Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Bundestrojaner, Klappe die 439. (https://www.trojaner-board.de/111319-bundestrojaner-klappe-439-a.html)

Hagen 12.03.2012 14:26
Bundestrojaner, Klappe die 439.
 
Das klassische Design des Bundestrojaners, auch mit der Aufforderung 100€ zu bezahlen.

Habe seit dem die Schritte 1-7 wie gewünscht befolgt und hab den PC im abgesicherten Modus mit Netzwerktreibern

Bitte hilf mir jemand. Ich bin am PC ne totale Null und brauch echt jemanden, der mich idiotensicher durch die sache durchgeleitet.

Hier der dds log

DDS Logfile:
Code:
DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK
Internet Explorer: 7.0.6001.18000  BrowserJavaVersion: 1.6.0_11
Run by *** at 13:55:04 on 2012-03-12
Microsoft® Windows Vista™ Home Premium  6.0.6001.1.1252.49.1031.18.1790.1311 [GMT 1:00]
.
AV: Avira Desktop *Enabled/Outdated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Outdated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://start.icq.com/
uSEARCH PAGE = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/sp/*hxxp://de.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://de.intl.acer.yahoo.com
mDefault_Page_URL = hxxp://de.intl.acer.yahoo.com
uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/su/*hxxp://de.yahoo.com
uURLSearchHooks: ICQToolBar: {855f3b16-6d32-4fe6-8a56-bbb695989046} - c:\program files\icq6toolbar\ICQToolBar.dll
uURLSearchHooks: Yahoo! Toolbar mit Pop-Up-Blocker: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uURLSearchHooks: H - No File
uURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {eee6c35d-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgHelper.dll
BHO: XTTBPos00 Class: {055fd26d-3a88-4e15-963d-dc8493744b1d} - c:\progra~1\icqtoo~1\toolbaru.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Shopping Assistant Plugin: {1631550f-191d-4826-b069-d9439253d926} - c:\program files\pricegong\2.5.4\PriceGongIE.dll
BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SweetPacks Browser Helper: {eee6c35c-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\eDStoolbar.dll
TB: ICQToolBar: {855f3b16-6d32-4fe6-8a56-bbb695989046} - c:\program files\icq6toolbar\ICQToolBar.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: SweetPacks Toolbar for Internet Explorer: {eee6c35b-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll
EB: ICQToolBar: {855f3b16-6d32-4fe6-8a56-bbb695989046} - c:\program files\icq6toolbar\ICQToolBar.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\eDSloader.exe
mRun: [eAudio] "c:\acer\empowering technology\eaudio\eAudio.exe"
mRun: [Acer Tour]
mRun: [LManager] c:\progra~1\launch~1\LManager.exe
mRun: [PlayMovie] "c:\program files\acer arcade deluxe\play movie\PMVService.exe"
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [eRecoveryService]
mRun: [Acer Tour Reminder] c:\acer\acertour\Reminder.exe
mRun: [WarReg_PopUp] c:\acer\wr_popup\WarReg_PopUp.exe
mRun: [MSConfig] "c:\windows\system32\msconfig.exe" /auto
mRun: [Skytel] Skytel.exe
mRun: [WinampAgent] "d:\program files\winamp\winampa.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [<NO NAME>]
mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"
mRun: [SweetIM] c:\program files\sweetim\messenger\SweetIM.exe
mRunOnce: [GrpConv] grpconv -o
StartupFolder: c:\users\***~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\***\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\users\***~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 2.4\program\quickstart.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\empowe~1.lnk - c:\acer\empowering technology\eAPLauncher.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Free YouTube Download - c:\users\***\appdata\roaming\dvdvideosoftiehelpers\freeyoutubedownload.htm
IE: Web-Suche - c:\program files\sweetim\toolbars\internet explorer\resources\menuext.html
IE: {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\icq7.5\ICQ.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
TCP: DhcpNameServer = 10.0.0.1
TCP: Interfaces\{C66F2917-D5D8-4200-AC42-A165F822EB73} : DhcpNameServer = 10.0.0.1
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\***\appdata\roaming\mozilla\firefox\profiles\nuqmv2sc.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.6&q=
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll
.
============= SERVICES / DRIVERS ===============
.
R3 enecir;ENE CIR Receiver;c:\windows\system32\drivers\enecir.sys [2007-7-28 32256]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\acer arcade deluxe\play movie\000.fcl [2008-1-19 13560]
S2 ALaunchService;ALaunch Service;c:\acer\alaunch\ALaunchSvc.exe [2007-7-28 50688]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-4-28 136176]
S2 ICQ Service;ICQ Service;c:\program files\icq6toolbar\ICQ Service.exe [2011-4-21 247608]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-4-28 136176]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [2008-6-12 80744]
.
=============== Created Last 30 ================
.
2012-03-09 15:37:04    --------    d-----w-    c:\users\***\appdata\local\AskToolbar
2012-03-09 11:01:14    6552120    ----a-w-    c:\programdata\microsoft\windows defender\definition updates\{cc08c290-aca6-4147-8942-7388c51d5587}\mpengine.dll
2012-03-09 09:34:46    --------    d-----w-    c:\programdata\Avira
2012-03-09 09:34:46    --------    d-----w-    c:\program files\Avira
2012-03-08 19:19:58    --------    d-----w-    c:\users\***\appdata\roaming\StreamTorrent
2012-03-08 19:19:58    --------    d-----w-    c:\program files\StreamTorrent 1.0
2012-02-26 20:16:07    --------    d-----w-    c:\program files\PriceGong
2012-02-26 20:15:25    --------    d-----w-    c:\programdata\SweetIM
2012-02-26 20:15:25    --------    d-----w-    c:\program files\SweetIM
2012-02-26 20:00:22    --------    d-----w-    c:\program files\common files\Steam
2012-02-25 16:43:31    --------    d-----w-    c:\users\***\appdata\local\Ilivid Player
2012-02-25 16:36:58    --------    d-----w-    c:\program files\iLivid
2012-02-25 16:35:41    --------    d-----w-    c:\users\***\appdata\local\PackageAware
2012-02-22 10:49:30    --------    d-----w-    c:\program files\Ask.com
2012-02-22 10:49:04    --------    d-----w-    c:\users\***\appdata\local\APN
.
==================== Find3M  ====================
.
2012-02-29 13:58:52    414368    ----a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-23 08:18:36    237072    ------w-    c:\windows\system32\MpSigStub.exe
.
============= FINISH: 13:56:41,82 ===============
--- --- ---
EDIT: Hab vor ein paar tagen den neuen Antivir installieren wollen. Dachte auch es geschafft zu haben, nun hab ich gesehn, dass es wohl nicht ging, da mir nichts angezeigt wird. Ich bin also praktisch NACKT und ohne Virenschutz. Gehe deshlab von dieser Seite nicht mehr runter.

cosinus 12.03.2012 16:18
Zitat:
hab den PC im abgesicherten Modus mit Netzwerktreibern
na wenn der Modus geht wirst du erstmal MBAM/ESET probieren können:

Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Hagen 12.03.2012 22:31
Danke für die Hilfe. Wird morgen prompt gemacht

Hagen 13.03.2012 11:31
Das ist schonmal der malware scan

Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.13.02

Windows Vista Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 7.0.6001.18000
*** :: *** [Administrator]

13.03.2012 10:15:32
mbam-log-2012-03-13 (10-15-32).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 322807
Laufzeit: 58 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 6
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{77D6DDFA-7834-4541-B2B3-A8B0FB0E3924} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\ToolBand.XTTBPos00.1 (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\ToolBand.XTTBPos00 (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Users\***\AppData\Local\Temp\ICReinstall_ICReinstall_MediaPlayerSetup.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\AppData\Local\Temp\ICReinstall_MediaPlayerSetup.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\AppData\Local\Temp\wpbt0.dll (Spyware.Zbot.ES) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\ICQToolbar\toolbaru.dll (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Hagen 13.03.2012 13:26
Und der eset Log

Code:
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=171a8ce615236343ace843142ba9dc79
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-03-13 12:10:46
# local_time=2012-03-13 01:10:46 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=5892 16776573 100 100 347815 169167817 0 0
# compatibility_mode=8192 67108863 100 0 3870 3870 0 0
# scanned=167973
# found=3
# cleaned=0
# scan_time=5578
C:\Users\***\AppData\Local\Mozilla\Firefox\Profiles\nuqmv2sc.default\Cache\B\D1\28957d01        JS/Exploit.Pdfka.PIV trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\***\AppData\Local\Temp\SetupDataMngr_Searchqu.exe        Win32/Toolbar.SearchSuite application (unable to clean)        00000000000000000000000000000000        I
C:\Users\***\AppData\Local\Temp\is1373634743\MyBabylonTB.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

cosinus 13.03.2012 17:21
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Hagen 14.03.2012 11:51
OTL Log

OTL Logfile:
Code:
OTL logfile created on: 14.03.2012 11:01:37 - Run 1
OTL by OldTimer - Version 3.2.36.3    Folder = C:\Users\***\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,75 Gb Total Physical Memory | 1,37 Gb Available Physical Memory | 78,33% Memory free
3,74 Gb Paging File | 3,48 Gb Available in Paging File | 93,06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,77 Gb Total Space | 11,52 Gb Free Space | 16,51% Space Free | Partition Type: NTFS
Drive D: | 69,52 Gb Total Space | 58,06 Gb Free Space | 83,52% Space Free | Partition Type: NTFS
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.14 11:00:08 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
PRC - [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2007.09.20 17:34:58 | 000,129,024 | ---- | M] () -- D:\Program Files\WinRAR\RarExt.dll
MOD - [2006.11.30 14:03:46 | 000,434,688 | ---- | M] () -- D:\Program Files\TotalAudioConverter\axTotalConverter.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto | Stopped] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.09.14 14:32:46 | 000,167,936 | ---- | M] (acer) [Auto | Stopped] -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- (WMIService)
SRV - [2007.07.03 10:40:10 | 000,053,248 | ---- | M] (Acer Inc.) [Auto | Stopped] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2007.06.28 17:50:52 | 000,024,576 | ---- | M] () [Auto | Stopped] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)
SRV - [2007.06.13 15:54:36 | 000,135,168 | R--- | M] (Acer Inc.) [Auto | Stopped] -- C:\Acer\Empowering Technology\eNet\eNet Service.exe -- (eNet Service)
SRV - [2007.04.25 15:34:30 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Stopped] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007.04.23 08:53:48 | 000,024,576 | ---- | M] (Acer Inc.) [Auto | Stopped] -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe -- (eLockService)
SRV - [2007.01.26 13:24:42 | 000,050,688 | ---- | M] () [Auto | Stopped] -- C:\Acer\ALaunch\ALaunchSvc.exe -- (ALaunchService)
SRV - [2006.11.24 11:57:54 | 000,107,008 | ---- | M] () [Auto | Stopped] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (IpInIp)
DRV - [2008.12.29 22:57:56 | 000,952,832 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.12.03 21:12:00 | 007,606,688 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007.11.18 02:39:50 | 001,040,544 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2007.06.14 03:33:26 | 000,154,624 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2007.05.21 12:39:48 | 000,101,120 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2007.05.17 02:05:10 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2007.05.17 01:46:50 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007.05.16 13:47:44 | 000,032,256 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\enecir.sys -- (enecir)
DRV - [2007.03.21 21:02:04 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.02.24 13:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007.01.23 15:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006.12.07 18:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006.11.02 16:51:58 | 000,013,560 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Stopped] -- C:\Programme\Acer Arcade Deluxe\Play Movie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})
DRV - [2006.11.02 14:27:34 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Stopped] -- C:\Programme\Launch Manager\DPortIO.sys -- (DritekPortIO)
DRV - [2006.09.19 16:47:04 | 000,080,744 | ---- | M] (Wasay) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSVD.sys -- (WSVD)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/sp/*hxxp://de.yahoo.com
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\SearchScopes,DefaultScope = {6552C7DD-90A4-4387-B795-F8F96747DE19}
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\SearchScopes\{5C108A81-1EF0-4B9D-A3B8-4763FDCA22D2}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.14.1.100010
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.2.6
FF - prefs.js..extensions.enabledItems: {bbf8fc30-5280-11db-b0de-0800200c9a66}:2.20090609
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.6&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.24 10:33:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.24 10:33:28 | 000,000,000 | ---D | M]
 
