beendet wurde

Klicke Finish.
Browser schließen.

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und kopiere folgenden Text in das Ausführen Fenster.

Code:

"%PROGRAMFILES%\Eset\Eset Online Scanner\log.txt"

Hinweis: Falls du ein 64-Bit-Windows einsetzt, lautet der Pfad so:

Code:

"%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\log.txt"

Poste nun den Inhalt der log.txt.

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=95e76623bdad2140a9f4d9f89b83a2b9
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-12 09:28:12
# local_time=2012-07-12 11:28:12 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 13083099 13083099 0 0
# compatibility_mode=5893 16776574 100 94 31389316 93754237 0 0
# compatibility_mode=8192 67108863 100 0 1411 1411 0 0
# scanned=167597
# found=1
# cleaned=0
# scan_time=4105
C:\Program Files (x86)\FoxTabFLVPlayer\FLVPlayer.exe a variant of Win32/InstallCore.A application (unable to clean) 00000000000000000000000000000000 I

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

zu 1. Es geht alles, einziges Problem: Tastenkürzel wie strg + c, strg + v oder strg + alt + entf funktionieren nicht, ebenso geht strg + f nicht.

Manuell kann ich die alle ausführen, also Rechtsklick kopieren, einfügen oder den Taskmanager aufrufen, nur über Tastenkürzel geht nichts.

zu 2. da ist mir nichts aufgefallen, alles da und sieht aus wie vorher.

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

# AdwCleaner v1.702 - Logfile created 07/13/2012 at 23:23:23
# Updated 13/07/2012 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)
# User : Myself - MYSELF-PC
# Running from : C:\Users\Myself\Desktop\adwcleaner0.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

Folder Found : C:\Users\Myself\AppData\Roaming\Mozilla\Firefox\Profiles\7wj5tk5k.default\extensions\{33E0DAA6-3AF3-D8B5-6752-10E949C61516}
Folder Found : C:\ProgramData\boost_interprocess

***** [Registry] *****

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default
File : C:\Users\Myself\AppData\Roaming\Mozilla\Firefox\Profiles\7wj5tk5k.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1403 octets] - [13/07/2012 23:23:23]

########## EOF - C:\AdwCleaner[R1].txt - [1531 octets] ##########

Bitte die Logs in CODE-Tags posten!

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Code:

# AdwCleaner v1.702 - Logfile created 07/14/2012 at 14:27:14

# Updated 13/07/2012 by Xplode

# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)

# User : Myself - MYSELF-PC

# Running from : C:\Users\Myself\Desktop\adwcleaner0.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Deleted : C:\Users\Myself\AppData\Roaming\Mozilla\Firefox\Profiles\7wj5tk5k.default\extensions\{33E0DAA6-3AF3-D8B5-6752-10E949C61516}

Folder Deleted : C:\ProgramData\boost_interprocess
 

***** [Registry] *****
 
 

***** [Registre - GUID] *****
 

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v13.0.1 (de)
 

Profile name : default 

File : C:\Users\Myself\AppData\Roaming\Mozilla\Firefox\Profiles\7wj5tk5k.default\prefs.js
 

[OK] File is clean.
 

*************************
 

AdwCleaner[R1].txt - [1528 octets] - [13/07/2012 23:23:23]

AdwCleaner[S1].txt - [1387 octets] - [14/07/2012 14:27:14]
 

########## EOF - C:\AdwCleaner[S1].txt - [1515 octets] ##########

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 14.07.2012 16:50:52 - Run 2

OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Myself\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,74 Gb Total Physical Memory | 6,62 Gb Available Physical Memory | 85,50% Memory free

15,49 Gb Paging File | 14,16 Gb Available in Paging File | 91,46% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 297,99 Gb Total Space | 219,75 Gb Free Space | 73,75% Space Free | Partition Type: NTFS

 

Computer Name: MYSELF-PC | User Name: Myself | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.07.14 16:48:53 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Myself\Desktop\OTL.exe

PRC - [2012.05.08 15:04:41 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.05.08 15:04:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.05.08 15:04:41 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.11.25 17:32:36 | 000,687,400 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe

PRC - [2010.10.01 15:44:58 | 000,280,120 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe

PRC - [2010.09.27 18:29:26 | 000,092,216 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

PRC - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2011.03.16 02:54:10 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2012.07.11 20:46:12 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.06.17 00:20:58 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.05.08 15:04:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.05.08 15:04:41 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.11.25 17:32:36 | 000,687,400 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) @C:\Program Files (x86)

SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)

SRV - [2010.10.01 15:44:58 | 000,280,120 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe -- (hpHotkeyMonitor)

SRV - [2010.09.27 18:29:26 | 000,092,216 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)

SRV - [2010.09.08 13:05:34 | 000,271,360 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Programme\IDT\WDM\stacsv64.exe -- (STacSV)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.03.02 13:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Programme\IDT\WDM\AESTSr64.exe -- (AESTFilters)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.05.08 15:04:41 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2012.05.08 15:04:41 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2012.02.24 11:14:42 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)

DRV:64bit: - [2012.02.24 11:14:42 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)

DRV:64bit: - [2012.02.12 15:34:39 | 000,503,352 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)

DRV:64bit: - [2012.02.12 12:46:20 | 003,063,360 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)

DRV:64bit: - [2011.12.15 16:00:00 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)

DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)

DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)

DRV:64bit: - [2011.03.16 03:14:36 | 006,862,848 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2011.03.16 02:20:10 | 000,264,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.02.08 12:03:24 | 002,374,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

DRV:64bit: - [2010.11.21 05:24:43 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.21 05:23:48 | 000,117,248 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tsusbhub.sys -- (tsusbhub)

DRV:64bit: - [2010.11.21 05:23:48 | 000,088,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Synth3dVsc.sys -- (Synth3dVsc)

DRV:64bit: - [2010.11.21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)

DRV:64bit: - [2010.11.21 05:23:48 | 000,034,816 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)

DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2010.11.17 09:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2010.09.08 13:05:34 | 000,515,584 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)

DRV:64bit: - [2010.06.03 20:18:56 | 001,379,376 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2010.06.02 16:08:38 | 000,025,912 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV:64bit: - [2010.05.03 15:44:02 | 000,331,880 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2010.03.09 23:03:52 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) AMD PCI Express (3GIO)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2010.07.01 19:11:24 | 000,012,352 | ---- | M] () [Kernel | Unavailable | Unknown] -- C:\Programme\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-1962454846-1833420751-261684099-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-1962454846-1833420751-261684099-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKU\S-1-5-21-1962454846-1833420751-261684099-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6A D4 1A B2 1C 5D CD 01  [binary data]

IE - HKU\S-1-5-21-1962454846-1833420751-261684099-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-1962454846-1833420751-261684099-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-1962454846-1833420751-261684099-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.17 00:20:58 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2012.02.12 13:01:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Myself\AppData\Roaming\mozilla\Extensions

[2012.07.14 14:27:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Myself\AppData\Roaming\mozilla\Firefox\Profiles\7wj5tk5k.default\extensions

[2012.03.18 09:59:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.06.17 00:20:58 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.02.08 19:36:16 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.08 19:36:16 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)

O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [QLBController] C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\S-1-5-21-1962454846-1833420751-261684099-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D5F06006-4B42-4C27-A6E8-D98FC5B3AF6F}: NameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DB50102F-D1ED-4138-B01E-BFAF302D09BA}: NameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

 

MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig:64bit - StartUpReg: AlcoholAutomount - hkey= - key= - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe (Alcohol Soft Development Team)

MsConfig:64bit - StartUpReg: EPSON SX110 Series - hkey= - key= - C:\Windows\SysNative\spool\DRIVERS\x64\3\E_IATIFBE.EXE (SEIKO EPSON CORPORATION)

MsConfig:64bit - StartUpReg: KiesAirMessage - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: KiesHelper - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: KiesPDLR - hkey= - key= - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

MsConfig:64bit - StartUpReg: KiesTrayAgent - hkey= - key= - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

MsConfig:64bit - StartUpReg: Malwarebytes' Anti-Malware - hkey= - key= - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig:64bit - StartUpReg: SynTPEnh - hkey= - key= - C:\Programme\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)

MsConfig:64bit - State: "startup" - Reg Error: Key error.

 

SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========
 

[2012.07.12 21:56:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.07.12 21:55:31 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Myself\Desktop\esetsmartinstaller_enu.exe

[2012.07.07 18:34:14 | 000,000,000 | ---D | C] -- C:\Users\Myself\AppData\Roaming\Malwarebytes

[2012.07.07 18:33:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.07.07 18:33:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.07.07 18:33:58 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.07.07 18:33:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.07.07 16:56:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.07.07 16:56:01 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.07.07 16:47:50 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Myself\Desktop\OTL.exe

[2012.07.07 15:32:44 | 000,000,000 | ---D | C] -- C:\Users\Myself\AppData\Roaming\Xeibov

[2012.06.18 11:08:14 | 000,000,000 | -H-D | C] -- C:\Users\Myself\AppData\Local\Macromedia

[1 C:\Users\Myself\Desktop\*.tmp files -> C:\Users\Myself\Desktop\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.07.14 16:48:53 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Myself\Desktop\OTL.exe

[2012.07.14 16:46:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.07.14 15:29:13 | 001,507,342 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.07.14 15:29:13 | 000,657,910 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.07.14 15:29:13 | 000,619,146 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.07.14 15:29:13 | 000,131,250 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.07.14 15:29:13 | 000,107,466 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.07.14 14:35:49 | 000,028,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.07.14 14:35:49 | 000,028,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.07.14 14:28:16 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.07.14 14:28:10 | 1941,094,399 | -HS- | M] () -- C:\hiberfil.sys

[2012.07.13 23:08:24 | 000,624,883 | ---- | M] () -- C:\Users\Myself\Desktop\adwcleaner0.exe

[2012.07.13 16:10:53 | 000,000,655 | ---- | M] () -- C:\Users\Myself\Documents\ax_files.xml

[2012.07.12 21:55:34 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Myself\Desktop\esetsmartinstaller_enu.exe

[2012.07.11 11:25:08 | 000,413,624 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.07.08 17:45:16 | 000,000,020 | -H-- | M] () -- C:\Users\Myself\defogger_reenable

[2012.07.07 18:33:59 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.07.07 18:17:14 | 000,050,477 | ---- | M] () -- C:\Users\Myself\Desktop\Defogger.exe

[2012.07.06 14:45:47 | 000,054,015 | -H-- | M] () -- C:\Users\Myself\183071_105598086186381_3878415_n.jpg

[2012.07.04 09:49:10 | 000,001,531 | ---- | M] () -- C:\Windows\wininit.ini

[1 C:\Users\Myself\Desktop\*.tmp files -> C:\Users\Myself\Desktop\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.07.13 23:08:23 | 000,624,883 | ---- | C] () -- C:\Users\Myself\Desktop\adwcleaner0.exe

[2012.07.08 17:45:16 | 000,000,020 | -H-- | C] () -- C:\Users\Myself\defogger_reenable

[2012.07.07 18:33:59 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.07.07 18:17:14 | 000,050,477 | ---- | C] () -- C:\Users\Myself\Desktop\Defogger.exe