[2009.01.28 15:09:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.02.26 21:16:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions
[2011.06.28 12:11:14 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.02.25 10:25:29 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.02.26 21:16:07 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
[2011.04.26 16:50:15 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.06.28 12:11:05 | 000,000,000 | ---D | M] (HalloFF) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{bbf8fc30-5280-11db-b0de-0800200c9a66}
[2012.02.22 19:52:05 | 000,000,000 | ---D | M] ("Avira SearchFree Toolbar plus Web Protection") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\toolbar@ask.com
[2012.03.09 10:16:36 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-1.xml
[2009.05.06 09:25:00 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-10.xml
[2011.06.28 12:19:59 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-11.xml
[2012.02.23 20:52:16 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-12.xml
[2008.07.27 20:17:57 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-2.xml
[2008.10.03 06:53:21 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-3.xml
[2008.11.21 11:44:53 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-4.xml
[2009.01.06 08:55:34 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-5.xml
[2009.01.28 15:15:30 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-6.xml
[2009.01.28 17:29:08 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-7.xml
[2009.02.08 13:38:06 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-8.xml
[2009.03.16 18:23:21 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-9.xml
[2011.03.30 14:14:34 | 000,001,042 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin.xml
[2012.02.26 21:15:37 | 000,003,915 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\sweetim.xml
[2012.02.24 10:33:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.02.16 15:55:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.16 12:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.16 11:48:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.16 12:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.16 12:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.16 12:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.16 12:02:53 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\***\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.56\pdf.dll
CHR - plugin: registryAccess (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\background/registryAccess.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Avira Toolbar = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\
CHR - Extension: PriceGong = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.2_0\
CHR - Extension: YouTube = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: Google Mail = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Shopping Assistant Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Programme\PriceGong\2.5.4\PriceGongIE.dll (PriceGong)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acer Tour]  File not found
O4 - HKLM..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [eAudio] C:\Acer\Empowering Technology\eAudio\eAudio.exe (CyberLink)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)
O4 - HKLM..\Run: [eRecoveryService]  File not found
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [MSConfig] C:\Windows\System32\msconfig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O4 - HKLM..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk = C:\Programme\OpenOffice.org 2.4\program\quickstart.exe ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Web-Suche - C:\Programme\SweetIM\Toolbars\Internet Explorer\resources\MenuExt.html ()
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C66F2917-D5D8-4200-AC42-A165F822EB73}: DhcpNameServer = 10.0.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{128d15bc-5e41-11dd-93b9-001b38cd4a29}\Shell - "" = AutoRun
O33 - MountPoints2\{128d15bc-5e41-11dd-93b9-001b38cd4a29}\Shell\AutoRun\command - "" = G:\LaunchU3.exe
O33 - MountPoints2\{44182896-d509-11df-9fe6-001b38cd4a29}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{906c9767-4d18-11dd-a2e0-ce9c950d73e8}\Shell - "" = AutoRun
O33 - MountPoints2\{906c9767-4d18-11dd-a2e0-ce9c950d73e8}\Shell\AutoRun\command - "" = F:\VMC_PBStarter.exe
O33 - MountPoints2\{906c9783-4d18-11dd-a2e0-ce9c950d73e8}\Shell - "" = AutoRun
O33 - MountPoints2\{906c9783-4d18-11dd-a2e0-ce9c950d73e8}\Shell\AutoRun\command - "" = F:\VMC_PBStarter.exe
O33 - MountPoints2\{edec6fcb-9a3c-11de-bc3d-fab406eca9fa}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\VMC_PBStarter.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: Acer Tour Reminder - hkey= - key= - C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
MsConfig - StartUpReg: ICQ - hkey= - key= -  File not found
MsConfig - StartUpReg: MsnMsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (Microsoft Corporation)
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.mkdmp3enc - C:\PROGRA~1\ACERAR~1\DVWIZA~1\Kernel\Burner\MKDMP3Enc.ACM File not found
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.14 11:00:07 | 000,594,944 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.03.13 11:33:39 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.03.13 11:33:11 | 002,322,184 | ---- | C] (ESET) -- C:\Users\***\Desktop\esetsmartinstaller_enu.exe
[2012.03.13 10:14:22 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2012.03.13 10:14:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.03.13 10:14:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.03.13 10:14:11 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.03.13 10:14:11 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.03.13 10:12:50 | 009,502,424 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\***\Desktop\mbam-setup-1.60.1.1000.exe
[2012.03.12 14:38:35 | 146,665,024 | ---- | C] (AVG Technologies) -- C:\Users\***\Desktop\avg_free_x86_all_2012_1913a4770.exe
[2012.03.12 11:20:35 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\***\Desktop\dds.scr
[2012.03.09 16:37:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\AskToolbar
[2012.03.09 10:34:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.03.08 20:19:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StreamTorrent 1.0
[2012.03.08 20:19:58 | 000,000,000 | ---D | C] -- C:\Program Files\StreamTorrent 1.0
[2012.03.08 20:19:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\StreamTorrent
[2012.03.08 11:33:38 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Hintergründe
[2012.02.29 14:58:32 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.02.26 21:16:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong
[2012.02.26 21:16:07 | 000,000,000 | ---D | C] -- C:\Program Files\PriceGong
[2012.02.26 21:15:25 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM
[2012.02.26 21:15:25 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM
[2012.02.26 21:00:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Steam
[2012.02.25 17:43:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Ilivid Player
[2012.02.25 17:36:58 | 000,000,000 | ---D | C] -- C:\Program Files\iLivid
[2012.02.25 17:35:41 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\PackageAware
[2012.02.22 11:49:30 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2012.02.22 11:49:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\APN
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.14 11:00:08 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.03.14 10:54:38 | 000,001,356 | ---- | M] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2012.03.14 10:50:36 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat
[2012.03.13 11:33:12 | 002,322,184 | ---- | M] (ESET) -- C:\Users\***\Desktop\esetsmartinstaller_enu.exe
[2012.03.13 10:13:04 | 009,502,424 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\***\Desktop\mbam-setup-1.60.1.1000.exe
[2012.03.13 10:12:44 | 000,627,756 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.13 10:12:44 | 000,595,386 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.13 10:12:44 | 000,125,676 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.13 10:12:44 | 000,103,460 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.13 10:05:26 | 000,028,599 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.03.13 10:04:51 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.13 10:04:49 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.13 10:04:49 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.12 14:43:05 | 146,665,024 | ---- | M] (AVG Technologies) -- C:\Users\***\Desktop\avg_free_x86_all_2012_1913a4770.exe
[2012.03.12 14:20:55 | 000,000,427 | ---- | M] () -- C:\Users\***\Desktop\gmer.zip
[2012.03.12 14:20:45 | 000,001,884 | ---- | M] () -- C:\Users\***\Desktop\attach.zip
[2012.03.12 11:43:06 | 000,302,592 | ---- | M] () -- C:\Users\***\Desktop\yl9xw2mx.exe
[2012.03.12 11:20:36 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\***\Desktop\dds.scr
[2012.03.12 11:13:38 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable
[2012.03.12 11:11:56 | 000,050,477 | ---- | M] () -- C:\Users\***\Desktop\Defogger.exe
[2012.03.12 11:01:46 | 000,028,599 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.03.10 10:02:47 | 000,059,904 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.10 00:12:00 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.08 20:19:58 | 000,000,918 | ---- | M] () -- C:\Users\***\Desktop\StreamTorrent 1.0.lnk
[2012.02.27 01:02:30 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2012.02.27 01:02:30 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2012.02.25 17:46:55 | 000,000,011 | R--- | M] () -- C:\Windows\amunres.lsl
[2012.02.25 10:21:20 | 000,000,927 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012.02.24 10:33:30 | 000,000,850 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.12 14:20:55 | 000,000,427 | ---- | C] () -- C:\Users\***\Desktop\gmer.zip
[2012.03.12 14:20:45 | 000,001,884 | ---- | C] () -- C:\Users\***\Desktop\attach.zip
[2012.03.12 11:43:05 | 000,302,592 | ---- | C] () -- C:\Users\***\Desktop\yl9xw2mx.exe
[2012.03.12 11:13:38 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable
[2012.03.12 11:11:55 | 000,050,477 | ---- | C] () -- C:\Users\***\Desktop\Defogger.exe
[2012.03.08 20:19:58 | 000,000,918 | ---- | C] () -- C:\Users\***\Desktop\StreamTorrent 1.0.lnk
[2012.02.27 01:02:30 | 000,000,268 | -H-- | C] () -- C:\sqmdata00.sqm
[2012.02.27 01:02:30 | 000,000,244 | -H-- | C] () -- C:\sqmnoopt00.sqm
[2012.02.25 17:46:55 | 000,000,011 | R--- | C] () -- C:\Windows\amunres.lsl
[2012.02.24 10:33:30 | 000,000,862 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.02.24 10:33:30 | 000,000,850 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.05.25 01:24:00 | 000,000,000 | ---- | C] () -- C:\Windows\PCFriend.INI
[2011.05.25 01:23:48 | 000,000,116 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2011.04.21 12:52:23 | 000,074,240 | ---- | C] () -- C:\Windows\AKDeInstall.exe
 
========== LOP Check ==========
 
[2009.01.17 22:37:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Azureus
[2012.03.13 10:06:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox
[2011.09.01 11:50:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2011.04.26 16:50:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.08 21:44:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2008.06.14 07:26:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ Toolbar
[2008.07.19 17:56:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Softplicity
[2012.03.08 20:19:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\StreamTorrent
[2009.01.06 22:12:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TeamViewer
[2012.03.13 10:07:02 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2008.06.14 13:21:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe
[2009.01.17 22:37:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Azureus
[2011.02.11 14:41:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\CyberLink
[2011.08.21 01:23:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DivX
[2012.03.13 10:06:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox
[2011.09.01 11:50:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2011.04.26 16:50:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.08 21:44:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2008.06.14 07:26:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ Toolbar
[2008.06.12 16:05:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities
[2008.06.12 16:05:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia
[2012.03.13 10:14:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs
[2011.12.16 15:56:02 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft
[2009.01.28 15:09:03 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mozilla
[2012.03.12 11:03:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org2
[2008.07.19 17:56:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Softplicity
[2012.03.08 20:19:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\StreamTorrent
[2008.06.14 07:52:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Symantec
[2008.07.28 18:33:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\teamspeak2
[2009.01.06 22:12:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TeamViewer
[2008.07.30 15:14:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\U3
[2011.03.27 21:03:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Winamp
[2008.06.17 17:13:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2012.02.15 00:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe
[2012.02.15 00:03:44 | 000,174,752 | ---- | M] (Dropbox, Inc.) -- C:\Users\***\AppData\Roaming\Dropbox\bin\Uninstall.exe
[2011.11.11 12:53:15 | 008,111,264 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\***\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2011.12.16 15:56:03 | 000,000,766 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{78AB3064-5C72-4BAE-AA58-22B2EA69501E}\_2F4443E31A160A53B3A51A.exe
[2011.12.16 15:56:03 | 000,000,766 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{78AB3064-5C72-4BAE-AA58-22B2EA69501E}\_321A615469AB78C37BF107.exe
[2011.12.16 15:56:03 | 000,000,766 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{78AB3064-5C72-4BAE-AA58-22B2EA69501E}\_6FEFF9B68218417F98F549.exe
[2005.06.06 10:29:14 | 000,110,592 | ---- | M] () -- C:\Users\***\AppData\Roaming\U3\081073714170A894\cleanup.exe
[2006.04.25 16:37:22 | 002,592,768 | ---- | M] () -- C:\Users\***\AppData\Roaming\U3\081073714170A894\Launchpad.exe
 
< %SYSTEMDRIVE%\*.exe >
[2005.08.16 08:49:12 | 000,040,960 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\junction.exe
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2007.07.28 10:16:04 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_cb7c81c7\AGP440.sys
[2007.07.28 10:16:04 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20598_none_b85cfa98dae9b436\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.06.14 08:41:01 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.06.14 08:41:01 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.06.14 08:41:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: ENETHOOK.DLL  >
[2007.06.13 15:53:50 | 000,090,112 | R--- | M] (acer) MD5=B6A1D439109F7294C1BE14D5DC0C41AC -- C:\Acer\Empowering Technology\eNet\eNetHook.dll
[2007.06.13 15:53:50 | 000,090,112 | R--- | M] (acer) MD5=B6A1D439109F7294C1BE14D5DC0C41AC -- C:\Windows\System32\eNetHook.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.04.04 12:35:52 | 000,108,328 | ---- | M] (NVIDIA Corporation) MD5=4A820160BC3C85297BF33CEF08A905C2 -- C:\DRV\CHIPSET\IDE\WINVISTA\SATA_IDE\NVSTOR32.SYS
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.07.28 09:56:05 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2007.07.28 09:56:05 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008.01.19 08:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\System32\user32.dll
[2008.01.19 08:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 10:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 09:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 11:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:B623B5B8
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:B203B914
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:A95A95AC
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:798A3728
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:7B212553
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:0A73A758

< End of report >
--- --- ---


Ich komm mir vor wie jemand der ne Operation am offenen Herzen unter Anleitung durchführt ohne auch nur die geringste Ahnung zu haben was er tut :crazy: Aber vielen vielen Dank für diese Anleitung :party:

Kannst du mir vielleicht sagen wo wir stehen??? Welchen Teil des Weges haben wir schon geschafft?? Wie ist die Prognose??

Ich führe eben stur deine Befehle aus ohne den geringsten Schimmer watt dat bringt. Ist sehr ungewohnt für mich. Normalerweise bin ich nicht gänzlich doof. AAAAAAAAAAAAAAAAHHHHHHHH!!!! ;-)

cosinus 14.03.2012 15:25
Funktioniert der normale Modus noch nicht?
Und nein an dieser Stelle kann man noch keine genaueren Aussagen machen

Hagen 14.03.2012 15:37
Sobald der pc angeht geht ich in den abgesicherten modus. in den normalen trau ich mich nicht

cosinus 14.03.2012 15:59
Was soll das werden du traust dich nicht? :wtf:
Probier es bitte aus!

Hagen 14.03.2012 20:37
Bin im normalen Modus und es scheint alles zu gehen. Er ist irritierend langsam aber sonst scheint alles glatt zu gehen

cosinus 14.03.2012 21:44
Dann mach in diesem Modus wieder ein neues OTL-Log!

Hagen 15.03.2012 11:30
hier der neue otl log

OTL Logfile:
Code:
OTL logfile created on: 14.03.2012 23:16:56 - Run 2
OTL by OldTimer - Version 3.2.36.3    Folder = C:\Users\***\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,75 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 45,18% Memory free
3,74 Gb Paging File | 2,20 Gb Available in Paging File | 58,90% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,77 Gb Total Space | 11,80 Gb Free Space | 16,91% Space Free | Partition Type: NTFS
Drive D: | 69,52 Gb Total Space | 56,74 Gb Free Space | 81,62% Space Free | Partition Type: NTFS
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - File not found --
PRC - [2012.03.14 20:52:51 | 000,909,152 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe
PRC - [2012.03.14 20:52:50 | 000,939,872 | ---- | M] () -- C:\Programme\AVG Secure Search\vprot.exe
PRC - [2012.03.14 11:00:08 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
PRC - [2012.02.15 00:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012.01.24 17:24:26 | 002,416,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgtray.exe
PRC - [2012.01.19 12:30:04 | 000,114,992 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Messenger\SweetIM.exe
PRC - [2011.11.28 01:19:04 | 001,229,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgnsx.exe
PRC - [2011.11.03 17:20:58 | 000,803,144 | ---- | M] (AVG) -- C:\Programme\AVG\AVG PC Tuneup\BoostSpeed.exe
PRC - [2011.10.12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011.10.10 06:23:34 | 000,973,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgemcx.exe
PRC - [2011.09.08 20:53:26 | 000,743,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgrsx.exe
PRC - [2011.08.15 06:21:40 | 000,337,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgcsrvx.exe
PRC - [2011.08.02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgwdsvc.exe
PRC - [2011.08.02 06:08:34 | 000,967,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgscanx.exe
PRC - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe
PRC - [2008.11.10 05:43:54 | 000,382,384 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Java\jre6\bin\jucheck.exe
PRC - [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.07.09 15:16:38 | 000,036,352 | ---- | M] () -- D:\Program Files\Winamp\winampa.exe
PRC - [2008.05.29 21:30:18 | 002,580,480 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.4\program\soffice.bin
PRC - [2008.05.29 21:28:18 | 002,363,392 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.4\program\soffice.exe
PRC - [2008.01.19 08:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2008.01.19 08:33:30 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2008.01.19 08:33:04 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2007.09.14 14:32:46 | 000,167,936 | ---- | M] (acer) -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
PRC - [2007.09.14 10:06:48 | 000,454,656 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
PRC - [2007.08.29 10:35:38 | 000,323,584 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
PRC - [2007.08.15 10:21:38 | 000,772,616 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\LManager.exe
PRC - [2007.07.06 04:06:52 | 004,669,440 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.07.03 10:40:10 | 000,053,248 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
PRC - [2007.06.28 17:50:52 | 000,024,576 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
PRC - [2007.06.13 15:56:18 | 000,765,952 | R--- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNMTray.exe
PRC - [2007.06.13 15:54:36 | 000,135,168 | R--- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNet Service.exe
PRC - [2007.06.11 13:54:58 | 001,286,144 | ---- | M] (CyberLink) -- C:\Acer\Empowering Technology\eAudio\eAudio.exe
PRC - [2007.05.24 13:38:22 | 000,206,952 | ---- | M] (CyberLink Corp.) -- C:\Programme\Acer Arcade Deluxe\Play Movie\PMVService.exe
PRC - [2007.04.25 15:34:30 | 000,457,512 | ---- | M] (HiTRSUT) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
PRC - [2007.04.25 15:33:36 | 000,457,216 | ---- | M] (HiTRUST) -- C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
PRC - [2007.04.23 08:53:48 | 000,024,576 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
PRC - [2007.02.09 06:35:54 | 000,397,312 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
PRC - [2007.01.26 13:24:42 | 000,050,688 | ---- | M] () -- C:\Acer\ALaunch\ALaunchSvc.exe
PRC - [2006.11.24 11:57:54 | 000,107,008 | ---- | M] () -- C:\Acer\Mobility Center\MobilityService.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.03.14 20:52:50 | 000,939,872 | ---- | M] () -- C:\Programme\AVG Secure Search\vprot.exe
MOD - [2011.11.03 17:21:06 | 000,350,024 | ---- | M] () -- C:\Programme\AVG\AVG PC Tuneup\madExcept_.bpl
MOD - [2011.11.03 17:21:06 | 000,184,136 | ---- | M] () -- C:\Programme\AVG\AVG PC Tuneup\madBasic_.bpl
MOD - [2011.11.03 17:21:06 | 000,050,504 | ---- | M] () -- C:\Programme\AVG\AVG PC Tuneup\madDisAsm_.bpl
MOD - [2011.06.29 19:24:55 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\e3180b4230f052996adb81da3dc64ad0\System.Management.ni.dll
MOD - [2011.06.29 19:23:09 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\c933fd5d1d27f268331890d7ddba8fec\System.ServiceProcess.ni.dll
MOD - [2011.06.29 19:23:02 | 011,800,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\0a1195c6b5fab213527364c9e8b26ef0\System.Web.ni.dll
MOD - [2011.06.29 19:22:52 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\1ba19f8efcff8ad7f972aa38ab9a15f5\System.Runtime.Remoting.ni.dll
MOD - [2011.06.29 19:22:32 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\aa3e053d433c48e1e8c3f436b4de1ed3\System.Configuration.ni.dll
MOD - [2011.06.29 00:04:20 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\cfb60f99da570cc494e27e0e8ee747e2\System.Xml.ni.dll
MOD - [2011.06.29 00:03:47 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\381fb23cb39e1a61e13b8770eb9800ba\System.Windows.Forms.ni.dll
MOD - [2011.06.29 00:03:28 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f1aa2385c0109f3059e0e6ba8b58ff68\System.Drawing.ni.dll
MOD - [2011.06.29 00:01:48 | 007,950,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dff86a62a525ec8dc827fe9f50298b7\System.ni.dll
MOD - [2011.06.29 00:01:27 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll
MOD - [2008.07.27 19:03:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2008.07.09 15:16:38 | 000,036,352 | ---- | M] () -- D:\Program Files\Winamp\winampa.exe
MOD - [2007.12.19 14:04:24 | 000,828,416 | ---- | M] () -- C:\Programme\OpenOffice.org 2.4\program\libxml2.dll
MOD - [2007.09.20 17:34:58 | 000,129,024 | ---- | M] () -- D:\Program Files\WinRAR\RarExt.dll
MOD - [2007.08.29 10:35:12 | 000,057,344 | ---- | M] () -- C:\Acer\Empowering Technology\Acer.Empowering.Framework.DialogManager.dll
MOD - [2007.08.29 10:34:34 | 000,024,576 | ---- | M] () -- C:\Acer\Empowering Technology\Acer.Empowering.Framework.PasswordSetting.dll
MOD - [2007.07.24 10:39:40 | 000,208,896 | ---- | M] () -- C:\Acer\Empowering Technology\ePower\SysHook.dll
MOD - [2007.06.28 17:50:56 | 000,028,672 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\eSettings.Plugin.dll
MOD - [2007.06.28 17:50:56 | 000,003,584 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\de\eSettings.Plugin.resources.dll
MOD - [2007.06.28 17:50:38 | 000,010,752 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\de\eSettings.Presenter.resources.dll
MOD - [2007.06.28 17:50:36 | 000,155,648 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\eSettings.Presenter.dll
MOD - [2007.06.28 17:50:28 | 003,420,160 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\eSettings.View.dll
MOD - [2007.06.28 17:50:20 | 000,032,768 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings.Model.ComputerInterfaces.dll
MOD - [2007.06.13 15:56:36 | 000,249,856 | R--- | M] () -- C:\Acer\Empowering Technology\eNet\eNetPlugin.dll
MOD - [2007.06.11 13:54:18 | 000,106,496 | ---- | M] () -- C:\Acer\Empowering Technology\eAudio\eAudioUI.dll
MOD - [2007.05.24 08:53:34 | 000,106,496 | ---- | M] () -- C:\Acer\Empowering Technology\eLock\de\eLockCTL.resources.dll
MOD - [2007.05.24 08:53:32 | 000,679,936 | ---- | M] () -- C:\Acer\Empowering Technology\eLock\eLockCTL.dll
MOD - [2007.04.25 15:31:00 | 000,028,672 | ---- | M] () -- C:\Windows\System32\BatchCrypto.dll
MOD - [2007.04.25 15:30:44 | 000,063,488 | ---- | M] () -- C:\Windows\System32\ShowErrMsg.dll
MOD - [2007.04.11 15:42:40 | 000,307,200 | ---- | M] () -- C:\Acer\Empowering Technology\ePresentation\ePresentationCTL.dll
MOD - [2007.04.11 14:07:46 | 000,077,824 | ---- | M] () -- C:\Acer\Empowering Technology\ePresentation\de\ePresentationCTL.resources.dll
MOD - [2007.03.22 10:51:56 | 000,003,584 | ---- | M] () -- C:\Acer\Empowering Technology\eAudio\de\eAudioUI.resources.dll
MOD - [2007.02.13 06:26:30 | 000,016,384 | ---- | M] () -- C:\Acer\Empowering Technology\eRecovery\ServiceInterface.dll
MOD - [2006.11.30 14:03:46 | 000,434,688 | ---- | M] () -- D:\Program Files\TotalAudioConverter\axTotalConverter.dll
MOD - [2003.06.07 06:30:08 | 000,057,344 | ---- | M] () -- C:\Programme\Launch Manager\PowerUtl.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.03.14 20:52:51 | 000,909,152 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe -- (vToolbarUpdater)
SRV - [2011.10.12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011.08.02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.09.14 14:32:46 | 000,167,936 | ---- | M] (acer) [Auto | Running] -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- (WMIService)
SRV - [2007.07.03 10:40:10 | 000,053,248 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2007.06.28 17:50:52 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)
SRV - [2007.06.13 15:54:36 | 000,135,168 | R--- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eNet\eNet Service.exe -- (eNet Service)
SRV - [2007.04.25 15:34:30 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Running] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007.04.23 08:53:48 | 000,024,576 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe -- (eLockService)
SRV - [2007.01.26 13:24:42 | 000,050,688 | ---- | M] () [Auto | Running] -- C:\Acer\ALaunch\ALaunchSvc.exe -- (ALaunchService)
SRV - [2006.11.24 11:57:54 | 000,107,008 | ---- | M] () [Auto | Running] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (IpInIp)
DRV - [2011.10.07 06:23:48 | 000,230,608 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2011.10.04 06:21:16 | 000,016,720 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011.09.13 06:30:10 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011.08.08 06:08:58 | 000,040,016 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011.07.11 01:14:38 | 000,295,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011.07.11 01:14:02 | 000,024,272 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011.07.11 01:14:00 | 000,023,120 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Stopped] -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011.07.11 01:13:58 | 000,134,736 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2008.12.29 22:57:56 | 000,952,832 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.12.03 21:12:00 | 007,606,688 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007.11.18 02:39:50 | 001,040,544 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2007.06.14 03:33:26 | 000,154,624 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2007.05.21 12:39:48 | 000,101,120 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2007.05.17 02:05:10 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2007.05.17 01:46:50 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007.05.16 13:47:44 | 000,032,256 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\enecir.sys -- (enecir)
DRV - [2007.03.21 21:02:04 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.02.24 13:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007.01.23 15:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006.12.07 18:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006.11.02 16:51:58 | 000,013,560 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Programme\Acer Arcade Deluxe\Play Movie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})
DRV - [2006.11.02 14:27:34 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Programme\Launch Manager\DPortIO.sys -- (DritekPortIO)
DRV - [2006.09.19 16:47:04 | 000,080,744 | ---- | M] (Wasay) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSVD.sys -- (WSVD)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/sp/*hxxp://de.yahoo.com
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\SearchScopes\{5C108A81-1EF0-4B9D-A3B8-4763FDCA22D2}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={F05FB8D8-6EA6-4200-89D2-E592A47F1545}&mid=6a6bd21da01547d08e0cd1527e29a3da-782f070b6d0772fd2d4e4ef7e9f99257ef3ab50b&lang=de&ds=AVG&pr=fr&d=2012-03-14 20:53:09&v=10.0.0.7&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.14.1.100010
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.2.6
FF - prefs.js..extensions.enabledItems: {bbf8fc30-5280-11db-b0de-0800200c9a66}:2.20090609
FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid=%7Bbdaca476-5135-4791-a24a-91fe6f92cee6%7D&mid=6a6bd21da01547d08e0cd1527e29a3da-782f070b6d0772fd2d4e4ef7e9f99257ef3ab50b&ds=AVG&v=10.0.0.7&lang=de&pr=fr&d=2012-03-14%2020%3A53%3A09&sap=ku&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012.03.14 20:54:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\10.0.0.7\ [2012.03.14 20:53:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.24 10:33:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.24 10:33:28 | 000,000,000 | ---D | M]
 