[2012.07.06 14:45:44 | 000,054,015 | -H-- | C] () -- C:\Users\Myself\183071_105598086186381_3878415_n.jpg

[2012.04.02 19:03:29 | 000,001,531 | ---- | C] () -- C:\Windows\wininit.ini

[2012.02.12 17:36:29 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.02.12 12:14:06 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.03.02 07:57:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe

[2011.03.02 07:57:40 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll

[2011.03.02 07:57:40 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll

[2011.03.02 07:57:40 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll

[2011.03.02 07:57:40 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll

 
 ========== LOP Check ==========

 

[2012.03.13 21:16:55 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\IrfanView

[2012.02.12 16:37:03 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Leadertech

[2012.02.12 14:24:45 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Miranda Fusion

[2012.02.12 22:16:10 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\PacificPoker

[2012.03.13 20:58:59 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\PhotoFiltre

[2012.05.12 12:41:25 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Samsung

[2012.07.07 15:33:23 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Xeibov

[2012.05.11 14:45:45 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.02.14 12:53:12 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Adobe

[2012.02.12 12:15:54 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\ATI

[2012.02.12 14:13:38 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Avira

[2012.04.15 11:34:50 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\dvdcss

[2012.02.12 12:03:17 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Hewlett-Packard

[2012.02.12 12:03:41 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\hpqLog

[2012.02.12 11:01:55 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Identities

[2012.03.13 21:16:55 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\IrfanView

[2012.02.12 16:37:03 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Leadertech

[2012.02.12 16:35:15 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Logishrd

[2012.02.12 16:37:09 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Logitech

[2012.02.12 13:19:27 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Macromedia

[2012.07.07 18:34:14 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Malwarebytes

[2011.04.12 09:54:45 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Media Center Programs

[2012.05.26 01:23:51 | 000,000,000 | --SD | M] -- C:\Users\Myself\AppData\Roaming\Microsoft

[2012.02.12 14:24:45 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Miranda Fusion

[2012.02.12 13:01:28 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Mozilla

[2012.02.22 14:54:55 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Nero

[2012.02.12 22:16:10 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\PacificPoker

[2012.03.13 20:58:59 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\PhotoFiltre

[2012.05.12 12:41:25 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Samsung

[2012.07.14 12:39:55 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\vlc

[2012.02.12 15:17:22 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\WinRAR

[2012.07.07 15:33:23 | 000,000,000 | ---D | M] -- C:\Users\Myself\AppData\Roaming\Xeibov

 
 < %APPDATA%\*.exe /s >

[2012.02.12 16:37:03 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\Myself\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

[2012.05.12 12:42:20 | 000,106,920 | ---- | M] () -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\FirmwareUpdateTemp\AGENT\AgentInstaller.exe

[2012.05.12 12:42:20 | 000,101,288 | ---- | M] () -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\FirmwareUpdateTemp\AGENT\AgentUpdate.exe

[2012.05.12 12:42:20 | 000,021,416 | ---- | M] () -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\FirmwareUpdateTemp\AGENT\KiesPDLR.exe

[2012.06.11 13:56:21 | 003,154,792 | ---- | M] (Microsoft Corporation) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\NDP40-KB2461678-x64.exe

[2012.04.27 02:13:04 | 000,955,280 | ---- | M] (Samsung) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\Kies.exe

[2012.04.27 02:13:08 | 000,278,928 | ---- | M] () -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\KiesDriverInstaller.exe

[2012.04.05 18:41:16 | 000,317,952 | ---- | M] (Samsung) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\KiesLogger.exe

[2012.04.27 02:13:06 | 003,521,424 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\KiesTrayAgent.exe

[2011.10.25 16:01:04 | 000,140,800 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\ConnectionManager.exe

[2012.03.22 23:43:30 | 000,297,984 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\DeviceDataService.exe

[2012.04.09 17:16:32 | 000,695,296 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\DeviceManager.exe

[2012.04.27 02:13:12 | 000,067,472 | ---- | M] (Samsung) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\Kies_Tutorial.exe

[2012.05.12 12:42:20 | 000,106,920 | ---- | M] () -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\AgentInstaller.exe

[2012.05.12 12:42:20 | 000,101,288 | ---- | M] () -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\AgentUpdate.exe

[2012.04.27 02:13:16 | 000,183,696 | ---- | M] () -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\BinaryLoaderMgr.exe

[2012.05.12 12:42:20 | 000,021,416 | ---- | M] () -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\KiesPDLR.exe

[2012.04.27 02:13:22 | 003,570,312 | ---- | M] (Freeware) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\MediaModules\MyFreeCodecPack.exe

[2012.03.19 18:53:42 | 024,161,656 | ---- | M] (SAMSUNG Electronics Co., Ltd.) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\USB Driver\SAMSUNG_USB_Driver_for_Mobile_Phones.exe

[2012.04.27 02:13:24 | 000,371,088 | ---- | M] (ml) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\Temp\Kies.Update.exe

[2012.06.08 13:02:14 | 000,371,128 | ---- | M] (ml) -- C:\Users\Myself\AppData\Roaming\Samsung\Kies\UpdateTemp\Updater\Kies.Update.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

FF - user.js - File not found

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\S-1-5-21-1962454846-1833420751-261684099-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

[2012.07.07 15:32:44 | 000,000,000 | ---D | C] -- C:\Users\Myself\AppData\Roaming\Xeibov

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

All processes killed

========== OTL ==========

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1962454846-1833420751-261684099-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

C:\Users\Myself\AppData\Roaming\Xeibov folder moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Gast

->Temp folder emptied: 50175 bytes

->Temporary Internet Files folder emptied: 1923011 bytes

->Flash cache emptied: 456 bytes

 

User: Myself

->Temp folder emptied: 26962308 bytes

->Temporary Internet Files folder emptied: 20065770 bytes

->Java cache emptied: 8611196 bytes

->FireFox cache emptied: 1062712695 bytes

->Flash cache emptied: 19160 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 5258 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 1.068,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: Default

 

User: Default User

 

User: Gast

->Flash cache emptied: 0 bytes

 

User: Myself

->Flash cache emptied: 0 bytes

 

User: Public

 

Total Flash Files Cleaned = 0,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.54.0 log created on 07152012_133149
 

Files\Folders moved on Reboot...

C:\Users\Myself\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

PendingFileRenameOperations files...

File C:\Users\Myself\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
 

Registry entries deleted on Reboot...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Code:

23:23:53.0623 5292        TDSS rootkit removing tool 2.7.45.0 Jul  9 2012 12:46:35

23:23:54.0007 5292        ============================================================

23:23:54.0007 5292        Current date / time: 2012/07/15 23:23:54.0007

23:23:54.0007 5292        SystemInfo:

23:23:54.0007 5292        

23:23:54.0007 5292        OS Version: 6.1.7601 ServicePack: 1.0

23:23:54.0007 5292        Product type: Workstation

23:23:54.0008 5292        ComputerName: MYSELF-PC

23:23:54.0008 5292        UserName: Myself

23:23:54.0008 5292        Windows directory: C:\Windows

23:23:54.0008 5292        System windows directory: C:\Windows

23:23:54.0008 5292        Running under WOW64

23:23:54.0008 5292        Processor architecture: Intel x64

23:23:54.0008 5292        Number of processors: 2

23:23:54.0008 5292        Page size: 0x1000

23:23:54.0008 5292        Boot type: Normal boot

23:23:54.0008 5292        ============================================================

23:23:55.0440 5292        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

23:23:55.0445 5292        ============================================================

23:23:55.0445 5292        \Device\Harddisk0\DR0:

23:23:55.0445 5292        MBR partitions:

23:23:55.0445 5292        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

23:23:55.0445 5292        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x253FB800

23:23:55.0445 5292        ============================================================

23:23:55.0470 5292        C: <-> \Device\Harddisk0\DR0\Partition1

23:23:55.0470 5292        ============================================================

23:23:55.0470 5292        Initialize success

23:23:55.0470 5292        ============================================================

23:25:57.0973 5024        ============================================================

23:25:57.0973 5024        Scan started

23:25:57.0973 5024        Mode: Manual; SigCheck; TDLFS; 

23:25:57.0973 5024        ============================================================

23:26:00.0375 5024        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys

23:26:00.0531 5024        1394ohci - ok

23:26:00.0625 5024        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

23:26:00.0672 5024        ACPI - ok

23:26:00.0703 5024        AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

23:26:00.0797 5024        AcpiPmi - ok

23:26:00.0859 5024        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

23:26:00.0890 5024        AdobeARMservice - ok

23:26:01.0093 5024        AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

23:26:01.0124 5024        AdobeFlashPlayerUpdateSvc - ok

23:26:01.0202 5024        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys

23:26:01.0233 5024        adp94xx - ok

23:26:01.0296 5024        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys

23:26:01.0327 5024        adpahci - ok

23:26:01.0358 5024        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys

23:26:01.0389 5024        adpu320 - ok

23:26:01.0421 5024        AeLookupSvc     (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll

23:26:01.0623 5024        AeLookupSvc - ok

23:26:01.0733 5024        AESTFilters     (a6fb9db8f1a86861d955fd6975977ae0) C:\Program Files\IDT\WDM\AESTSr64.exe

23:26:01.0811 5024        AESTFilters - ok

23:26:01.0920 5024        AFD             (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys

23:26:02.0013 5024        AFD - ok

23:26:02.0060 5024        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

23:26:02.0091 5024        agp440 - ok

23:26:02.0154 5024        ALG             (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe

23:26:02.0216 5024        ALG - ok

23:26:02.0247 5024        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

23:26:02.0263 5024        aliide - ok

23:26:02.0325 5024        AMD External Events Utility (fd6568a8924bcdaff11ef83aeef94039) C:\Windows\system32\atiesrxx.exe

23:26:02.0403 5024        AMD External Events Utility - ok

23:26:02.0435 5024        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

23:26:02.0450 5024        amdide - ok

23:26:02.0497 5024        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys

23:26:02.0528 5024        AmdK8 - ok

23:26:02.0949 5024        amdkmdag        (5587fd43508e9f0b313a494e58f2c5dc) C:\Windows\system32\DRIVERS\atikmdag.sys

23:26:03.0168 5024        amdkmdag - ok

23:26:03.0355 5024        amdkmdap        (95e78aec7b1e9258be4918206fa9f6e3) C:\Windows\system32\DRIVERS\atikmpag.sys

23:26:03.0417 5024        amdkmdap - ok

23:26:03.0449 5024        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

23:26:03.0511 5024        AmdPPM - ok

23:26:03.0542 5024        amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

23:26:03.0558 5024        amdsata - ok

23:26:03.0605 5024        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys

23:26:03.0636 5024        amdsbs - ok

23:26:03.0651 5024        amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

23:26:03.0667 5024        amdxata - ok

23:26:03.0776 5024        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

23:26:03.0823 5024        AntiVirSchedulerService - ok

23:26:03.0885 5024        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

23:26:03.0901 5024        AntiVirService - ok

23:26:03.0932 5024        AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

23:26:04.0151 5024        AppID - ok

23:26:04.0182 5024        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll

23:26:04.0260 5024        AppIDSvc - ok

23:26:04.0322 5024        Appinfo         (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll

23:26:04.0416 5024        Appinfo - ok

23:26:04.0478 5024        AppMgmt         (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll

23:26:04.0556 5024        AppMgmt - ok

23:26:04.0572 5024        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys

23:26:04.0587 5024        arc - ok

23:26:04.0619 5024        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys

23:26:04.0650 5024        arcsas - ok

23:26:04.0697 5024        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

23:26:04.0806 5024        AsyncMac - ok

23:26:04.0821 5024        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

23:26:04.0837 5024        atapi - ok

23:26:05.0009 5024        athr            (96abf88241f90ff647e55c934c55c2f1) C:\Windows\system32\DRIVERS\athrx.sys

23:26:05.0102 5024        athr ( UnsignedFile.Multi.Generic ) - warning

23:26:05.0102 5024        athr - detected UnsignedFile.Multi.Generic (1)

23:26:05.0352 5024        AtiHDAudioService (4bf5bca6e2608cd8a00bc4a6673a9f47) C:\Windows\system32\drivers\AtihdW76.sys

23:26:05.0414 5024        AtiHDAudioService - ok

23:26:05.0445 5024        AtiPcie         (e82e61f46d1336447f4deff8c074f13e) C:\Windows\system32\DRIVERS\AtiPcie64.sys

23:26:05.0477 5024        AtiPcie - ok

23:26:05.0570 5024        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

23:26:05.0664 5024        AudioEndpointBuilder - ok

23:26:05.0679 5024        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

23:26:05.0711 5024        AudioSrv - ok

23:26:05.0789 5024        avgntflt        (26e38b5a58c6c55fafbc563eeddb0867) C:\Windows\system32\DRIVERS\avgntflt.sys

23:26:05.0820 5024        avgntflt - ok

23:26:05.0867 5024        avipbb          (9d1f00beff84cbbf46d7f052bc7e0565) C:\Windows\system32\DRIVERS\avipbb.sys

23:26:05.0882 5024        avipbb - ok

23:26:05.0913 5024        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys

23:26:05.0929 5024        avkmgr - ok

23:26:05.0976 5024        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll

23:26:06.0101 5024        AxInstSV - ok

23:26:06.0194 5024        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys

23:26:06.0272 5024        b06bdrv - ok

23:26:06.0335 5024        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

23:26:06.0397 5024        b57nd60a - ok

23:26:06.0725 5024        BCM43XX         (810be94a9e42309b3f74217ac28bc6ac) C:\Windows\system32\DRIVERS\bcmwl664.sys

23:26:06.0849 5024        BCM43XX - ok

23:26:07.0021 5024        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll

23:26:07.0083 5024        BDESVC - ok

23:26:07.0130 5024        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

23:26:07.0161 5024        Beep - ok

23:26:07.0286 5024        BFE             (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll

23:26:07.0364 5024        BFE - ok

23:26:07.0442 5024        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll

23:26:07.0520 5024        BITS - ok

23:26:07.0614 5024        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

23:26:07.0661 5024        blbdrive - ok

23:26:07.0707 5024        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

23:26:07.0754 5024        bowser - ok

23:26:07.0801 5024        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys

23:26:07.0848 5024        BrFiltLo - ok

23:26:07.0863 5024        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys

23:26:07.0879 5024        BrFiltUp - ok

23:26:07.0910 5024        Bridge          (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys

23:26:07.0957 5024        Bridge - ok

23:26:07.0973 5024        BridgeMP        (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys

23:26:08.0004 5024        BridgeMP - ok

23:26:08.0051 5024        Browser         (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll

23:26:08.0097 5024        Browser - ok

23:26:08.0129 5024        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

23:26:08.0207 5024        Brserid - ok

23:26:08.0253 5024        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

23:26:08.0285 5024        BrSerWdm - ok

23:26:08.0300 5024        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

23:26:08.0331 5024        BrUsbMdm - ok

23:26:08.0331 5024        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

23:26:08.0363 5024        BrUsbSer - ok

23:26:08.0425 5024        BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\DRIVERS\BthEnum.sys

23:26:08.0487 5024        BthEnum - ok

23:26:08.0534 5024        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys

23:26:08.0581 5024        BTHMODEM - ok

23:26:08.0628 5024        BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys

23:26:08.0659 5024        BthPan - ok

23:26:08.0768 5024        BTHPORT         (64c198198501f7560ee41d8d1efa7952) C:\Windows\system32\Drivers\BTHport.sys

23:26:08.0815 5024        BTHPORT - ok

23:26:08.0862 5024        bthserv         (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll

23:26:08.0924 5024        bthserv - ok

23:26:08.0924 5024        BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\system32\Drivers\BTHUSB.sys

23:26:08.0955 5024        BTHUSB - ok

23:26:08.0987 5024        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

23:26:09.0033 5024        cdfs - ok

23:26:09.0080 5024        cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys

23:26:09.0096 5024        cdrom - ok

23:26:09.0143 5024        CertPropSvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

23:26:09.0252 5024        CertPropSvc - ok

23:26:09.0283 5024        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys

23:26:09.0314 5024        circlass - ok

23:26:09.0361 5024        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

23:26:09.0377 5024        CLFS - ok

23:26:09.0455 5024        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

23:26:09.0486 5024        clr_optimization_v2.0.50727_32 - ok

23:26:09.0548 5024        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

23:26:09.0579 5024        clr_optimization_v2.0.50727_64 - ok

23:26:09.0657 5024        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

23:26:09.0689 5024        clr_optimization_v4.0.30319_32 - ok

23:26:09.0720 5024        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

23:26:09.0735 5024        clr_optimization_v4.0.30319_64 - ok

23:26:09.0767 5024        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

23:26:09.0813 5024        CmBatt - ok

23:26:09.0845 5024        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

23:26:09.0860 5024        cmdide - ok

23:26:09.0938 5024        CNG             (9ac4f97c2d3e93367e2148ea940cd2cd) C:\Windows\system32\Drivers\cng.sys

23:26:09.0985 5024        CNG - ok

23:26:10.0001 5024        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys

23:26:10.0016 5024        Compbatt - ok

23:26:10.0063 5024        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\DRIVERS\CompositeBus.sys

23:26:10.0125 5024        CompositeBus - ok

23:26:10.0141 5024        COMSysApp - ok

23:26:10.0157 5024        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys

23:26:10.0172 5024        crcdisk - ok

23:26:10.0235 5024        CryptSvc        (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll

23:26:10.0297 5024        CryptSvc - ok

23:26:10.0359 5024        CSC             (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys

23:26:10.0437 5024        CSC - ok

23:26:10.0531 5024        CscService      (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll

23:26:10.0562 5024        CscService - ok

23:26:10.0656 5024        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

23:26:10.0718 5024        DcomLaunch - ok

23:26:10.0812 5024        defragsvc       (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll

23:26:10.0905 5024        defragsvc - ok

23:26:10.0983 5024        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

23:26:11.0061 5024        DfsC - ok

23:26:11.0124 5024        dg_ssudbus      (113212d25d0c9bb8901a9833774da97f) C:\Windows\system32\DRIVERS\ssudbus.sys

23:26:11.0155 5024        dg_ssudbus - ok

23:26:11.0217 5024        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll

23:26:11.0295 5024        Dhcp - ok

23:26:11.0327 5024        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

23:26:11.0373 5024        discache - ok

23:26:11.0420 5024        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys

23:26:11.0436 5024        Disk - ok

23:26:11.0467 5024        dmvsc           (5db085a8a6600be6401f2b24eecb5415) C:\Windows\system32\drivers\dmvsc.sys

23:26:11.0529 5024        dmvsc - ok

23:26:11.0592 5024        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll

23:26:11.0654 5024        Dnscache - ok

23:26:11.0701 5024        dot3svc         (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll

23:26:11.0779 5024        dot3svc - ok

23:26:11.0810 5024        DPS             (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll

23:26:11.0888 5024        DPS - ok

23:26:11.0935 5024        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

23:26:11.0982 5024        drmkaud - ok

23:26:12.0091 5024        DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

23:26:12.0153 5024        DXGKrnl - ok

23:26:12.0185 5024        EapHost         (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll

23:26:12.0247 5024        EapHost - ok

23:26:12.0465 5024        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys

23:26:12.0590 5024        ebdrv - ok

23:26:12.0731 5024        EFS             (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe

23:26:12.0793 5024        EFS - ok

23:26:12.0933 5024        ehRecvr         (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe

23:26:13.0011 5024        ehRecvr - ok

23:26:13.0043 5024        ehSched         (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe

23:26:13.0074 5024        ehSched - ok

23:26:13.0214 5024        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys

23:26:13.0245 5024        elxstor - ok

23:26:13.0261 5024        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

23:26:13.0292 5024        ErrDev - ok

23:26:13.0370 5024        EventSystem     (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll

23:26:13.0417 5024        EventSystem - ok

23:26:13.0448 5024        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

23:26:13.0495 5024        exfat - ok

23:26:13.0526 5024        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

23:26:13.0589 5024        fastfat - ok

23:26:13.0682 5024        Fax             (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe

23:26:13.0745 5024        Fax - ok

23:26:13.0791 5024        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys

23:26:13.0823 5024        fdc - ok

23:26:13.0854 5024        fdPHost         (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll

23:26:13.0901 5024        fdPHost - ok

23:26:13.0916 5024        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll

23:26:13.0963 5024        FDResPub - ok

23:26:13.0994 5024        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

23:26:13.0994 5024        FileInfo - ok

23:26:14.0025 5024        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

23:26:14.0057 5024        Filetrace - ok

23:26:14.0103 5024        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys

23:26:14.0135 5024        flpydisk - ok

23:26:14.0181 5024        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

23:26:14.0197 5024        FltMgr - ok

23:26:14.0337 5024        FontCache       (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll

23:26:14.0400 5024        FontCache - ok

23:26:14.0493 5024        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

23:26:14.0525 5024        FontCache3.0.0.0 - ok

23:26:14.0603 5024        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

23:26:14.0634 5024        FsDepends - ok

23:26:14.0665 5024        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys

23:26:14.0681 5024        Fs_Rec - ok

23:26:14.0727 5024        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

23:26:14.0759 5024        fvevol - ok

23:26:14.0774 5024        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys

23:26:14.0790 5024        gagp30kx - ok

23:26:14.0883 5024        gpsvc           (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll

23:26:14.0961 5024        gpsvc - ok

23:26:14.0977 5024        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

23:26:15.0024 5024        hcw85cir - ok

23:26:15.0071 5024        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys

23:26:15.0117 5024        HdAudAddService - ok

23:26:15.0149 5024        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys

23:26:15.0180 5024        HDAudBus - ok

23:26:15.0195 5024        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys

23:26:15.0227 5024        HidBatt - ok

23:26:15.0258 5024        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys

23:26:15.0273 5024        HidBth - ok

23:26:15.0289 5024        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys

23:26:15.0305 5024        HidIr - ok

23:26:15.0351 5024        hidserv         (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll

23:26:15.0383 5024        hidserv - ok

23:26:15.0429 5024        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys

23:26:15.0461 5024        HidUsb - ok

23:26:15.0476 5024        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll

23:26:15.0539 5024        hkmsvc - ok

23:26:15.0570 5024        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll

23:26:15.0648 5024        HomeGroupListener - ok

23:26:15.0695 5024        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll

23:26:15.0741 5024        HomeGroupProvider - ok

23:26:15.0819 5024        HPDrvMntSvc.exe (68ebc244e60795c9c11f30963a39a35e) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

23:26:15.0851 5024        HPDrvMntSvc.exe - ok

23:26:15.0897 5024        hpHotkeyMonitor (120c1ceb5e45db0a04416242bd6c1e3e) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe

23:26:15.0929 5024        hpHotkeyMonitor - ok

23:26:15.0960 5024        HpqKbFiltr      (b98ee5d4535a685634b90f7e04de0df7) C:\Windows\system32\DRIVERS\HpqKbFiltr.sys

23:26:15.0975 5024        HpqKbFiltr - ok

23:26:16.0038 5024        hpqwmiex        (615586c9a6d065d1fba098168d1748b4) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

23:26:16.0069 5024        hpqwmiex - ok

23:26:16.0116 5024        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

23:26:16.0147 5024        HpSAMD - ok

23:26:16.0225 5024        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

23:26:16.0350 5024        HTTP - ok

23:26:16.0365 5024        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

23:26:16.0365 5024        hwpolicy - ok

23:26:16.0397 5024        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys

23:26:16.0412 5024        i8042prt - ok

23:26:16.0475 5024        iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

23:26:16.0490 5024        iaStorV - ok

23:26:16.0662 5024        idsvc           (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

23:26:16.0771 5024        idsvc - ok

23:26:17.0223 5024        igfx            (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys

23:26:17.0426 5024        igfx - ok

23:26:17.0582 5024        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys

23:26:17.0613 5024        iirsp - ok

23:26:17.0707 5024        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll

23:26:17.0769 5024        IKEEXT - ok

23:26:17.0801 5024        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

23:26:17.0816 5024        intelide - ok

23:26:17.0847 5024        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\drivers\intelppm.sys

23:26:17.0863 5024        intelppm - ok

23:26:17.0910 5024        IPBusEnum       (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll

23:26:17.0957 5024        IPBusEnum - ok

23:26:17.0988 5024        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

23:26:18.0019 5024        IpFilterDriver - ok

23:26:18.0066 5024        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll

23:26:18.0128 5024        iphlpsvc - ok

23:26:18.0128 5024        IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

23:26:18.0144 5024        IPMIDRV - ok

23:26:18.0159 5024        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

23:26:18.0206 5024        IPNAT - ok

23:26:18.0237 5024        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

23:26:18.0300 5024        IRENUM - ok

23:26:18.0331 5024        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

23:26:18.0347 5024        isapnp - ok

23:26:18.0393 5024        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

23:26:18.0409 5024        iScsiPrt - ok

23:26:18.0440 5024        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

23:26:18.0440 5024        kbdclass - ok

23:26:18.0487 5024        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys

23:26:18.0503 5024        kbdhid - ok

23:26:18.0534 5024        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

23:26:18.0549 5024        KeyIso - ok

23:26:18.0581 5024        KSecDD          (97a7070aea4c058b6418519e869a63b4) C:\Windows\system32\Drivers\ksecdd.sys

23:26:18.0596 5024        KSecDD - ok

23:26:18.0627 5024        KSecPkg         (26c43a7c2862447ec59deda188d1da07) C:\Windows\system32\Drivers\ksecpkg.sys

23:26:18.0643 5024        KSecPkg - ok

23:26:18.0659 5024        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

23:26:18.0705 5024        ksthunk - ok

23:26:18.0783 5024        KtmRm           (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll

23:26:18.0861 5024        KtmRm - ok

23:26:18.0924 5024        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll

23:26:18.0986 5024        LanmanServer - ok

23:26:19.0049 5024        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll

23:26:19.0127 5024        LanmanWorkstation - ok

23:26:19.0298 5024        LBTServ         (7772dfab22611050b79504e671b06e6e) C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe

23:26:19.0345 5024        LBTServ - ok

23:26:19.0392 5024        LHidFilt        (241f2648adf090e2a10095bd6d6f5dcb) C:\Windows\system32\DRIVERS\LHidFilt.Sys

23:26:19.0407 5024        LHidFilt - ok

23:26:19.0532 5024        LightScribeService (c34411a244029f1c08687f7c752c4563) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

23:26:19.0548 5024        LightScribeService ( UnsignedFile.Multi.Generic ) - warning

23:26:19.0548 5024        LightScribeService - detected UnsignedFile.Multi.Generic (1)

23:26:19.0610 5024        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

23:26:19.0688 5024        lltdio - ok

23:26:19.0751 5024        lltdsvc         (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll

23:26:19.0813 5024        lltdsvc - ok

23:26:19.0844 5024        lmhosts         (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll

23:26:19.0891 5024        lmhosts - ok

23:26:19.0922 5024        LMouFilt        (342ed5a4b3326014438f36d22d803737) C:\Windows\system32\DRIVERS\LMouFilt.Sys

23:26:19.0938 5024        LMouFilt - ok

23:26:19.0985 5024        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys

23:26:20.0000 5024        LSI_FC - ok

23:26:20.0031 5024        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys

23:26:20.0047 5024        LSI_SAS - ok

23:26:20.0063 5024        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys

23:26:20.0078 5024        LSI_SAS2 - ok

23:26:20.0094 5024        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys

23:26:20.0109 5024        LSI_SCSI - ok

23:26:20.0141 5024        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

23:26:20.0172 5024        luafv - ok

23:26:20.0234 5024        MBAMProtector   (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys

23:26:20.0265 5024        MBAMProtector - ok

23:26:20.0343 5024        MBAMService     (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

23:26:20.0375 5024        MBAMService - ok

23:26:20.0406 5024        Mcx2Svc         (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll

23:26:20.0437 5024        Mcx2Svc - ok

23:26:20.0468 5024        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys

23:26:20.0484 5024        megasas - ok

23:26:20.0531 5024        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys

23:26:20.0546 5024        MegaSR - ok

23:26:20.0577 5024        MMCSS           (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

23:26:20.0624 5024        MMCSS - ok

23:26:20.0671 5024        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

23:26:20.0718 5024        Modem - ok

23:26:20.0749 5024        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

23:26:20.0796 5024        monitor - ok

23:26:20.0811 5024        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

23:26:20.0827 5024        mouclass - ok

23:26:20.0858 5024        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

23:26:20.0874 5024        mouhid - ok

23:26:20.0889 5024        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

23:26:20.0905 5024        mountmgr - ok

23:26:20.0999 5024        MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

23:26:21.0045 5024        MozillaMaintenance - ok

23:26:21.0077 5024        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

23:26:21.0108 5024        mpio - ok

23:26:21.0155 5024        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

23:26:21.0201 5024        mpsdrv - ok

23:26:21.0311 5024        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll

23:26:21.0389 5024        MpsSvc - ok

23:26:21.0420 5024        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

23:26:21.0467 5024        MRxDAV - ok

23:26:21.0513 5024        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

23:26:21.0560 5024        mrxsmb - ok

23:26:21.0623 5024        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

23:26:21.0685 5024        mrxsmb10 - ok

23:26:21.0716 5024        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

23:26:21.0732 5024        mrxsmb20 - ok

23:26:21.0763 5024        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

23:26:21.0779 5024        msahci - ok

23:26:21.0794 5024        msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

23:26:21.0810 5024        msdsm - ok

23:26:21.0857 5024        MSDTC           (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe

23:26:21.0888 5024        MSDTC - ok

23:26:21.0903 5024        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

23:26:21.0950 5024        Msfs - ok

23:26:21.0966 5024        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

23:26:22.0013 5024        mshidkmdf - ok

23:26:22.0028 5024        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

23:26:22.0044 5024        msisadrv - ok

23:26:22.0091 5024        MSiSCSI         (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll

23:26:22.0200 5024        MSiSCSI - ok

23:26:22.0215 5024        msiserver - ok

23:26:22.0247 5024        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

23:26:22.0309 5024        MSKSSRV - ok

23:26:22.0325 5024        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

23:26:22.0371 5024        MSPCLOCK - ok

23:26:22.0387 5024        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

23:26:22.0418 5024        MSPQM - ok

23:26:22.0465 5024        MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

23:26:22.0481 5024        MsRPC - ok

23:26:22.0496 5024        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys

23:26:22.0512 5024        mssmbios - ok

23:26:22.0543 5024        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

23:26:22.0590 5024        MSTEE - ok

23:26:22.0590 5024        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys

23:26:22.0605 5024        MTConfig - ok

23:26:22.0621 5024        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

23:26:22.0637 5024        Mup - ok

23:26:22.0715 5024        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll

23:26:22.0793 5024        napagent - ok

23:26:22.0871 5024        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

23:26:22.0949 5024        NativeWifiP - ok

23:26:23.0120 5024        NAUpdate        (934bb0d23a25c8c136570800a5a149b6) C:\Program Files (x86)\Nero\Update\NASvc.exe

23:26:23.0167 5024        NAUpdate - ok

23:26:23.0261 5024        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

23:26:23.0276 5024        NDIS - ok

23:26:23.0323 5024        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

23:26:23.0401 5024        NdisCap - ok

23:26:23.0432 5024        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

23:26:23.0463 5024        NdisTapi - ok

23:26:23.0510 5024        Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

23:26:23.0557 5024        Ndisuio - ok

23:26:23.0588 5024        NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

23:26:23.0651 5024        NdisWan - ok

23:26:23.0666 5024        NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

23:26:23.0713 5024        NDProxy - ok

23:26:23.0729 5024        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

23:26:23.0775 5024        NetBIOS - ok

23:26:23.0822 5024        NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

23:26:23.0853 5024        NetBT - ok

23:26:23.0885 5024        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

23:26:23.0900 5024        Netlogon - ok

23:26:23.0947 5024        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll

23:26:24.0041 5024        Netman - ok

23:26:24.0103 5024        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll

23:26:24.0181 5024        netprofm - ok

23:26:24.0275 5024        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

23:26:24.0321 5024        NetTcpPortSharing - ok

23:26:24.0368 5024        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys

23:26:24.0399 5024        nfrd960 - ok

23:26:24.0462 5024        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll

23:26:24.0540 5024        NlaSvc - ok

23:26:24.0555 5024        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

23:26:24.0618 5024        Npfs - ok

23:26:24.0618 5024        nsi             (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll

23:26:24.0680 5024        nsi - ok

23:26:24.0696 5024        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

23:26:24.0774 5024        nsiproxy - ok

23:26:24.0945 5024        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

23:26:25.0039 5024        Ntfs - ok

23:26:25.0164 5024        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

23:26:25.0273 5024        Null - ok

23:26:25.0304 5024        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

23:26:25.0320 5024        nvraid - ok

23:26:25.0351 5024        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

23:26:25.0382 5024        nvstor - ok

23:26:25.0413 5024        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

23:26:25.0429 5024        nv_agp - ok

23:26:25.0569 5024        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

23:26:25.0616 5024        odserv - ok

23:26:25.0647 5024        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

23:26:25.0679 5024        ohci1394 - ok

23:26:25.0741 5024        ose             (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