[2009.01.28 15:09:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.03.14 21:15:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions
[2011.06.28 12:11:14 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.02.25 10:25:29 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.02.26 21:16:07 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
[2011.04.26 16:50:15 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.06.28 12:11:05 | 000,000,000 | ---D | M] (HalloFF) -- C:\Users\***AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{bbf8fc30-5280-11db-b0de-0800200c9a66}
[2012.03.09 10:16:36 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-1.xml
[2009.05.06 09:25:00 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-10.xml
[2011.06.28 12:19:59 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-11.xml
[2012.02.23 20:52:16 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-12.xml
[2008.07.27 20:17:57 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-2.xml
[2008.10.03 06:53:21 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-3.xml
[2008.11.21 11:44:53 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-4.xml
[2009.01.06 08:55:34 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-5.xml
[2009.01.28 15:15:30 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-6.xml
[2009.01.28 17:29:08 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-7.xml
[2009.02.08 13:38:06 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-8.xml
[2009.03.16 18:23:21 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-9.xml
[2011.03.30 14:14:34 | 000,001,042 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin.xml
[2012.02.26 21:15:37 | 000,003,915 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\sweetim.xml
[2012.02.24 10:33:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.14 20:54:01 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG2012\FIREFOX4
[2012.03.14 20:53:48 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\PROGRAMDATA\AVG SECURE SEARCH\10.0.0.7
[2012.02.16 15:55:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.16 12:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.03.14 20:52:43 | 000,003,747 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.02.16 11:48:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.16 12:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.16 12:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.16 12:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.16 12:02:53 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\***\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.78\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.78\pdf.dll
CHR - plugin: registryAccess (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\background/registryAccess.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Avira Toolbar = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\
CHR - Extension: PriceGong = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.2_0\
CHR - Extension: YouTube = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: Google Mail = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Shopping Assistant Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Programme\PriceGong\2.5.4\PriceGongIE.dll (PriceGong)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll ()
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [Acer Tour]  File not found
O4 - HKLM..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [eAudio] C:\Acer\Empowering Technology\eAudio\eAudio.exe (CyberLink)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [MSConfig] C:\Windows\System32\msconfig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O4 - HKLM..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk = C:\Programme\OpenOffice.org 2.4\program\quickstart.exe ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Web-Suche - C:\Programme\SweetIM\Toolbars\Internet Explorer\resources\MenuExt.html ()
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C66F2917-D5D8-4200-AC42-A165F822EB73}: DhcpNameServer = 10.0.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Programme\Common Files\AVG Secure Search\ViProtocolInstaller\10.0.6\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{128d15bc-5e41-11dd-93b9-001b38cd4a29}\Shell - "" = AutoRun
O33 - MountPoints2\{128d15bc-5e41-11dd-93b9-001b38cd4a29}\Shell\AutoRun\command - "" = G:\LaunchU3.exe
O33 - MountPoints2\{44182896-d509-11df-9fe6-001b38cd4a29}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{906c9767-4d18-11dd-a2e0-ce9c950d73e8}\Shell - "" = AutoRun
O33 - MountPoints2\{906c9767-4d18-11dd-a2e0-ce9c950d73e8}\Shell\AutoRun\command - "" = F:\VMC_PBStarter.exe
O33 - MountPoints2\{906c9783-4d18-11dd-a2e0-ce9c950d73e8}\Shell - "" = AutoRun
O33 - MountPoints2\{906c9783-4d18-11dd-a2e0-ce9c950d73e8}\Shell\AutoRun\command - "" = F:\VMC_PBStarter.exe
O33 - MountPoints2\{edec6fcb-9a3c-11de-bc3d-fab406eca9fa}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\VMC_PBStarter.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: Acer Tour Reminder - hkey= - key= - C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
MsConfig - StartUpReg: ICQ - hkey= - key= -  File not found
MsConfig - StartUpReg: MsnMsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (Microsoft Corporation)
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.mkdmp3enc - C:\PROGRA~1\ACERAR~1\DVWIZA~1\Kernel\Burner\MKDMP3Enc.ACM File not found
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.14 21:24:23 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\AVG
[2012.03.14 21:23:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC Tuneup 2011
[2012.03.14 21:03:45 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\AVG2012
[2012.03.14 20:54:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2012
[2012.03.14 20:52:57 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search
[2012.03.14 20:52:51 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search
[2012.03.14 20:52:50 | 000,000,000 | ---D | C] -- C:\Program Files\AVG Secure Search
[2012.03.14 20:52:34 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.03.14 20:47:27 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012
[2012.03.14 20:47:27 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\AVG
[2012.03.14 20:45:35 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2012.03.14 20:43:02 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012.03.14 11:00:07 | 000,594,944 | ---- | C] (OldTimer Tools) -- C:\Users\Lady Sirenety\Desktop\OTL.exe
[2012.03.13 11:33:39 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.03.13 11:33:11 | 002,322,184 | ---- | C] (ESET) -- C:\Users\***\Desktop\esetsmartinstaller_enu.exe
[2012.03.13 10:14:22 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2012.03.13 10:14:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.03.13 10:14:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.03.13 10:14:11 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.03.13 10:14:11 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.03.12 11:20:35 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Lady Sirenety\Desktop\dds.scr
[2012.03.09 10:34:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.03.08 20:19:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StreamTorrent 1.0
[2012.03.08 20:19:58 | 000,000,000 | ---D | C] -- C:\Program Files\StreamTorrent 1.0
[2012.03.08 20:19:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\StreamTorrent
[2012.03.08 11:33:38 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Hintergründe
[2012.02.29 14:58:32 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.02.26 21:16:07 | 000,000,000 | ---D | C] -- C:\Program Files\PriceGong
[2012.02.26 21:15:25 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM
[2012.02.26 21:15:25 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM
[2012.02.26 21:00:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Steam
[2012.02.25 17:43:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Ilivid Player
[2012.02.25 17:36:58 | 000,000,000 | ---D | C] -- C:\Program Files\iLivid
[2012.02.25 17:35:41 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\PackageAware
[2012.02.22 11:49:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\APN
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.14 23:12:17 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.14 22:41:43 | 000,060,928 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.14 22:31:28 | 000,342,016 | ---- | M] () -- C:\Users\***\Desktop\Threnodia.MSWMM
[2012.03.14 22:30:24 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.14 22:30:24 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.14 21:23:12 | 000,000,939 | ---- | M] () -- C:\Users\***\Desktop\AVG PC Tuneup 2011.lnk
[2012.03.14 21:05:44 | 091,761,561 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2012.03.14 20:54:03 | 000,000,862 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2012.lnk
[2012.03.14 20:35:27 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.14 20:35:27 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.14 20:35:27 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.14 20:35:26 | 000,126,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.14 20:32:26 | 000,028,599 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.03.14 20:30:51 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.14 20:30:11 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat
[2012.03.14 20:29:54 | 1877,831,680 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.14 13:50:46 | 000,031,626 | ---- | M] () -- C:\Users\***\Desktop\zartbitter.odt
[2012.03.14 11:00:08 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\Lady Sirenety\Desktop\OTL.exe
[2012.03.14 10:54:38 | 000,001,356 | ---- | M] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2012.03.13 11:33:12 | 002,322,184 | ---- | M] (ESET) -- C:\Users\***\Desktop\esetsmartinstaller_enu.exe
[2012.03.12 14:20:55 | 000,000,427 | ---- | M] () -- C:\Users\***\Desktop\gmer.zip
[2012.03.12 14:20:45 | 000,001,884 | ---- | M] () -- C:\Users\***\Desktop\attach.zip
[2012.03.12 11:43:06 | 000,302,592 | ---- | M] () -- C:\Users\***\Desktop\yl9xw2mx.exe
[2012.03.12 11:20:36 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\***\Desktop\dds.scr
[2012.03.12 11:13:38 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable
[2012.03.12 11:11:56 | 000,050,477 | ---- | M] () -- C:\Users\***\Desktop\Defogger.exe
[2012.03.12 11:01:46 | 000,028,599 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.03.08 20:19:58 | 000,000,918 | ---- | M] () -- C:\Users\***\Desktop\StreamTorrent 1.0.lnk
[2012.02.27 01:02:30 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2012.02.27 01:02:30 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2012.02.25 17:46:55 | 000,000,011 | R--- | M] () -- C:\Windows\amunres.lsl
[2012.02.25 10:21:20 | 000,000,927 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012.02.24 10:33:30 | 000,000,850 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.14 22:24:22 | 000,342,016 | ---- | C] () -- C:\Users\***\Desktop\Threnodia.MSWMM
[2012.03.14 21:23:12 | 000,000,939 | ---- | C] () -- C:\Users\***\Desktop\AVG PC Tuneup 2011.lnk
[2012.03.14 21:05:44 | 091,761,561 | ---- | C] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2012.03.14 20:54:03 | 000,000,862 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2012.lnk
[2012.03.14 20:29:54 | 1877,831,680 | -HS- | C] () -- C:\hiberfil.sys
[2012.03.14 13:50:46 | 000,031,626 | ---- | C] () -- C:\Users\***\Desktop\zartbitter.odt
[2012.03.12 14:20:55 | 000,000,427 | ---- | C] () -- C:\Users\***\Desktop\gmer.zip
[2012.03.12 14:20:45 | 000,001,884 | ---- | C] () -- C:\Users\***\Desktop\attach.zip
[2012.03.12 11:43:05 | 000,302,592 | ---- | C] () -- C:\Users\***\Desktop\yl9xw2mx.exe
[2012.03.12 11:13:38 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable
[2012.03.12 11:11:55 | 000,050,477 | ---- | C] () -- C:\Users\***\Desktop\Defogger.exe
[2012.03.08 20:19:58 | 000,000,918 | ---- | C] () -- C:\Users\***\Desktop\StreamTorrent 1.0.lnk
[2012.02.27 01:02:30 | 000,000,268 | -H-- | C] () -- C:\sqmdata00.sqm
[2012.02.27 01:02:30 | 000,000,244 | -H-- | C] () -- C:\sqmnoopt00.sqm
[2012.02.25 17:46:55 | 000,000,011 | R--- | C] () -- C:\Windows\amunres.lsl
[2012.02.24 10:33:30 | 000,000,862 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.02.24 10:33:30 | 000,000,850 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.05.25 01:24:00 | 000,000,000 | ---- | C] () -- C:\Windows\PCFriend.INI
[2011.05.25 01:23:48 | 000,000,116 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2011.04.21 12:52:23 | 000,074,240 | ---- | C] () -- C:\Windows\AKDeInstall.exe
 
========== LOP Check ==========
 
[2012.03.14 21:27:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AVG
[2012.03.14 21:03:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AVG2012
[2009.01.17 22:37:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Azureus
[2012.03.14 20:33:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox
[2011.09.01 11:50:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2011.04.26 16:50:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.08 21:44:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2008.06.14 07:26:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ Toolbar
[2008.07.19 17:56:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Softplicity
[2012.03.08 20:19:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\StreamTorrent
[2009.01.06 22:12:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TeamViewer
[2012.03.13 10:07:02 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2008.06.14 13:21:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe
[2012.03.14 21:27:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AVG
[2012.03.14 21:03:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AVG2012
[2009.01.17 22:37:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Azureus
[2011.02.11 14:41:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\CyberLink
[2011.08.21 01:23:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DivX
[2012.03.14 20:33:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox
[2011.09.01 11:50:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2011.04.26 16:50:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.08 21:44:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2008.06.14 07:26:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ Toolbar
[2008.06.12 16:05:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities
[2008.06.12 16:05:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia
[2012.03.13 10:14:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs
[2011.12.16 15:56:02 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft
[2009.01.28 15:09:03 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mozilla
[2012.03.14 20:33:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org2
[2008.07.19 17:56:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Softplicity
[2012.03.08 20:19:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\StreamTorrent
[2008.06.14 07:52:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Symantec
[2008.07.28 18:33:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\teamspeak2
[2009.01.06 22:12:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TeamViewer
[2008.07.30 15:14:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\U3
[2011.03.27 21:03:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Winamp
[2008.06.17 17:13:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2012.02.15 00:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe
[2012.02.15 00:03:44 | 000,174,752 | ---- | M] (Dropbox, Inc.) -- C:\Users\***\AppData\Roaming\Dropbox\bin\Uninstall.exe
[2011.12.16 15:56:03 | 000,000,766 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{78AB3064-5C72-4BAE-AA58-22B2EA69501E}\_2F4443E31A160A53B3A51A.exe
[2011.12.16 15:56:03 | 000,000,766 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{78AB3064-5C72-4BAE-AA58-22B2EA69501E}\_321A615469AB78C37BF107.exe
[2011.12.16 15:56:03 | 000,000,766 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{78AB3064-5C72-4BAE-AA58-22B2EA69501E}\_6FEFF9B68218417F98F549.exe
[2005.06.06 10:29:14 | 000,110,592 | ---- | M] () -- C:\Users\***\AppData\Roaming\U3\081073714170A894\cleanup.exe
[2006.04.25 16:37:22 | 002,592,768 | ---- | M] () -- C:\Users\***\AppData\Roaming\U3\081073714170A894\Launchpad.exe
 
< %SYSTEMDRIVE%\*.exe >
[2005.08.16 08:49:12 | 000,040,960 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\junction.exe
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2007.07.28 10:16:04 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_cb7c81c7\AGP440.sys
[2007.07.28 10:16:04 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20598_none_b85cfa98dae9b436\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.06.14 08:41:01 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.06.14 08:41:01 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.06.14 08:41:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: ENETHOOK.DLL  >
[2007.06.13 15:53:50 | 000,090,112 | R--- | M] (acer) MD5=B6A1D439109F7294C1BE14D5DC0C41AC -- C:\Acer\Empowering Technology\eNet\eNetHook.dll
[2007.06.13 15:53:50 | 000,090,112 | R--- | M] (acer) MD5=B6A1D439109F7294C1BE14D5DC0C41AC -- C:\Windows\System32\eNetHook.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.04.04 12:35:52 | 000,108,328 | ---- | M] (NVIDIA Corporation) MD5=4A820160BC3C85297BF33CEF08A905C2 -- C:\DRV\CHIPSET\IDE\WINVISTA\SATA_IDE\NVSTOR32.SYS
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.07.28 09:56:05 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2007.07.28 09:56:05 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2006.11.02 10:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2008.01.19 08:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2008.01.19 08:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 09:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 11:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2008.01.19 08:34:21 | 000,403,968 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\FirewallAPI.dll
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:B623B5B8
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:B203B914
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:A95A95AC
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:798A3728
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:7B212553
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:0A73A758

< End of report >
--- --- ---


Da ich jetzt wieder im normalmodus bin, hab ich mich wieder mit nem AV ausgestattet. Der hat bei den Scans nichts gefunden. Der PC is nur eeeecht lahmarschig.

cosinus 15.03.2012 22:26
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://de.intl.acer.yahoo.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = http://de.rd.yahoo.com/customize/ycomp/defaults/sp/*http://de.yahoo.com
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://global.acer.com [binary data]
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\SearchScopes\{5C108A81-1EF0-4B9D-A3B8-4763FDCA22D2}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={F05FB8D8-6EA6-4200-89D2-E592A47F1545}&mid=6a6bd21da01547d08e0cd1527e29a3da-782f070b6d0772fd2d4e4ef7e9f99257ef3ab50b&lang=de&ds=AVG&pr=fr&d=2012-03-14 20:53:09&v=10.0.0.7&sap=dsp&q={searchTerms}
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.14.1.100010
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7Bbdaca476-5135-4791-a24a-91fe6f92cee6%7D&mid=6a6bd21da01547d08e0cd1527e29a3da-782f070b6d0772fd2d4e4ef7e9f99257ef3ab50b&ds=AVG&v=10.0.0.7&lang=de&pr=fr&d=2012-03-14%2020%3A53%3A09&sap=ku&q="
[2011.06.28 12:11:14 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.02.25 10:25:29 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.02.26 21:16:07 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
[2011.04.26 16:50:15 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.06.28 12:11:05 | 000,000,000 | ---D | M] (HalloFF) -- C:\Users\***AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{bbf8fc30-5280-11db-b0de-0800200c9a66}
[2012.03.09 10:16:36 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-1.xml
[2009.05.06 09:25:00 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-10.xml
[2011.06.28 12:19:59 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-11.xml
[2012.02.23 20:52:16 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-12.xml
[2008.07.27 20:17:57 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-2.xml
[2008.10.03 06:53:21 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-3.xml
[2008.11.21 11:44:53 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-4.xml
[2009.01.06 08:55:34 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-5.xml
[2009.01.28 15:15:30 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-6.xml
[2009.01.28 17:29:08 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-7.xml
[2009.02.08 13:38:06 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-8.xml
[2009.03.16 18:23:21 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-9.xml
[2011.03.30 14:14:34 | 000,001,042 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin.xml
[2012.02.26 21:15:37 | 000,003,915 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\sweetim.xml
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
CHR - plugin: registryAccess (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\background/registryAccess.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - Extension: Avira Toolbar = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\
CHR - Extension: PriceGong = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.2_0\O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Shopping Assistant Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Programme\PriceGong\2.5.4\PriceGongIE.dll (PriceGong)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKU\S-1-5-21-203809257-3905849057-4149600105-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [Acer Tour]  File not found
O4 - HKLM..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{128d15bc-5e41-11dd-93b9-001b38cd4a29}\Shell - "" = AutoRun
O33 - MountPoints2\{128d15bc-5e41-11dd-93b9-001b38cd4a29}\Shell\AutoRun\command - "" = G:\LaunchU3.exe
O33 - MountPoints2\{44182896-d509-11df-9fe6-001b38cd4a29}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{906c9767-4d18-11dd-a2e0-ce9c950d73e8}\Shell - "" = AutoRun
O33 - MountPoints2\{906c9767-4d18-11dd-a2e0-ce9c950d73e8}\Shell\AutoRun\command - "" = F:\VMC_PBStarter.exe
O33 - MountPoints2\{906c9783-4d18-11dd-a2e0-ce9c950d73e8}\Shell - "" = AutoRun
O33 - MountPoints2\{906c9783-4d18-11dd-a2e0-ce9c950d73e8}\Shell\AutoRun\command - "" = F:\VMC_PBStarter.exe
O33 - MountPoints2\{edec6fcb-9a3c-11de-bc3d-fab406eca9fa}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\VMC_PBStarter.exe
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:B623B5B8
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:B203B914
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:A95A95AC
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:798A3728
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:7B212553
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:0A73A758
:Files
C:\Users\***\AppData\Roaming\ICQ Toolbar
C:\Program Files\PriceGong
C:\ProgramData\SweetIM
C:\Program Files\SweetIM
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hagen 16.03.2012 20:39
Löschen, sternchen, später wieder einsetzen AAAAAAAAAHHH
Ich machs mal ohne Sternchen. Kann eh keiner was damit anfangen. :-)
btw: Hab den PC aus zweiter Hand, deshalb der schwule username. Hab ihn halt nie geändert ;-)


Code:
All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\SEARCH PAGE| /E : value set successfully!
HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\SearchMigratedDefaultName| /E : value set successfully!
HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\SearchMigratedDefaultURL| /E : value set successfully!
HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Secondary Start Pages| /E : value set successfully!
HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-203809257-3905849057-4149600105-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\StartPageCache| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
C:\Programme\ICQ6Toolbar\ICQToolBar.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\ deleted successfully.
C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.
HKEY_USERS\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Internet Explorer\SearchScopes\{5C108A81-1EF0-4B9D-A3B8-4763FDCA22D2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C108A81-1EF0-4B9D-A3B8-4763FDCA22D2}\ not found.
Registry key HKEY_USERS\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_USERS\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Prefs.js: toolbar@ask.com:3.14.1.100010 removed from extensions.enabledItems
Prefs.js: "hxxp://isearch.avg.com/search?cid=%7Bbdaca476-5135-4791-a24a-91fe6f92cee6%7D&mid=6a6bd21da01547d08e0cd1527e29a3da-782f070b6d0772fd2d4e4ef7e9f99257ef3ab50b&ds=AVG&v=10.0.0.7&lang=de&pr=fr&d=2012-03-14%2020%3A53%3A09&sap=ku&q=" removed from keyword.URL
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults\preferences folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\chrome folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\components folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\tr folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\sk folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\ru folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\it folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\he folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\fr folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\es folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\en-US folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\de folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\cs folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\bg folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\components folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\skin folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale\en-US folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}\chrome folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{bbf8fc30-5280-11db-b0de-0800200c9a66}\chrome folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\mozilla\Firefox\Profiles\nuqmv2sc.default\extensions\{bbf8fc30-5280-11db-b0de-0800200c9a66} folder moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-10.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-11.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-12.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-2.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-3.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-4.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-5.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-6.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-7.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-8.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin-9.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\icqplugin.xml moved successfully.
C:\Users\lady sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\searchplugins\sweetim.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0\ deleted successfully.
C:\Program Files\DivX\DivX Web Player\npdivx32.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0\ deleted successfully.
C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\background/registryAccess.dll moved successfully.
C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll moved successfully.
C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll moved successfully.
C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\tb_ux folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\lib folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\content_script\hack folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\content_script folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\config\skin\js folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\config\skin\images folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\config\skin\css folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\config\skin folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\config\locales\en folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\config\locales folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\config folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0\background folder moved successfully.
C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanggjopenpllbdidcpbendcjhbjme\7.14.1.20932_0 folder moved successfully.
File C:\Users\lady sirenety\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.2_0\O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ not found.
File move failed. C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll scheduled to be moved on reboot.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1631550F-191D-4826-B069-D9439253D926}\ deleted successfully.
C:\Programme\PriceGong\2.5.4\PriceGongIE.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.
C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
File C:\Programme\ICQ6Toolbar\ICQToolBar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ deleted successfully.
File C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_USERS\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
File C:\Programme\ICQ6Toolbar\ICQToolBar.dll not found.
Registry value HKEY_USERS\S-1-5-21-203809257-3905849057-4149600105-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Acer Tour deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinampAgent deleted successfully.
D:\Program Files\Winamp\winampa.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{128d15bc-5e41-11dd-93b9-001b38cd4a29}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{128d15bc-5e41-11dd-93b9-001b38cd4a29}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{128d15bc-5e41-11dd-93b9-001b38cd4a29}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{128d15bc-5e41-11dd-93b9-001b38cd4a29}\ not found.
File G:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{44182896-d509-11df-9fe6-001b38cd4a29}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44182896-d509-11df-9fe6-001b38cd4a29}\ not found.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{906c9767-4d18-11dd-a2e0-ce9c950d73e8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{906c9767-4d18-11dd-a2e0-ce9c950d73e8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{906c9767-4d18-11dd-a2e0-ce9c950d73e8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{906c9767-4d18-11dd-a2e0-ce9c950d73e8}\ not found.
File F:\VMC_PBStarter.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{906c9783-4d18-11dd-a2e0-ce9c950d73e8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{906c9783-4d18-11dd-a2e0-ce9c950d73e8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{906c9783-4d18-11dd-a2e0-ce9c950d73e8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{906c9783-4d18-11dd-a2e0-ce9c950d73e8}\ not found.
File F:\VMC_PBStarter.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edec6fcb-9a3c-11de-bc3d-fab406eca9fa}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edec6fcb-9a3c-11de-bc3d-fab406eca9fa}\ not found.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
File F:\VMC_PBStarter.exe not found.
ADS C:\ProgramData\TEMP:0B4227B4 deleted successfully.
ADS C:\ProgramData\TEMP:B623B5B8 deleted successfully.
ADS C:\ProgramData\TEMP:B203B914 deleted successfully.
ADS C:\ProgramData\TEMP:A95A95AC deleted successfully.
ADS C:\ProgramData\TEMP:798A3728 deleted successfully.
ADS C:\ProgramData\TEMP:7B212553 deleted successfully.
ADS C:\ProgramData\TEMP:0A73A758 deleted successfully.
========== FILES ==========
C:\Users\lady sirenety\AppData\Roaming\ICQ Toolbar folder moved successfully.
C:\Program Files\PriceGong\2.5.4 folder moved successfully.
C:\Program Files\PriceGong folder moved successfully.
C:\ProgramData\SweetIM\Messenger\update folder moved successfully.
C:\ProgramData\SweetIM\Messenger\logs folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\packages\FailDialog folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\packages folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\contentdb folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default\400 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default\200 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default\100 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\Default folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\400\default folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\400\bar0160 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\400\bar0104 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars\400 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data\Bars folder moved successfully.
C:\ProgramData\SweetIM\Messenger\data folder moved successfully.
C:\ProgramData\SweetIM\Messenger\conf\users\621313049 folder moved successfully.
C:\ProgramData\SweetIM\Messenger\conf\users folder moved successfully.
C:\ProgramData\SweetIM\Messenger\conf folder moved successfully.
C:\ProgramData\SweetIM\Messenger folder moved successfully.
C:\ProgramData\SweetIM folder moved successfully.
C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\orange folder moved successfully.
C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\green folder moved successfully.
C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\blue folder moved successfully.
C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources folder moved successfully.
C:\Program Files\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT folder moved successfully.
C:\Program Files\SweetIM\Toolbars\Internet Explorer\conf folder moved successfully.
C:\Program Files\SweetIM\Toolbars\Internet Explorer folder moved successfully.
C:\Program Files\SweetIM\Toolbars folder moved successfully.
C:\Program Files\SweetIM\Messenger\resources\sqlite folder moved successfully.
C:\Program Files\SweetIM\Messenger\resources\images folder moved successfully.
C:\Program Files\SweetIM\Messenger\resources folder moved successfully.
C:\Program Files\SweetIM\Messenger folder moved successfully.
C:\Program Files\SweetIM folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Lady Sirenety
->Temp folder emptied: 4305395 bytes
->Temporary Internet Files folder emptied: 51297090 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 189767061 bytes
->Google Chrome cache emptied: 313462569 bytes
->Flash cache emptied: 1826 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 3285 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 29847105 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 561,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.36.3 log created on 03162012_202939