23:26:25.0772 5024        ose - ok

23:26:25.0819 5024        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

23:26:25.0881 5024        p2pimsvc - ok

23:26:25.0928 5024        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll

23:26:25.0944 5024        p2psvc - ok

23:26:25.0991 5024        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys

23:26:26.0037 5024        Parport - ok

23:26:26.0084 5024        partmgr         (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys

23:26:26.0100 5024        partmgr - ok

23:26:26.0147 5024        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll

23:26:26.0178 5024        PcaSvc - ok

23:26:26.0225 5024        pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

23:26:26.0256 5024        pci - ok

23:26:26.0287 5024        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

23:26:26.0287 5024        pciide - ok

23:26:26.0334 5024        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys

23:26:26.0349 5024        pcmcia - ok

23:26:26.0365 5024        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

23:26:26.0381 5024        pcw - ok

23:26:26.0459 5024        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

23:26:26.0521 5024        PEAUTH - ok

23:26:26.0693 5024        PeerDistSvc     (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll

23:26:26.0786 5024        PeerDistSvc - ok

23:26:26.0880 5024        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe

23:26:26.0911 5024        PerfHost - ok

23:26:27.0114 5024        pla             (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll

23:26:27.0223 5024        pla - ok

23:26:27.0301 5024        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll

23:26:27.0379 5024        PlugPlay - ok

23:26:27.0410 5024        PNRPAutoReg     (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll

23:26:27.0441 5024        PNRPAutoReg - ok

23:26:27.0488 5024        PNRPsvc         (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

23:26:27.0535 5024        PNRPsvc - ok

23:26:27.0597 5024        PolicyAgent     (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll

23:26:27.0660 5024        PolicyAgent - ok

23:26:27.0707 5024        Power           (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll

23:26:27.0753 5024        Power - ok

23:26:27.0847 5024        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

23:26:27.0909 5024        PptpMiniport - ok

23:26:27.0941 5024        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys

23:26:27.0956 5024        Processor - ok

23:26:28.0034 5024        ProfSvc         (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll

23:26:28.0112 5024        ProfSvc - ok

23:26:28.0128 5024        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

23:26:28.0159 5024        ProtectedStorage - ok

23:26:28.0206 5024        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

23:26:28.0268 5024        Psched - ok

23:26:28.0409 5024        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys

23:26:28.0471 5024        ql2300 - ok

23:26:28.0627 5024        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys

23:26:28.0658 5024        ql40xx - ok

23:26:28.0721 5024        QWAVE           (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll

23:26:28.0783 5024        QWAVE - ok

23:26:28.0799 5024        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

23:26:28.0845 5024        QWAVEdrv - ok

23:26:28.0861 5024        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

23:26:28.0923 5024        RasAcd - ok

23:26:28.0970 5024        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

23:26:29.0033 5024        RasAgileVpn - ok

23:26:29.0048 5024        RasAuto         (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll

23:26:29.0111 5024        RasAuto - ok

23:26:29.0142 5024        Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

23:26:29.0204 5024        Rasl2tp - ok

23:26:29.0251 5024        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll

23:26:29.0298 5024        RasMan - ok

23:26:29.0345 5024        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

23:26:29.0423 5024        RasPppoe - ok

23:26:29.0469 5024        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

23:26:29.0563 5024        RasSstp - ok

23:26:29.0610 5024        rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

23:26:29.0672 5024        rdbss - ok

23:26:29.0703 5024        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

23:26:29.0735 5024        rdpbus - ok

23:26:29.0750 5024        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

23:26:29.0781 5024        RDPCDD - ok

23:26:29.0813 5024        RDPDR           (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys

23:26:29.0875 5024        RDPDR - ok

23:26:29.0906 5024        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

23:26:30.0015 5024        RDPENCDD - ok

23:26:30.0047 5024        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

23:26:30.0078 5024        RDPREFMP - ok

23:26:30.0125 5024        RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys

23:26:30.0171 5024        RdpVideoMiniport - ok

23:26:30.0218 5024        RDPWD           (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys

23:26:30.0296 5024        RDPWD - ok

23:26:30.0359 5024        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

23:26:30.0374 5024        rdyboost - ok

23:26:30.0405 5024        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll

23:26:30.0468 5024        RemoteAccess - ok

23:26:30.0515 5024        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll

23:26:30.0624 5024        RemoteRegistry - ok

23:26:30.0671 5024        RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys

23:26:30.0733 5024        RFCOMM - ok

23:26:30.0780 5024        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll

23:26:30.0873 5024        RpcEptMapper - ok

23:26:30.0905 5024        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe

23:26:30.0967 5024        RpcLocator - ok

23:26:31.0014 5024        RpcSs           (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

23:26:31.0061 5024        RpcSs - ok

23:26:31.0107 5024        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

23:26:31.0139 5024        rspndr - ok

23:26:31.0217 5024        RTL8167         (ba3e57c89e6f63808d3f2b11e1a2ad3c) C:\Windows\system32\DRIVERS\Rt64win7.sys

23:26:31.0263 5024        RTL8167 - ok

23:26:31.0295 5024        s3cap           (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys

23:26:31.0326 5024        s3cap - ok

23:26:31.0357 5024        SamSs           (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

23:26:31.0373 5024        SamSs - ok

23:26:31.0404 5024        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

23:26:31.0419 5024        sbp2port - ok

23:26:31.0466 5024        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll

23:26:31.0513 5024        SCardSvr - ok

23:26:31.0529 5024        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

23:26:31.0575 5024        scfilter - ok

23:26:31.0685 5024        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll

23:26:31.0763 5024        Schedule - ok

23:26:31.0794 5024        SCPolicySvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

23:26:31.0825 5024        SCPolicySvc - ok

23:26:31.0841 5024        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll

23:26:31.0887 5024        SDRSVC - ok

23:26:31.0965 5024        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

23:26:32.0075 5024        secdrv - ok

23:26:32.0121 5024        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll

23:26:32.0168 5024        seclogon - ok

23:26:32.0199 5024        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll

23:26:32.0246 5024        SENS - ok

23:26:32.0262 5024        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll

23:26:32.0324 5024        SensrSvc - ok

23:26:32.0355 5024        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys

23:26:32.0418 5024        Serenum - ok

23:26:32.0449 5024        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys

23:26:32.0480 5024        Serial - ok

23:26:32.0543 5024        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys

23:26:32.0589 5024        sermouse - ok

23:26:32.0636 5024        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll

23:26:32.0683 5024        SessionEnv - ok

23:26:32.0714 5024        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

23:26:32.0730 5024        sffdisk - ok

23:26:32.0730 5024        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

23:26:32.0792 5024        sffp_mmc - ok

23:26:32.0792 5024        sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

23:26:32.0823 5024        sffp_sd - ok

23:26:32.0823 5024        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys

23:26:32.0839 5024        sfloppy - ok

23:26:32.0901 5024        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll

23:26:33.0011 5024        SharedAccess - ok

23:26:33.0073 5024        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll

23:26:33.0151 5024        ShellHWDetection - ok

23:26:33.0182 5024        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys

23:26:33.0198 5024        SiSRaid2 - ok

23:26:33.0213 5024        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys

23:26:33.0229 5024        SiSRaid4 - ok

23:26:33.0260 5024        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

23:26:33.0307 5024        Smb - ok

23:26:33.0369 5024        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe

23:26:33.0401 5024        SNMPTRAP - ok

23:26:33.0432 5024        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

23:26:33.0447 5024        spldr - ok

23:26:33.0510 5024        Spooler         (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe

23:26:33.0541 5024        Spooler - ok

23:26:33.0759 5024        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe

23:26:33.0931 5024        sppsvc - ok

23:26:34.0071 5024        sppuinotify     (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll

23:26:34.0134 5024        sppuinotify - ok

23:26:34.0259 5024        sptd            (34f974f8b3c86de03a30dcbe79091c97) C:\Windows\System32\Drivers\sptd.sys

23:26:34.0305 5024        sptd - ok

23:26:34.0352 5024        srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

23:26:34.0430 5024        srv - ok

23:26:34.0477 5024        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

23:26:34.0524 5024        srv2 - ok

23:26:34.0571 5024        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

23:26:34.0586 5024        srvnet - ok

23:26:34.0633 5024        SSDPSRV         (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll

23:26:34.0711 5024        SSDPSRV - ok

23:26:34.0727 5024        SstpSvc         (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll

23:26:34.0758 5024        SstpSvc - ok

23:26:34.0836 5024        ssudmdm         (78cd64791f8634cf7b582fd085e57c4b) C:\Windows\system32\DRIVERS\ssudmdm.sys

23:26:34.0867 5024        ssudmdm - ok

23:26:34.0992 5024        STacSV          (f8807aaf697e1d20c9d7716a4941e574) C:\Program Files\IDT\WDM\STacSV64.exe

23:26:35.0023 5024        STacSV - ok

23:26:35.0210 5024        StarWindServiceAE (e5c796b621f6fba8616511063d7f0ffe) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

23:26:35.0257 5024        StarWindServiceAE ( UnsignedFile.Multi.Generic ) - warning

23:26:35.0257 5024        StarWindServiceAE - detected UnsignedFile.Multi.Generic (1)

23:26:35.0288 5024        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys

23:26:35.0319 5024        stexstor - ok

23:26:35.0413 5024        STHDA           (96df19a03d37f8568141612d31f0d035) C:\Windows\system32\DRIVERS\stwrt64.sys

23:26:35.0475 5024        STHDA - ok

23:26:35.0553 5024        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll

23:26:35.0600 5024        stisvc - ok

23:26:35.0631 5024        storflt         (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys

23:26:35.0631 5024        storflt - ok

23:26:35.0663 5024        storvsc         (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys

23:26:35.0678 5024        storvsc - ok

23:26:35.0694 5024        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys

23:26:35.0709 5024        swenum - ok

23:26:35.0772 5024        swprv           (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll

23:26:35.0834 5024        swprv - ok

23:26:35.0865 5024        Synth3dVsc      (c3a39c4079305480972d29c44b868c78) C:\Windows\system32\drivers\Synth3dVsc.sys

23:26:35.0881 5024        Synth3dVsc - ok

23:26:36.0053 5024        SynTP           (d268d2a0db2a2bbe963e688d0b039267) C:\Windows\system32\DRIVERS\SynTP.sys

23:26:36.0131 5024        SynTP - ok

23:26:36.0427 5024        SysMain         (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll

23:26:36.0536 5024        SysMain - ok

23:26:36.0692 5024        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll

23:26:36.0755 5024        TabletInputService - ok

23:26:36.0817 5024        TapiSrv         (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll

23:26:36.0895 5024        TapiSrv - ok

23:26:36.0911 5024        TBS             (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll

23:26:36.0957 5024        TBS - ok

23:26:37.0207 5024        Tcpip           (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys

23:26:37.0285 5024        Tcpip - ok

23:26:37.0628 5024        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys

23:26:37.0675 5024        TCPIP6 - ok

23:26:37.0753 5024        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

23:26:37.0831 5024        tcpipreg - ok

23:26:37.0847 5024        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

23:26:37.0909 5024        TDPIPE - ok

23:26:37.0940 5024        TDTCP           (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys

23:26:37.0987 5024        TDTCP - ok

23:26:38.0034 5024        tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

23:26:38.0081 5024        tdx - ok

23:26:38.0096 5024        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\DRIVERS\termdd.sys

23:26:38.0096 5024        TermDD - ok

23:26:38.0112 5024        terminpt        (2b5bdff688ec9871d7ec5837833374e9) C:\Windows\system32\drivers\terminpt.sys

23:26:38.0159 5024        terminpt - ok

23:26:38.0252 5024        TermService     (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll

23:26:38.0346 5024        TermService - ok

23:26:38.0361 5024        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll

23:26:38.0377 5024        Themes - ok

23:26:38.0408 5024        THREADORDER     (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

23:26:38.0439 5024        THREADORDER - ok

23:26:38.0471 5024        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll

23:26:38.0517 5024        TrkWks - ok

23:26:38.0611 5024        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe

23:26:38.0689 5024        TrustedInstaller - ok

23:26:38.0720 5024        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

23:26:38.0798 5024        tssecsrv - ok

23:26:38.0845 5024        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

23:26:38.0907 5024        TsUsbFlt - ok

23:26:38.0907 5024        TsUsbGD         (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys

23:26:38.0923 5024        TsUsbGD - ok

23:26:38.0939 5024        tsusbhub        (e1748d04ae40118b62bc18ac86032192) C:\Windows\system32\drivers\tsusbhub.sys

23:26:38.0954 5024        tsusbhub - ok

23:26:39.0001 5024        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

23:26:39.0079 5024        tunnel - ok

23:26:39.0079 5024        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys

23:26:39.0095 5024        uagp35 - ok

23:26:39.0126 5024        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

23:26:39.0188 5024        udfs - ok

23:26:39.0235 5024        UI0Detect       (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe

23:26:39.0266 5024        UI0Detect - ok

23:26:39.0297 5024        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

23:26:39.0329 5024        uliagpkx - ok

23:26:39.0360 5024        umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys

23:26:39.0407 5024        umbus - ok

23:26:39.0422 5024        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys

23:26:39.0438 5024        UmPass - ok

23:26:39.0500 5024        UmRdpService    (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll

23:26:39.0547 5024        UmRdpService - ok

23:26:39.0609 5024        UnlockerDriver5 (9dc07e73a4abb9acf692113b36a5009f) C:\Program Files\Unlocker\UnlockerDriver5.sys

23:26:39.0641 5024        UnlockerDriver5 - ok

23:26:39.0703 5024        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll

23:26:39.0765 5024        upnphost - ok

23:26:39.0812 5024        usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

23:26:39.0875 5024        usbccgp - ok

23:26:39.0921 5024        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

23:26:39.0953 5024        usbcir - ok

23:26:39.0984 5024        usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys

23:26:40.0015 5024        usbehci - ok

23:26:40.0077 5024        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

23:26:40.0140 5024        usbhub - ok

23:26:40.0171 5024        usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys

23:26:40.0187 5024        usbohci - ok

23:26:40.0233 5024        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

23:26:40.0280 5024        usbprint - ok

23:26:40.0311 5024        USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

23:26:40.0358 5024        USBSTOR - ok

23:26:40.0389 5024        usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys

23:26:40.0436 5024        usbuhci - ok

23:26:40.0467 5024        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\system32\Drivers\usbvideo.sys

23:26:40.0530 5024        usbvideo - ok

23:26:40.0561 5024        UxSms           (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll

23:26:40.0623 5024        UxSms - ok

23:26:40.0655 5024        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

23:26:40.0670 5024        VaultSvc - ok

23:26:40.0701 5024        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

23:26:40.0717 5024        vdrvroot - ok

23:26:40.0779 5024        vds             (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe

23:26:40.0826 5024        vds - ok

23:26:40.0857 5024        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

23:26:40.0873 5024        vga - ok

23:26:40.0889 5024        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

23:26:40.0951 5024        VgaSave - ok

23:26:40.0951 5024        VGPU - ok

23:26:40.0967 5024        vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

23:26:40.0982 5024        vhdmp - ok

23:26:41.0013 5024        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

23:26:41.0013 5024        viaide - ok

23:26:41.0045 5024        vmbus           (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys

23:26:41.0060 5024        vmbus - ok

23:26:41.0076 5024        VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys

23:26:41.0091 5024        VMBusHID - ok

23:26:41.0123 5024        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

23:26:41.0138 5024        volmgr - ok

23:26:41.0169 5024        volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

23:26:41.0201 5024        volmgrx - ok

23:26:41.0232 5024        volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

23:26:41.0247 5024        volsnap - ok

23:26:41.0294 5024        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys

23:26:41.0341 5024        vsmraid - ok

23:26:41.0481 5024        VSS             (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe

23:26:41.0559 5024        VSS - ok

23:26:41.0715 5024        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

23:26:41.0762 5024        vwifibus - ok

23:26:41.0809 5024        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

23:26:41.0856 5024        vwififlt - ok

23:26:41.0949 5024        W32Time         (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll

23:26:41.0996 5024        W32Time - ok

23:26:42.0027 5024        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys

23:26:42.0059 5024        WacomPen - ok

23:26:42.0105 5024        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

23:26:42.0152 5024        WANARP - ok

23:26:42.0183 5024        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

23:26:42.0215 5024        Wanarpv6 - ok

23:26:42.0355 5024        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe

23:26:42.0449 5024        wbengine - ok

23:26:42.0605 5024        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll

23:26:42.0698 5024        WbioSrvc - ok

23:26:42.0729 5024        wcncsvc         (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll

23:26:42.0776 5024        wcncsvc - ok

23:26:42.0807 5024        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll

23:26:42.0854 5024        WcsPlugInService - ok

23:26:42.0932 5024        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys

23:26:42.0963 5024        Wd - ok

23:26:43.0026 5024        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

23:26:43.0057 5024        Wdf01000 - ok

23:26:43.0073 5024        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

23:26:43.0182 5024        WdiServiceHost - ok

23:26:43.0182 5024        WdiSystemHost   (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

23:26:43.0197 5024        WdiSystemHost - ok

23:26:43.0244 5024        WebClient       (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll

23:26:43.0322 5024        WebClient - ok

23:26:43.0353 5024        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll

23:26:43.0431 5024        Wecsvc - ok

23:26:43.0463 5024        wercplsupport   (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll

23:26:43.0509 5024        wercplsupport - ok

23:26:43.0556 5024        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll

23:26:43.0587 5024        WerSvc - ok

23:26:43.0665 5024        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

23:26:43.0728 5024        WfpLwf - ok

23:26:43.0743 5024        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

23:26:43.0743 5024        WIMMount - ok

23:26:43.0775 5024        WinDefend - ok

23:26:43.0790 5024        WinHttpAutoProxySvc - ok

23:26:43.0868 5024        Winmgmt         (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll

23:26:43.0931 5024        Winmgmt - ok

23:26:44.0087 5024        WinRM           (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll

23:26:44.0180 5024        WinRM - ok

23:26:44.0336 5024        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys

23:26:44.0399 5024        WinUsb - ok

23:26:44.0508 5024        Wlansvc         (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll

23:26:44.0570 5024        Wlansvc - ok

23:26:44.0601 5024        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys

23:26:44.0648 5024        WmiAcpi - ok

23:26:44.0757 5024        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe

23:26:44.0820 5024        wmiApSrv - ok

23:26:44.0851 5024        WMPNetworkSvc - ok

23:26:44.0898 5024        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll

23:26:44.0945 5024        WPCSvc - ok

23:26:44.0976 5024        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll

23:26:45.0023 5024        WPDBusEnum - ok

23:26:45.0054 5024        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

23:26:45.0116 5024        ws2ifsl - ok

23:26:45.0147 5024        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll

23:26:45.0163 5024        wscsvc - ok

23:26:45.0179 5024        WSearch - ok

23:26:45.0397 5024        wuauserv        (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll

23:26:45.0491 5024        wuauserv - ok

23:26:45.0631 5024        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

23:26:45.0725 5024        WudfPf - ok

23:26:45.0787 5024        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys

23:26:45.0849 5024        WUDFRd - ok

23:26:45.0881 5024        wudfsvc         (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll

23:26:45.0927 5024        wudfsvc - ok

23:26:45.0959 5024        WwanSvc         (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll

23:26:45.0990 5024        WwanSvc - ok

23:26:46.0052 5024        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

23:26:46.0629 5024        \Device\Harddisk0\DR0 - ok

23:26:46.0629 5024        Boot (0x1200)   (9ab5db95e10ed22216df90838eb0581a) \Device\Harddisk0\DR0\Partition0

23:26:46.0645 5024        \Device\Harddisk0\DR0\Partition0 - ok

23:26:46.0676 5024        Boot (0x1200)   (e38bcaed3cca3cc916df5f0ac8ec2e10) \Device\Harddisk0\DR0\Partition1

23:26:46.0676 5024        \Device\Harddisk0\DR0\Partition1 - ok

23:26:46.0676 5024        ============================================================

23:26:46.0676 5024        Scan finished

23:26:46.0676 5024        ============================================================

23:26:46.0692 5664        Detected object count: 3

23:26:46.0692 5664        Actual detected object count: 3

23:34:07.0523 5664        athr ( UnsignedFile.Multi.Generic ) - skipped by user

23:34:07.0523 5664        athr ( UnsignedFile.Multi.Generic ) - User select action: Skip 

23:34:07.0539 5664        LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user

23:34:07.0539 5664        LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

23:34:07.0539 5664        StarWindServiceAE ( UnsignedFile.Multi.Generic ) - skipped by user

23:34:07.0539 5664        StarWindServiceAE ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Code:

ComboFix 12-07-16.01 - Myself 16.07.2012  17:24:05.1.2 - x64

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.7930.6666 [GMT 2:00]

ausgeführt von:: c:\users\Myself\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\SysWow64\muzapp.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-06-16 bis 2012-07-16  ))))))))))))))))))))))))))))))

.

.