Files\Folders moved on Reboot...
File move failed. C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

cosinus 17.03.2012 14:21
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Hagen 18.03.2012 08:55
Code:
08:51:16.0347 4424        TDSS rootkit removing tool 2.7.20.0 Mar  9 2012 17:10:43
08:51:16.0581 4424        ============================================================
08:51:16.0581 4424        Current date / time: 2012/03/18 08:51:16.0581
08:51:16.0581 4424        SystemInfo:
08:51:16.0581 4424       
08:51:16.0581 4424        OS Version: 6.0.6002 ServicePack: 2.0
08:51:16.0581 4424        Product type: Workstation
08:51:16.0581 4424        ComputerName: LADYSIRENETY
08:51:16.0581 4424        UserName: Lady Sirenety
08:51:16.0581 4424        Windows directory: C:\Windows
08:51:16.0581 4424        System windows directory: C:\Windows
08:51:16.0581 4424        Processor architecture: Intel x86
08:51:16.0581 4424        Number of processors: 2
08:51:16.0581 4424        Page size: 0x1000
08:51:16.0581 4424        Boot type: Normal boot
08:51:16.0581 4424        ============================================================
08:51:19.0733 4424        Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
08:51:19.0748 4424        \Device\Harddisk0\DR0:
08:51:19.0748 4424        MBR used
08:51:19.0748 4424        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x6, StartLBA 0x1385000, BlocksNum 0x8B8C000
08:51:19.0748 4424        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x9F11000, BlocksNum 0x8B08000
08:51:19.0826 4424        Initialize success
08:51:19.0826 4424        ============================================================
08:51:31.0464 6084        ============================================================
08:51:31.0464 6084        Scan started
08:51:31.0464 6084        Mode: Manual; SigCheck; TDLFS;
08:51:31.0464 6084        ============================================================
08:51:32.0696 6084        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
08:51:32.0805 6084        ACPI - ok
08:51:32.0868 6084        adp94xx        (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
08:51:32.0993 6084        adp94xx - ok
08:51:33.0351 6084        adpahci        (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
08:51:33.0367 6084        adpahci - ok
08:51:33.0476 6084        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
08:51:33.0492 6084        adpu160m - ok
08:51:33.0523 6084        adpu320        (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
08:51:33.0539 6084        adpu320 - ok
08:51:33.0617 6084        AFD            (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
08:51:33.0695 6084        AFD - ok
08:51:33.0819 6084        agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
08:51:33.0835 6084        agp440 - ok
08:51:33.0882 6084        aic78xx        (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
08:51:33.0897 6084        aic78xx - ok
08:51:34.0038 6084        aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
08:51:34.0053 6084        aliide - ok
08:51:34.0100 6084        amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
08:51:34.0116 6084        amdagp - ok
08:51:34.0131 6084        amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
08:51:34.0147 6084        amdide - ok
08:51:34.0178 6084        AmdK7          (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
08:51:34.0350 6084        AmdK7 - ok
08:51:34.0662 6084        AmdK8          (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys
08:51:34.0787 6084        AmdK8 - ok
08:51:34.0958 6084        ApfiltrService  (db8ea68e5864adf61b73516788659e71) C:\Windows\system32\DRIVERS\Apfiltr.sys
08:51:35.0005 6084        ApfiltrService - ok
08:51:35.0067 6084        arc            (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
08:51:35.0083 6084        arc - ok
08:51:35.0192 6084        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
08:51:35.0208 6084        arcsas - ok
08:51:35.0255 6084        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
08:51:35.0317 6084        AsyncMac - ok
08:51:35.0364 6084        atapi          (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
08:51:35.0379 6084        atapi - ok
08:51:35.0535 6084        athr            (acdb46b1a467752a2f280c68c8461556) C:\Windows\system32\DRIVERS\athr.sys
08:51:35.0645 6084        athr - ok
08:51:35.0816 6084        avgntflt        (7713e4eb0276702faa08e52a6e23f2a6) C:\Windows\system32\DRIVERS\avgntflt.sys
08:51:35.0847 6084        avgntflt - ok
08:51:35.0879 6084        avipbb          (13b02b9b969dde270cd7c351203dad3c) C:\Windows\system32\DRIVERS\avipbb.sys
08:51:35.0894 6084        avipbb - ok
08:51:35.0941 6084        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys
08:51:35.0957 6084        avkmgr - ok
08:51:36.0097 6084        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
08:51:36.0159 6084        Beep - ok
08:51:36.0191 6084        blbdrive - ok
08:51:36.0237 6084        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
08:51:36.0284 6084        bowser - ok
08:51:36.0409 6084        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
08:51:36.0518 6084        BrFiltLo - ok
08:51:36.0627 6084        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
08:51:36.0659 6084        BrFiltUp - ok
08:51:36.0705 6084        Brserid        (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
08:51:36.0768 6084        Brserid - ok
08:51:36.0877 6084        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
08:51:36.0955 6084        BrSerWdm - ok
08:51:36.0986 6084        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
08:51:37.0033 6084        BrUsbMdm - ok
08:51:37.0049 6084        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
08:51:37.0127 6084        BrUsbSer - ok
08:51:37.0251 6084        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
08:51:37.0314 6084        BTHMODEM - ok
08:51:37.0361 6084        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
08:51:37.0392 6084        cdfs - ok
08:51:37.0532 6084        cdrom          (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
08:51:37.0579 6084        cdrom - ok
08:51:37.0610 6084        circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys
08:51:37.0657 6084        circlass - ok
08:51:37.0766 6084        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
08:51:37.0782 6084        CLFS - ok
08:51:37.0860 6084        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
08:51:37.0907 6084        CmBatt - ok
08:51:38.0000 6084        cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
08:51:38.0000 6084        cmdide - ok
08:51:38.0047 6084        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
08:51:38.0063 6084        Compbatt - ok
08:51:38.0109 6084        crcdisk        (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
08:51:38.0109 6084        crcdisk - ok
08:51:38.0141 6084        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
08:51:38.0203 6084        Crusoe - ok
08:51:38.0687 6084        DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
08:51:38.0749 6084        DfsC - ok
08:51:38.0874 6084        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
08:51:38.0889 6084        disk - ok
08:51:39.0014 6084        DKbFltr        (73baf270d24fe726b9cd7f80bb17a23d) C:\Windows\system32\DRIVERS\DKbFltr.sys
08:51:39.0030 6084        DKbFltr - ok
08:51:39.0092 6084        DritekPortIO    (5c918d413f5837e67a85775c9873775e) C:\PROGRA~1\LAUNCH~1\DPortIO.sys
08:51:39.0092 6084        DritekPortIO - ok
08:51:39.0264 6084        drmkaud        (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
08:51:39.0295 6084        drmkaud - ok
08:51:39.0357 6084        DXGKrnl        (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
08:51:39.0404 6084        DXGKrnl - ok
08:51:39.0545 6084        E1G60          (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
08:51:39.0607 6084        E1G60 - ok
08:51:39.0747 6084        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
08:51:39.0763 6084        Ecache - ok
08:51:39.0935 6084        elxstor        (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
08:51:39.0950 6084        elxstor - ok
08:51:39.0997 6084        enecir          (29dcaeb81dde6f154aa4d36b18ecbb1f) C:\Windows\system32\DRIVERS\enecir.sys
08:51:40.0044 6084        enecir - ok
08:51:40.0215 6084        exfat          (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
08:51:40.0247 6084        exfat - ok
08:51:40.0325 6084        fastfat        (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
08:51:40.0449 6084        fastfat - ok
08:51:40.0481 6084        fdc            (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
08:51:40.0559 6084        fdc - ok
08:51:40.0683 6084        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
08:51:40.0699 6084        FileInfo - ok
08:51:40.0730 6084        Filetrace      (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
08:51:40.0777 6084        Filetrace - ok
08:51:40.0808 6084        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
08:51:40.0871 6084        flpydisk - ok
08:51:40.0980 6084        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
08:51:40.0995 6084        FltMgr - ok
08:51:41.0058 6084        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
08:51:41.0089 6084        Fs_Rec - ok
08:51:41.0120 6084        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
08:51:41.0136 6084        gagp30kx - ok
08:51:41.0307 6084        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
08:51:41.0385 6084        HdAudAddService - ok
08:51:41.0448 6084        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
08:51:41.0510 6084        HDAudBus - ok
08:51:41.0619 6084        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
08:51:41.0666 6084        HidBth - ok
08:51:41.0713 6084        HidIr          (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys
08:51:41.0760 6084        HidIr - ok
08:51:41.0822 6084        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
08:51:41.0853 6084        HidUsb - ok
08:51:41.0963 6084        HpCISSs        (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
08:51:41.0978 6084        HpCISSs - ok
08:51:42.0056 6084        HSFHWAZL        (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
08:51:42.0087 6084        HSFHWAZL - ok
08:51:42.0134 6084        HSF_DPV        (7bc42c65b5c6281777c1a7605b253ba8) C:\Windows\system32\DRIVERS\HSX_DPV.sys
08:51:42.0228 6084        HSF_DPV - ok
08:51:42.0384 6084        HSXHWAZL        (9ebf2d102ccbb6bcdfbf1b7922f8ba2e) C:\Windows\system32\DRIVERS\HSXHWAZL.sys
08:51:42.0415 6084        HSXHWAZL - ok
08:51:42.0509 6084        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
08:51:42.0571 6084        HTTP - ok
08:51:42.0711 6084        hwdatacard      (ab7f23c6563e5cafe861b857ef330f76) C:\Windows\system32\DRIVERS\ewusbmdm.sys
08:51:42.0758 6084        hwdatacard - ok
08:51:42.0805 6084        i2omp          (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
08:51:42.0821 6084        i2omp - ok
08:51:42.0899 6084        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
08:51:42.0945 6084        i8042prt - ok
08:51:43.0039 6084        iaStorV        (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
08:51:43.0055 6084        iaStorV - ok
08:51:43.0117 6084        iirsp          (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
08:51:43.0133 6084        iirsp - ok
08:51:43.0226 6084        int15          (9d64201c9e5ac8d1f088762ba00ff3ab) C:\Acer\Empowering Technology\eRecovery\int15.sys
08:51:43.0242 6084        int15 - ok
08:51:43.0413 6084        IntcAzAudAddService (6f62bafe6150f3952f877051c65786fe) C:\Windows\system32\drivers\RTKVHDA.sys
08:51:43.0491 6084        IntcAzAudAddService - ok
08:51:43.0616 6084        intelide        (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys
08:51:43.0632 6084        intelide - ok
08:51:43.0663 6084        intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
08:51:43.0725 6084        intelppm - ok
08:51:43.0757 6084        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
08:51:43.0803 6084        IpFilterDriver - ok
08:51:43.0944 6084        IpInIp - ok
08:51:43.0975 6084        IPMIDRV        (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
08:51:44.0053 6084        IPMIDRV - ok
08:51:44.0100 6084        IPNAT          (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
08:51:44.0131 6084        IPNAT - ok
08:51:44.0256 6084        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
08:51:44.0287 6084        IRENUM - ok
08:51:44.0334 6084        isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
08:51:44.0334 6084        isapnp - ok
08:51:44.0396 6084        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
08:51:44.0412 6084        iScsiPrt - ok
08:51:44.0521 6084        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
08:51:44.0537 6084        iteatapi - ok
08:51:44.0568 6084        iteraid        (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
08:51:44.0583 6084        iteraid - ok
08:51:44.0615 6084        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
08:51:44.0630 6084        kbdclass - ok
08:51:44.0677 6084        kbdhid          (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
08:51:44.0708 6084        kbdhid - ok
08:51:44.0833 6084        KSecDD          (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys
08:51:44.0864 6084        KSecDD - ok
08:51:44.0942 6084        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
08:51:44.0958 6084        lltdio - ok
08:51:45.0020 6084        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
08:51:45.0036 6084        LSI_FC - ok
08:51:45.0129 6084        LSI_SAS        (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
08:51:45.0145 6084        LSI_SAS - ok
08:51:45.0176 6084        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
08:51:45.0192 6084        LSI_SCSI - ok
08:51:45.0223 6084        luafv          (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
08:51:45.0254 6084        luafv - ok
08:51:45.0348 6084        mdmxsdk        (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys
08:51:45.0395 6084        mdmxsdk - ok
08:51:45.0473 6084        megasas        (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
08:51:45.0488 6084        megasas - ok
08:51:45.0566 6084        Modem          (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
08:51:45.0597 6084        Modem - ok
08:51:45.0629 6084        monitor        (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
08:51:45.0675 6084        monitor - ok
08:51:45.0753 6084        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
08:51:45.0769 6084        mouclass - ok
08:51:45.0816 6084        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
08:51:45.0831 6084        mouhid - ok
08:51:45.0878 6084        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
08:51:45.0894 6084        MountMgr - ok
08:51:45.0925 6084        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
08:51:45.0925 6084        mpio - ok
08:51:46.0034 6084        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
08:51:46.0065 6084        mpsdrv - ok
08:51:46.0112 6084        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
08:51:46.0128 6084        Mraid35x - ok
08:51:46.0175 6084        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
08:51:46.0206 6084        MRxDAV - ok
08:51:46.0331 6084        mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
08:51:46.0377 6084        mrxsmb - ok
08:51:46.0440 6084        mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
08:51:46.0471 6084        mrxsmb10 - ok
08:51:46.0565 6084        mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
08:51:46.0580 6084        mrxsmb20 - ok
08:51:46.0627 6084        msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
08:51:46.0643 6084        msahci - ok
08:51:46.0705 6084        msdsm          (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
08:51:46.0705 6084        msdsm - ok
08:51:46.0752 6084        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
08:51:46.0814 6084        Msfs - ok
08:51:46.0939 6084        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
08:51:46.0939 6084        msisadrv - ok
08:51:47.0001 6084        MSKSSRV        (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
08:51:47.0048 6084        MSKSSRV - ok
08:51:47.0095 6084        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
08:51:47.0142 6084        MSPCLOCK - ok
08:51:47.0220 6084        MSPQM          (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
08:51:47.0251 6084        MSPQM - ok
08:51:47.0329 6084        MsRPC          (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
08:51:47.0345 6084        MsRPC - ok
08:51:47.0391 6084        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
08:51:47.0391 6084        mssmbios - ok
08:51:47.0516 6084        MSTEE          (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
08:51:47.0547 6084        MSTEE - ok
08:51:47.0610 6084        Mup            (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
08:51:47.0625 6084        Mup - ok