2012-07-15 11:31 . 2012-07-15 11:31        --------        d-----w-        C:\_OTL

2012-07-12 19:56 . 2012-07-12 19:56        --------        d-----w-        c:\program files (x86)\ESET

2012-07-11 08:55 . 2012-06-12 03:08        3148800        ----a-w-        c:\windows\system32\win32k.sys

2012-07-11 08:42 . 2012-06-06 06:06        2004480        ----a-w-        c:\windows\system32\msxml6.dll

2012-07-10 09:35 . 2010-02-23 08:16        294912        ----a-w-        c:\windows\system32\browserchoice.exe

2012-07-07 16:34 . 2012-07-07 16:34        --------        d-----w-        c:\users\Myself\AppData\Roaming\Malwarebytes

2012-07-07 16:33 . 2012-07-07 16:33        --------        d-----w-        c:\programdata\Malwarebytes

2012-07-07 16:33 . 2012-07-07 16:34        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2012-07-07 16:33 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-07-07 14:56 . 2012-07-07 14:56        --------        d-----w-        c:\program files\CCleaner

2012-06-19 12:03 . 2012-06-02 22:19        57880        ----a-w-        c:\windows\system32\wuauclt.exe

2012-06-19 12:03 . 2012-06-02 22:19        44056        ----a-w-        c:\windows\system32\wups2.dll

2012-06-19 12:03 . 2012-06-02 22:19        2428952        ----a-w-        c:\windows\system32\wuaueng.dll

2012-06-19 12:03 . 2012-06-02 22:15        2622464        ----a-w-        c:\windows\system32\wucltux.dll

2012-06-19 12:02 . 2012-06-02 22:19        38424        ----a-w-        c:\windows\system32\wups.dll

2012-06-19 12:02 . 2012-06-02 22:19        701976        ----a-w-        c:\windows\system32\wuapi.dll

2012-06-19 12:02 . 2012-06-02 22:15        99840        ----a-w-        c:\windows\system32\wudriver.dll

2012-06-19 12:01 . 2012-06-02 13:19        186752        ----a-w-        c:\windows\system32\wuwebv.dll

2012-06-19 12:01 . 2012-06-02 13:15        36864        ----a-w-        c:\windows\system32\wuapp.exe

2012-06-18 23:20 . 2012-06-18 23:20        2203776        ----a-w-        c:\program files (x86)\Common Files\System\MSMAPI\MSNCON32.DLL

2012-06-18 09:08 . 2012-06-18 09:08        --------        d--h--w-        c:\users\Myself\AppData\Local\Macromedia

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-07-11 18:46 . 2012-04-02 12:36        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-07-11 18:46 . 2012-02-12 11:19        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-05-29 07:38 . 2011-03-02 05:57        330240        ----a-w-        c:\windows\MASetupCaller.dll

2012-05-08 13:04 . 2012-02-12 11:08        98848        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-05-08 13:04 . 2012-02-12 11:08        132832        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-05-04 11:06 . 2012-06-12 23:51        5559664        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-05-04 10:03 . 2012-06-12 23:51        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2012-05-04 10:03 . 2012-06-12 23:51        3913072        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2012-05-01 05:40 . 2012-06-12 23:51        209920        ----a-w-        c:\windows\system32\profsvc.dll

2012-04-28 05:32 . 2012-06-12 23:51        1112064        ----a-w-        c:\windows\system32\rdpcorets.dll

2012-04-28 03:55 . 2012-06-12 23:51        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-04-26 05:41 . 2012-06-12 23:51        77312        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-04-26 05:41 . 2012-06-12 23:51        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-04-26 05:34 . 2012-06-12 23:51        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe

2012-04-24 05:37 . 2012-06-12 23:51        184320        ----a-w-        c:\windows\system32\cryptsvc.dll

2012-04-24 05:37 . 2012-06-12 23:51        140288        ----a-w-        c:\windows\system32\cryptnet.dll

2012-04-24 05:37 . 2012-06-12 23:51        1462272        ----a-w-        c:\windows\system32\crypt32.dll

2012-04-24 04:36 . 2012-06-12 23:51        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll

2012-04-24 04:36 . 2012-06-12 23:51        1158656        ----a-w-        c:\windows\SysWow64\crypt32.dll

2012-04-24 04:36 . 2012-06-12 23:51        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"QLBController"="c:\program files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2010-10-01 256056]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-03-16 98304]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-11 250056]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-02-24 99384]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-21 20992]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-02-24 203320]

R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys [2010-11-21 88960]

R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-21 34816]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 tsusbhub;Remote Deskotop USB Hub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2012-02-12 503352]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-15 27760]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-02 89600]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-03-16 203264]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-08 86224]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-09-27 92216]

S2 hpHotkeyMonitor;HP Hotkey Monitor;c:\program files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [2010-10-01 280120]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]

S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-03-16 6862848]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-03-16 264192]

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-17 115216]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-05-03 331880]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2011-03-04 11:29        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners

.

2012-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 18:46]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-09-08 489472]

"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: Interfaces\{D5F06006-4B42-4C27-A6E8-D98FC5B3AF6F}: NameServer = 192.168.2.1

TCP: Interfaces\{DB50102F-D1ED-4138-B01E-BFAF302D09BA}: NameServer = 192.168.2.1

FF - ProfilePath - c:\users\Myself\AppData\Roaming\Mozilla\Firefox\Profiles\7wj5tk5k.default\

FF - prefs.js: network.proxy.type - 0

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-FoxTab FLV Player - c:\program files (x86)\FoxTabFLVPlayer\Uninstall\Uninstall.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe

c:\program files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-07-16  17:47:27 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-07-16 15:47

.

Vor Suchlauf: 14 Verzeichnis(se), 240.147.427.328 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 239.863.926.784 Bytes frei

.

- - End Of File - - 7F122137481A8D093905E486130BC7EC

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Hier schonmal das Log von GMER, Rest folgt gleich ...

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-07-18 10:55:20

Windows 6.1.7601 Service Pack 1 

Running: 7lrdoky1.exe
 
 

---- Registry - GMER 1.0.15 ----
 

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af16ca93                                           

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                                      

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0                                   C:\Program Files (x86)\Alcohol Soft\Alcohol 120\

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                   0

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                0x66 0x4E 0x10 0xBB ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001                             

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0                          0xA0 0x02 0x00 0x00 ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew                       0x07 0xBF 0x47 0xA1 ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40                      

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew                0xEA 0x6E 0x62 0x3B ...

Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af16ca93 (not active ControlSet)                       

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                  

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0                                       C:\Program Files (x86)\Alcohol Soft\Alcohol 120\

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                       0

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                    0x66 0x4E 0x10 0xBB ...

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet)         

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0                              0xA0 0x02 0x00 0x00 ...

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew                           0x07 0xBF 0x47 0xA1 ...

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet)  

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew                    0xEA 0x6E 0x62 0x3B ...
 

---- EOF - GMER 1.0.15 ----

OSAM Log

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 11:04:35 on 18.07.2012
 

OS: Windows 7 Ultimate Edition Service Pack 1 (Build 7601), 64-bit

Default Browser: Mozilla Corporation Firefox 14.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"AxSWindCx64.cpl" - "Alcohol Soft Development Team" - C:\Windows\system32\AxSWindCx64.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLCFG32.CPL
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Atheros Extensible Wireless LAN device driver" (athr) - "Atheros Communications, Inc." - C:\Windows\System32\DRIVERS\athrx.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys

"VGPU" (VGPU) - ? - C:\Windows\System32\drivers\rdvgkmd.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{5E2121EE-0300-11D4-8D3B-444553540000} "Catalyst Context Menu extension" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{F764812A-132C-4013-9960-5CBBEB408A0E} "NeroShellExt Class" - "Nero AG" - C:\Program Files (x86)\Common Files\Nero\NeroShellExt\NeroShellExt.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\OLKFSTUB.DLL
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\npjpi160_31.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_3_300_265.ocx / hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min

"QLBController" - "Hewlett-Packard Company" - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe /start

"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"EPSON SX110 Series 64MonitorBE" - "SEIKO EPSON CORPORATION" - C:\Windows\system32\E_ILMFBE.DLL
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)

"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)

"@C:\Program Files (x86)\Nero\Update\NASvc.exe,-200" (NAUpdate) - "Nero AG" - C:\Program Files (x86)\Nero\Update\NASvc.exe

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

"HP Hotkey Monitor" (hpHotkeyMonitor) - "Hewlett-Packard Company" - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe

"HP Quick Synchronization Service" (HPDrvMntSvc.exe) - "Hewlett-Packard Company" - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

"HP Software Framework Service" (hpqwmiex) - "Hewlett-Packard Company" - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

"Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"StarWind AE Service" (StarWindServiceAE) - "StarWind Software" - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-07-18 11:33:53

-----------------------------

11:33:53.567    OS Version: Windows x64 6.1.7601 Service Pack 1

11:33:53.567    Number of processors: 2 586 0x603

11:33:53.567    ComputerName: MYSELF-PC  UserName: Myself

11:33:54.612    Initialize success

11:34:01.554    AVAST engine defs: 12071800

11:34:06.109    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

11:34:06.125    Disk 0 Vendor: WDC_WD3200BEVT-60A23T0 02.01A02 Size: 305245MB BusType: 11

11:34:06.172    Disk 0 MBR read successfully

11:34:06.187    Disk 0 MBR scan

11:34:06.187    Disk 0 Windows 7 default MBR code

11:34:06.187    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

11:34:06.203    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       305143 MB offset 206848

11:34:06.234    Disk 0 scanning C:\Windows\system32\drivers

11:34:15.781    Service scanning

11:35:16.481    Modules scanning

11:35:16.496    Disk 0 trace - called modules:

11:35:16.512    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys 

11:35:16.528    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007d26430]

11:35:16.528    3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> [0xfffffa8007c1c280]

11:35:16.543    5 ACPI.sys[fffff88000f217a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8007c5d680]

11:35:18.415    AVAST engine scan C:\Windows

11:35:22.378    AVAST engine scan C:\Windows\system32

11:38:06.147    AVAST engine scan C:\Windows\system32\drivers

11:38:17.192    AVAST engine scan C:\Users\Myself

11:57:46.414    AVAST engine scan C:\ProgramData

11:58:20.047    Scan finished successfully

12:00:42.975    Disk 0 MBR has been saved successfully to "C:\Users\Myself\Desktop\MBR.dat"

12:00:42.975    The log file has been saved successfully to "C:\Users\Myself\Desktop\aswMBR2.txt"

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hier schonmal das erste Logfile, Rest folgt

Code:

Malwarebytes Anti-Malware (Test) 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.07.18.08
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Myself :: MYSELF-PC [Administrator]
 

Schutz: Aktiviert
 

18.07.2012 20:40:46

mbam-log-2012-07-18 (20-40-46).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 381334

Laufzeit: 50 Minute(n), 56 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 07/18/2012 at 11:27 PM
 

Application Version : 5.5.1006
 

Core Rules Database Version : 8921

Trace Rules Database Version: 6733
 

Scan type       : Complete Scan

Total Scan Time : 01:46:35
 

Operating System Information

Windows 7 Ultimate 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Administrator
 

Memory items scanned      : 655

Memory threats detected   : 0

Registry items scanned    : 65716

Registry threats detected : 0

File items scanned        : 177562

File threats detected     : 622
 

Adware.Tracking Cookie

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\G9SG980X.txt [ /c.atdmt.com ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\PN8NJJN4.txt [ /ad.zanox.com ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\8LOL1W30.txt [ /ad1.adfarm1.adition.com ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\JIW0S0CH.txt [ /doubleclick.net ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\1MNRE2QL.txt [ /apmebf.com ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\FPU7TU1R.txt [ /adfarm1.adition.com ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\6M79VB95.txt [ /fastclick.net ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\68FSHOEY.txt [ /de.sitestat.com ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\3WC2LN61.txt [ /zanox.com ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\P08GOWS3.txt [ /mediaplex.com ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\UKX9QZC8.txt [ /atdmt.com ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\9GIE3MZG.txt [ /2o7.net ]