08:51:47.0703 6084        NativeWifiP    (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
08:51:47.0735 6084        NativeWifiP - ok
08:51:47.0844 6084        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
08:51:47.0875 6084        NDIS - ok
08:51:47.0969 6084        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
08:51:47.0984 6084        NdisTapi - ok
08:51:48.0031 6084        Ndisuio        (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
08:51:48.0062 6084        Ndisuio - ok
08:51:48.0156 6084        NdisWan        (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
08:51:48.0187 6084        NdisWan - ok
08:51:48.0218 6084        NDProxy        (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
08:51:48.0265 6084        NDProxy - ok
08:51:48.0312 6084        NetBIOS        (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
08:51:48.0343 6084        NetBIOS - ok
08:51:48.0452 6084        netbt          (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
08:51:48.0499 6084        netbt - ok
08:51:48.0561 6084        nfrd960        (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
08:51:48.0561 6084        nfrd960 - ok
08:51:48.0686 6084        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
08:51:48.0717 6084        Npfs - ok
08:51:48.0764 6084        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
08:51:48.0795 6084        nsiproxy - ok
08:51:48.0951 6084        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
08:51:49.0232 6084        Ntfs - ok
08:51:49.0451 6084        NTIDrvr        (7f1c1f78d709c4a54cbb46ede7e0b48d) C:\Windows\system32\DRIVERS\NTIDrvr.sys
08:51:49.0482 6084        NTIDrvr ( UnsignedFile.Multi.Generic ) - warning
08:51:49.0482 6084        NTIDrvr - detected UnsignedFile.Multi.Generic (1)
08:51:49.0560 6084        ntrigdigi      (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
08:51:49.0607 6084        ntrigdigi - ok
08:51:49.0653 6084        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
08:51:49.0685 6084        Null - ok
08:51:49.0778 6084        NVENETFD        (d668632606d1cebf0b6ec64c1df7ed6f) C:\Windows\system32\DRIVERS\nvmfdx32.sys
08:51:49.0825 6084        NVENETFD - ok
08:51:50.0168 6084        nvlddmkm        (b36c3b866b0d47e2e2856ec8fd746e39) C:\Windows\system32\DRIVERS\nvlddmkm.sys
08:51:50.0699 6084        nvlddmkm ( UnsignedFile.Multi.Generic ) - warning
08:51:50.0699 6084        nvlddmkm - detected UnsignedFile.Multi.Generic (1)
08:51:50.0823 6084        nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
08:51:50.0839 6084        nvraid - ok
08:51:50.0855 6084        nvsmu          (9aebc32f9d6e02ebee0369ab296fe7c8) C:\Windows\system32\DRIVERS\nvsmu.sys
08:51:50.0901 6084        nvsmu - ok
08:51:50.0933 6084        nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
08:51:50.0933 6084        nvstor - ok
08:51:51.0073 6084        nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
08:51:51.0089 6084        nv_agp - ok
08:51:51.0104 6084        NwlnkFlt - ok
08:51:51.0120 6084        NwlnkFwd - ok
08:51:51.0167 6084        ohci1394        (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
08:51:51.0198 6084        ohci1394 - ok
08:51:51.0229 6084        Parport        (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
08:51:51.0291 6084        Parport - ok
08:51:51.0447 6084        partmgr        (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
08:51:51.0463 6084        partmgr - ok
08:51:51.0494 6084        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
08:51:51.0557 6084        Parvdm - ok
08:51:51.0822 6084        pci            (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
08:51:51.0853 6084        pci - ok
08:51:52.0134 6084        pciide          (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys
08:51:52.0165 6084        pciide - ok
08:51:52.0446 6084        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
08:51:52.0477 6084        pcmcia - ok
08:51:52.0914 6084        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
08:51:53.0023 6084        PEAUTH - ok
08:51:53.0429 6084        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
08:51:53.0475 6084        PptpMiniport - ok
08:51:53.0569 6084        Processor      (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
08:51:53.0616 6084        Processor - ok
08:51:53.0678 6084        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
08:51:53.0709 6084        PSched - ok
08:51:53.0756 6084        PSDFilter      (e801d5cc24e1cf18fa87d24d7074b876) C:\Windows\system32\DRIVERS\psdfilter.sys
08:51:53.0772 6084        PSDFilter - ok
08:51:53.0881 6084        PSDNServ        (24b5e3429f7f0e779fc2e6e36a0a5f73) C:\Windows\system32\drivers\PSDNServ.sys
08:51:53.0897 6084        PSDNServ - ok
08:51:53.0912 6084        psdvdisk        (01cbfd08c0e8a6106bb26fcda297154e) C:\Windows\system32\drivers\psdvdisk.sys
08:51:53.0928 6084        psdvdisk - ok
08:51:54.0006 6084        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
08:51:54.0053 6084        ql2300 - ok
08:51:54.0146 6084        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
08:51:54.0162 6084        ql40xx - ok
08:51:54.0302 6084        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
08:51:54.0349 6084        QWAVEdrv - ok
08:51:54.0443 6084        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
08:51:54.0489 6084        RasAcd - ok
08:51:54.0552 6084        Rasl2tp        (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
08:51:54.0599 6084        Rasl2tp - ok
08:51:55.0035 6084        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
08:51:55.0082 6084        RasPppoe - ok
08:51:55.0347 6084        RasSstp        (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
08:51:55.0379 6084        RasSstp - ok
08:51:55.0722 6084        rdbss          (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
08:51:55.0769 6084        rdbss - ok
08:51:56.0018 6084        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
08:51:56.0065 6084        RDPCDD - ok
08:51:56.0299 6084        rdpdr          (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
08:51:56.0361 6084        rdpdr - ok
08:51:56.0486 6084        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
08:51:56.0533 6084        RDPENCDD - ok
08:51:56.0642 6084        RDPWD          (79c6df8477250f5c54f7c5ae1d6b814e) C:\Windows\system32\drivers\RDPWD.sys
08:51:56.0705 6084        RDPWD - ok
08:51:56.0985 6084        rimmptsk        (355aac141b214bef1dbc1483afd9bd50) C:\Windows\system32\DRIVERS\rimmptsk.sys
08:51:57.0048 6084        rimmptsk - ok
08:51:57.0251 6084        rimsptsk        (a4216c71dd4f60b26418ccfd99cd0815) C:\Windows\system32\DRIVERS\rimsptsk.sys
08:51:57.0360 6084        rimsptsk - ok
08:51:57.0672 6084        rismxdp        (d231b577024aa324af13a42f3a807d10) C:\Windows\system32\DRIVERS\rixdptsk.sys
08:51:57.0719 6084        rismxdp - ok
08:51:57.0999 6084        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
08:51:58.0062 6084        rspndr - ok
08:51:58.0389 6084        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
08:51:58.0421 6084        sbp2port - ok
08:51:58.0639 6084        sdbus          (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys
08:51:58.0670 6084        sdbus - ok
08:51:58.0826 6084        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
08:51:58.0904 6084        secdrv - ok
08:51:58.0951 6084        Serenum        (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
08:51:58.0998 6084        Serenum - ok
08:51:59.0169 6084        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
08:51:59.0216 6084        Serial - ok
08:51:59.0419 6084        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
08:51:59.0435 6084        sermouse - ok
08:51:59.0825 6084        sffdisk        (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys
08:51:59.0856 6084        sffdisk - ok
08:51:59.0887 6084        sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
08:51:59.0949 6084        sffp_mmc - ok
08:52:00.0121 6084        sffp_sd        (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys
08:52:00.0168 6084        sffp_sd - ok
08:52:00.0449 6084        sfloppy        (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
08:52:00.0527 6084        sfloppy - ok
08:52:00.0807 6084        sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
08:52:00.0839 6084        sisagp - ok
08:52:01.0119 6084        SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
08:52:01.0151 6084        SiSRaid2 - ok
08:52:01.0369 6084        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
08:52:01.0400 6084        SiSRaid4 - ok
08:52:01.0619 6084        Smb            (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
08:52:01.0665 6084        Smb - ok
08:52:01.0977 6084        spldr          (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
08:52:01.0993 6084        spldr - ok
08:52:02.0321 6084        srv            (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
08:52:02.0383 6084        srv - ok
08:52:02.0742 6084        srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
08:52:02.0804 6084        srv2 - ok
08:52:02.0960 6084        srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
08:52:02.0991 6084        srvnet - ok
08:52:03.0038 6084        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
08:52:03.0054 6084        ssmdrv - ok
08:52:03.0381 6084        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
08:52:03.0397 6084        swenum - ok
08:52:03.0709 6084        Symc8xx        (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
08:52:03.0725 6084        Symc8xx - ok
08:52:03.0959 6084        SymIMMP - ok
08:52:04.0349 6084        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
08:52:04.0380 6084        Sym_hi - ok
08:52:04.0754 6084        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
08:52:04.0770 6084        Sym_u3 - ok
08:52:05.0238 6084        Tcpip          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys
08:52:05.0300 6084        Tcpip - ok
08:52:05.0550 6084        Tcpip6          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys
08:52:05.0597 6084        Tcpip6 - ok
08:52:05.0799 6084        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
08:52:05.0846 6084        tcpipreg - ok
08:52:06.0018 6084        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
08:52:06.0080 6084        TDPIPE - ok
08:52:06.0127 6084        TDTCP          (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
08:52:06.0174 6084        TDTCP - ok
08:52:06.0330 6084        tdx            (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
08:52:06.0392 6084        tdx - ok
08:52:06.0455 6084        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
08:52:06.0470 6084        TermDD - ok
08:52:06.0751 6084        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
08:52:06.0798 6084        tssecsrv - ok
08:52:07.0063 6084        tunmp          (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
08:52:07.0125 6084        tunmp - ok
08:52:07.0313 6084        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
08:52:07.0359 6084        tunnel - ok
08:52:07.0391 6084        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
08:52:07.0422 6084        uagp35 - ok
08:52:07.0765 6084        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
08:52:07.0796 6084        udfs - ok
08:52:08.0046 6084        UIUSys - ok
08:52:08.0217 6084        uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
08:52:08.0249 6084        uliagpkx - ok
08:52:08.0576 6084        uliahci        (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
08:52:08.0607 6084        uliahci - ok
08:52:08.0841 6084        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
08:52:08.0857 6084        UlSata - ok
08:52:08.0935 6084        ulsata2        (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
08:52:08.0951 6084        ulsata2 - ok
08:52:09.0013 6084        umbus          (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
08:52:09.0060 6084        umbus - ok
08:52:09.0138 6084        usbccgp        (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
08:52:09.0169 6084        usbccgp - ok
08:52:09.0387 6084        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
08:52:09.0465 6084        usbcir - ok
08:52:09.0762 6084        usbehci        (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
08:52:09.0809 6084        usbehci - ok
08:52:10.0214 6084        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
08:52:10.0355 6084        usbhub - ok
08:52:10.0791 6084        usbohci        (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys
08:52:10.0838 6084        usbohci - ok
08:52:10.0947 6084        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
08:52:10.0994 6084        usbprint - ok
08:52:11.0057 6084        usbscan        (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
08:52:11.0088 6084        usbscan - ok
08:52:11.0337 6084        USBSTOR        (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
08:52:11.0384 6084        USBSTOR - ok
08:52:11.0509 6084        usbuhci        (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
08:52:11.0571 6084        usbuhci - ok
08:52:11.0649 6084        vga            (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
08:52:11.0727 6084        vga - ok
08:52:11.0946 6084        VgaSave        (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
08:52:12.0008 6084        VgaSave - ok
08:52:12.0289 6084        viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
08:52:12.0320 6084        viaagp - ok
08:52:12.0585 6084        ViaC7          (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
08:52:12.0648 6084        ViaC7 - ok
08:52:12.0851 6084        viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
08:52:12.0866 6084        viaide - ok
08:52:12.0897 6084        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
08:52:12.0913 6084        volmgr - ok
08:52:12.0991 6084        volmgrx        (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
08:52:13.0007 6084        volmgrx - ok
08:52:13.0131 6084        volsnap        (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
08:52:13.0163 6084        volsnap - ok
08:52:13.0194 6084        vsmraid        (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
08:52:13.0209 6084        vsmraid - ok
08:52:13.0272 6084        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
08:52:13.0334 6084        WacomPen - ok
08:52:13.0428 6084        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
08:52:13.0459 6084        Wanarp - ok
08:52:13.0459 6084        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
08:52:13.0490 6084        Wanarpv6 - ok
08:52:13.0553 6084        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
08:52:13.0568 6084        Wd - ok
08:52:13.0599 6084        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
08:52:13.0631 6084        Wdf01000 - ok
08:52:13.0771 6084        winachsf        (5a77ac34a0ffb70ce8b35b524fede9ba) C:\Windows\system32\DRIVERS\HSX_CNXT.sys
08:52:13.0833 6084        winachsf - ok
08:52:13.0911 6084        WmiAcpi        (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
08:52:13.0943 6084        WmiAcpi - ok
08:52:14.0099 6084        ws2ifsl        (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
08:52:14.0130 6084        ws2ifsl - ok
08:52:14.0177 6084        WSVD            (2584df81cc9f7e7bd3545691106f8cae) C:\Windows\system32\drivers\WSVD.sys
08:52:14.0192 6084        WSVD - ok
08:52:14.0270 6084        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
08:52:14.0317 6084        WUDFRd - ok
08:52:14.0411 6084        XAudio          (88af537264f2b818da15479ceeaf5d7c) C:\Windows\system32\DRIVERS\xaudio.sys
08:52:14.0426 6084        XAudio - ok
08:52:14.0520 6084        {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} (8098180b3f6c430a4e60333bc036f936) C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl
08:52:14.0520 6084        {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} - ok
08:52:14.0582 6084        MBR (0x1B8)    (a863475757cc50891aa8458c415e4b25) \Device\Harddisk0\DR0
08:52:18.0108 6084        \Device\Harddisk0\DR0 - ok
08:52:18.0139 6084        Boot (0x1200)  (4f391be68cde7d98c830baf4c779ece3) \Device\Harddisk0\DR0\Partition0
08:52:18.0139 6084        \Device\Harddisk0\DR0\Partition0 - ok
08:52:18.0155 6084        Boot (0x1200)  (9b298b6e2b9644492c292feb68439d92) \Device\Harddisk0\DR0\Partition1
08:52:18.0155 6084        \Device\Harddisk0\DR0\Partition1 - ok
08:52:18.0155 6084        ============================================================
08:52:18.0155 6084        Scan finished
08:52:18.0155 6084        ============================================================
08:52:18.0186 4260        Detected object count: 2
08:52:18.0186 4260        Actual detected object count: 2
08:52:29.0449 4260        NTIDrvr ( UnsignedFile.Multi.Generic ) - skipped by user
08:52:29.0449 4260        NTIDrvr ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:52:29.0465 4260        nvlddmkm ( UnsignedFile.Multi.Generic ) - skipped by user
08:52:29.0465 4260        nvlddmkm ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:53:29.0041 5916        Deinitialize success