        C:\Users\Myself\AppData\Roaming\Microsoft\Windows\Cookies\K1UDQC7F.txt [ /www.etracker.de ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\DRBWAIR4.txt [ Cookie:gast@c.atdmt.com/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\TIZOQW7G.txt [ Cookie:gast@msnportal.112.2o7.net/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\J0YJT3SM.txt [ Cookie:gast@fl01.ct2.comclick.com/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\TFM5GGUT.txt [ Cookie:gast@adfarm1.adition.com/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\G2VA8OIO.txt [ Cookie:gast@ad.yieldmanager.com/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\WQI0QY5N.txt [ Cookie:gast@apmebf.com/ ]

        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\MNNZ3NXW.txt [ Cookie:gast@mediaplex.com/ ]

        C:\USERS\GAST\Cookies\DRBWAIR4.txt [ Cookie:gast@c.atdmt.com/ ]

        C:\USERS\GAST\Cookies\TIZOQW7G.txt [ Cookie:gast@msnportal.112.2o7.net/ ]

        C:\USERS\GAST\Cookies\J0YJT3SM.txt [ Cookie:gast@fl01.ct2.comclick.com/ ]

        C:\USERS\GAST\Cookies\TFM5GGUT.txt [ Cookie:gast@adfarm1.adition.com/ ]

        C:\USERS\GAST\Cookies\G2VA8OIO.txt [ Cookie:gast@ad.yieldmanager.com/ ]

        C:\USERS\GAST\Cookies\WQI0QY5N.txt [ Cookie:gast@apmebf.com/ ]

        C:\USERS\GAST\Cookies\MNNZ3NXW.txt [ Cookie:gast@mediaplex.com/ ]

        C:\USERS\MYSELF\Cookies\G9SG980X.txt [ Cookie:myself@c.atdmt.com/ ]

        C:\USERS\MYSELF\Cookies\8LOL1W30.txt [ Cookie:myself@ad1.adfarm1.adition.com/ ]

        C:\USERS\MYSELF\Cookies\JIW0S0CH.txt [ Cookie:myself@doubleclick.net/ ]

        C:\USERS\MYSELF\Cookies\1MNRE2QL.txt [ Cookie:myself@apmebf.com/ ]

        C:\USERS\MYSELF\Cookies\P08GOWS3.txt [ Cookie:myself@mediaplex.com/ ]

        C:\USERS\MYSELF\Cookies\K1UDQC7F.txt [ Cookie:myself@www.etracker.de/ ]

        secure-uk.imrworldwide.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RFGGKV2L ]

        track.webgains.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RFGGKV2L ]

        www.octoporno.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RFGGKV2L ]

        .smartadserver.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .specificclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .deutschepostag.112.2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .skydeutschland.122.2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .liveperson.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .a.revenuemax.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ad3.adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultbay.org [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .112.2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ad-emea.doubleclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ad-emea.doubleclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.digital-eliteboard.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.digital-eliteboard.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.digital-eliteboard.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.digital-eliteboard.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.digital-eliteboard.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .fls.doubleclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ru4.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        server.adformdsp.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adxpose.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tto2.traffictrack.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adserver.adtechus.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ero-advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .clickfuse.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ww251.smartadserver.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .uk.at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .247realmedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .247realmedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornbb.org [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .yadro.ru [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        7.rotator.wigetmedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .uk.at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .gostats.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tns-counter.ru [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .statcounter.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .statcounter.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6wjloemdjsfo.stats.esomniture.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .go.evolutionmedia.bbelements.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        delivery.way2traffic.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        delivery.way2traffic.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        delivery.way2traffic.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        delivery.way2traffic.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        delivery.way2traffic.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .go.evolutionmedia.bbelements.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .vodafonebranding.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .vodafonebranding.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .vodafonebranding.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .vodafonebranding.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        stat.onestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        stat.onestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        beacons.hottraffic.nl [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .googleads.g.doubleclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        media.gan-online.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6wnmiukajgfo.stats.esomniture.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .lucidmedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ru4.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ox-d.secure-clicks.org [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        pornoturbo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .sexvideo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .sexvideo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.sexvideo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornturbo.xxx [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornturbo.xxx [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornturbo.xxx [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornturbo.xxx [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornturbo.xxx [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adxpansion.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornturbo.xxx [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornturbo.xxx [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.pornturbo.xxx [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .syndication.traffichaus.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .syndication.traffichaus.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6aelyokd5acp.stats.esomniture.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        server.adformdsp.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adformdsp.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adform.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6wnmykkdjmep.stats.esomniture.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        stat.onestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6wjliejazsgp.stats.esomniture.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .cyonix.to [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .cyonix.to [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        xxx-blog.to [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .xxx-blog.to [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        count.rbc.ru [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .engine.mediamir.medialand.ru [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .medialand.ru [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .medialand.ru [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .go.evolutionmedia.bbelements.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .go.evolutionmedia.bbelements.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .go.evolutionmedia.bbelements.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .toplist.cz [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pro-market.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pro-market.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pro-market.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        tracking.point-rouge.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        tracking.point-rouge.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        adx.ibibo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6wfmyalc5chq.stats.esomniture.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tribalfusion.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        adx.betfair.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        fidelity.rotator.hadj7.adjuggler.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        fidelity.rotator.hadj7.adjuggler.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        fidelity.rotator.hadj7.adjuggler.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.sexy.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        api.zanox.ws [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6wjmykjcpabp.stats.esomniture.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        adserver.anschlusstor.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        vb.mol.vs.bluedotmedia.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        vb.mol.vs.bluedotmedia.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pubads.g.doubleclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        imagevenue.advertserve.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        imagevenue.advertserve.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultadworld.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultadworld.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultadworld.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultadworld.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .mmotraffic.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .statcounter.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .moviepilot.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .moviepilot.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        partners.webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.adserver01.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        api.zanox.ws [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        serv12.bluffmedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .bwincom.122.2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.fahrrad-fitness-discount.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .nextag.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .nextag.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www3.smartadserver.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .premiumtv.122.2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6aemyuiajskp.stats.esomniture.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.zanox-affiliate.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornleech.eu [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornleech.eu [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .paypal.112.2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adnetwork.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.active-tracking.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.active-tracking.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.active-tracking.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .autoscout24.112.2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .clicksor.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .clicksor.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .myroitracking.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .clicksor.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .clicksor.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        media.gan-online.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .blogads.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .blogads.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .sexy.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        media.neodau.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        media.neodau.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        media.neodau.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ads.proxy1.adservr.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .komtrack.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .komtrack.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .komtrack.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .www.mediaversand.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .uk.at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .dealtime.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        stat.dealtime.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.dyntracker.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        adserver.gb5.motorpresse.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6wfkiohcjeeo.stats.esomniture.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultbay.org [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tacoda.at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tacoda.at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tacoda.at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tacoda.at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tacoda.at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tacoda.at.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ar.atwola.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .questionmarket.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .questionmarket.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .wikiporno.org [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .wikiporno.org [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .wikiporno.org [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .yieldmanager.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .digital-eliteboard.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .digital-eliteboard.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.adition.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.adition.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        tomtailor.dyntracker.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .cepsaes.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .cepsaes.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .cepsaes.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .cepsaes.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        tracking.mobile.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.mindshare.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.thelabelfinder.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .www.burstnet.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .burstnet.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ecirebajas2.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ecirebajas2.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ecirebajas2.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ecirebajas2.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        server.adform.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .e-2dj6wjkyqodzgeo.stats.esomniture.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.ad-track.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.hannoversche.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        7.rotator.wigetmedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.usenext.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webstats4u.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.dyntracker.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.dyntracker.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        zbox.zanox.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        server.iad.liveperson.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .liveperson.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        media.gan-online.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .kontera.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .oms.122.2o7.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .googleads.g.doubleclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad4.adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        partners.webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        aimfar.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .aimfar.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .weboramapublishertrackinguk2.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .weboramapublishertrackinguk2.solution.weborama.fr [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        statse.webtrendslive.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .4stats.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adviva.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.dyntracker.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.zanox-affiliate.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .zanox-affiliate.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.adserver01.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        banners.victor.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .banners.victor.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad3.adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .ad-emea.doubleclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .xxxblackbook.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .xxxblackbook.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .xxxblackbook.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        www.pornbb.org [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .flagcounter.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornbb.org [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornbb.org [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornbb.org [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .octoporno.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .octoporno.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .octoporno.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornorips.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornorips.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .pornorips.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ads.crakmedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        fr.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        fr.sitestat.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .toplist.eu [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ww251.smartadserver.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        server.adform.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adform.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .stats.paypal.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad1.adfarm1.adition.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .4stats.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .4stats.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .quartermedia.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .quartermedia.de [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        accountservices.betfair.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .stats.betradar.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .stats.betradar.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .stats.betradar.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\MYSELF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\7WJ5TK5K.DEFAULT\COOKIES.SQLITE ]

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=95e76623bdad2140a9f4d9f89b83a2b9

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-07-12 09:28:12

# local_time=2012-07-12 11:28:12 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1792 16777215 100 0 13083099 13083099 0 0

# compatibility_mode=5893 16776574 100 94 31389316 93754237 0 0

# compatibility_mode=8192 67108863 100 0 1411 1411 0 0

# scanned=167597

# found=1

# cleaned=0

# scan_time=4105

C:\Program Files (x86)\FoxTabFLVPlayer\FLVPlayer.exe        a variant of Win32/InstallCore.A application (unable to clean)        00000000000000000000000000000000        I

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=95e76623bdad2140a9f4d9f89b83a2b9

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-07-18 10:56:26

# local_time=2012-07-19 12:56:26 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1792 16777215 100 0 13606606 13606606 0 0

# compatibility_mode=5893 16776573 100 94 0 94277744 0 0

# compatibility_mode=8192 67108863 100 0 524918 524918 0 0

# scanned=182534

# found=0

# cleaned=0

# scan_time=4292

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Vielen Dank erstmal für dein Hilfe. Einfach klasse der Support hier. Danke auch für die vielen Tipps im letzten Post.
Es funktioniert "eigentlich" alles perfekt und wunderbar, einzig die Sache mit den Tastenkombinationen ist leider immer noch nicht behoben. Wie schon gesagt z.B. Strg+c oder Strg+v funktioniert nicht. Auch Strg+f im Browser zum Durchsuchen (finde ich wahnsinnig sinnvoll) geht nicht, da muss ich dann halt den langen Weg gehen (Firefox: Bearbeiten -> Suchen).
Ebenso kann ich bei Windows z.B. wenn ich viele Dateien markiert habe einzelne nicht abwählen wenn ich die Strg Taste gedrückt halte und dann auf eine Datei klicke. Ich denke du weißt was ich meine.
Diese Dinge habe ich auch erst nachdem ich mir diesen Bundespolizei Trojaner eingefangen habe.
Gibt es da noch eine Lösung?

Vielen Dank

Gruß

Gerade herausgefunden, dass die rechte Strg Taste einwandfrei funktioniert. Die linke ist vertauscht und hat die Funktion der fn Taste ... lässt sich wohl durch ein Bios Update wieder herstellen, also Entwarnung.

Abschließend würde ich gerne wissen welche der vielen Programme, die ich hier im Laufe des Threads genutzt habe, ich auch weiterhin ab und an benutzen kann um mein System zu säubern. Bei einigen stand ja explizit dabei, dass man vorsichtig sein muss.

Vielen Dank

Gruß

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Vielen vielen Dank für die Hilfe.

Dann sind wir soweit durch?

Gruß