cosinus 19.03.2012 16:10
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hagen 21.03.2012 14:45
Combofix Logfile:
Code:
ComboFix 12-03-20.02 - Lady Sirenety 21.03.2012  14:10:03.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.1790.1103 [GMT 1:00]
ausgeführt von:: c:\users\Lady Sirenety\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Public\Azureus_2.5.0.4_Win32.setup.exe
c:\users\Public\SetupCloneCD5313.exe
c:\windows\system32\drivers\etc\hosts.ics
.
Infizierte Kopie von c:\windows\system32\userinit.exe wurde gefunden und desinfiziert
Kopie von - c:\windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe wurde wiederhergestellt
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_usnjsvc
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-02-21 bis 2012-03-21  ))))))))))))))))))))))))))))))
.
.
2012-03-21 10:43 . 2012-03-21 10:43        --------        d-----w-        c:\users\Lady Sirenety\AppData\Local\AskToolbar
2012-03-20 10:21 . 2012-02-08 06:03        6552120        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{22CE8932-618C-4F16-8821-7A57BA21ACC8}\mpengine.dll
2012-03-19 21:23 . 2012-03-19 21:23        592824        ----a-w-        c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-19 21:23 . 2012-03-19 21:23        44472        ----a-w-        c:\program files\Mozilla Firefox\mozglue.dll
2012-03-18 07:31 . 2012-02-14 15:45        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll
2012-03-18 07:31 . 2012-02-13 14:12        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll
2012-03-18 07:31 . 2012-02-13 13:44        1068544        ----a-w-        c:\windows\system32\DWrite.dll
2012-03-18 07:31 . 2012-02-14 15:45        160768        ----a-w-        c:\windows\system32\d3d10_1.dll
2012-03-18 07:31 . 2012-02-13 13:47        683008        ----a-w-        c:\windows\system32\d2d1.dll
2012-03-16 19:57 . 2012-03-16 19:57        --------        d-----w-        c:\users\Lady Sirenety\AppData\Roaming\Avira
2012-03-16 19:51 . 2012-03-16 19:51        --------        d-----w-        c:\program files\Ask.com
2012-03-16 19:50 . 2012-01-31 07:56        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-03-16 19:50 . 2012-01-31 07:56        137416        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-03-16 19:50 . 2011-09-16 15:08        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2012-03-16 19:50 . 2012-03-16 19:50        --------        d-----w-        c:\program files\Avira
2012-03-16 19:29 . 2012-03-16 19:29        --------        d-----w-        C:\_OTL
2012-03-16 18:43 . 2012-03-16 18:43        --------        d-----w-        c:\program files\Windows Portable Devices
2012-03-16 09:48 . 2009-09-10 02:00        92672        ----a-w-        c:\windows\system32\UIAnimation.dll
2012-03-16 09:48 . 2009-09-10 02:01        3023360        ----a-w-        c:\windows\system32\UIRibbon.dll
2012-03-16 09:48 . 2009-09-10 02:00        1164800        ----a-w-        c:\windows\system32\UIRibbonRes.dll
2012-03-16 09:47 . 2009-10-01 01:02        31232        ----a-w-        c:\windows\system32\BthMtpContextHandler.dll
2012-03-16 09:47 . 2009-10-01 01:01        60928        ----a-w-        c:\windows\system32\PortableDeviceConnectApi.dll
2012-03-16 09:47 . 2009-10-01 01:02        334848        ----a-w-        c:\windows\system32\PortableDeviceApi.dll
2012-03-16 09:47 . 2009-10-01 01:01        160256        ----a-w-        c:\windows\system32\PortableDeviceTypes.dll
2012-03-16 09:47 . 2009-10-01 01:01        196608        ----a-w-        c:\windows\system32\PortableDeviceWMDRM.dll
2012-03-16 09:47 . 2009-10-01 01:01        100864        ----a-w-        c:\windows\system32\PortableDeviceClassExtension.dll
2012-03-16 09:47 . 2009-10-01 01:01        227840        ----a-w-        c:\windows\system32\drivers\UMDF\WpdFs.dll
2012-03-16 09:36 . 2012-03-16 09:36        979456        ----a-w-        c:\windows\system32\MFH264Dec.dll
2012-03-16 09:35 . 2012-03-16 09:35        252928        ----a-w-        c:\windows\system32\dxdiag.exe
2012-03-16 09:35 . 2012-03-16 09:35        195584        ----a-w-        c:\windows\system32\dxdiagn.dll
2012-03-16 09:35 . 2012-03-16 09:35        519680        ----a-w-        c:\windows\system32\d3d11.dll
2012-03-16 09:35 . 2012-03-16 09:35        321024        ----a-w-        c:\windows\system32\PhotoMetadataHandler.dll
2012-03-16 09:35 . 2012-03-16 09:35        189440        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll
2012-03-16 09:35 . 2012-03-16 09:35        974848        ----a-w-        c:\windows\system32\WindowsCodecs.dll
2012-03-16 07:50 . 2011-10-14 16:03        189952        ----a-w-        c:\windows\system32\winmm.dll
2012-03-16 07:50 . 2011-10-14 16:00        23552        ----a-w-        c:\windows\system32\mciseq.dll
2012-03-16 07:50 . 2011-07-29 16:01        293376        ----a-w-        c:\windows\system32\psisdecd.dll
2012-03-16 07:50 . 2011-07-29 16:01        217088        ----a-w-        c:\windows\system32\psisrndr.ax
2012-03-16 07:50 . 2011-07-29 16:00        57856        ----a-w-        c:\windows\system32\MSDvbNP.ax
2012-03-16 07:50 . 2011-07-29 16:00        69632        ----a-w-        c:\windows\system32\Mpeg2Data.ax
2012-03-16 07:50 . 2011-10-27 08:01        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-03-16 07:50 . 2011-10-27 08:01        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-03-16 07:50 . 2012-02-02 15:16        2044416        ----a-w-        c:\windows\system32\win32k.sys
2012-03-16 07:50 . 2011-11-18 20:23        1205064        ----a-w-        c:\windows\system32\ntdll.dll
2012-03-16 07:50 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll
2012-03-16 07:48 . 2011-08-25 16:15        555520        ----a-w-        c:\windows\system32\UIAutomationCore.dll
2012-03-16 07:48 . 2011-08-25 16:14        563712        ----a-w-        c:\windows\system32\oleaut32.dll
2012-03-16 07:48 . 2011-08-25 16:14        238080        ----a-w-        c:\windows\system32\oleacc.dll
2012-03-16 07:48 . 2011-08-25 13:31        4096        ----a-w-        c:\windows\system32\oleaccrc.dll
2012-03-16 07:48 . 2011-09-30 15:57        707584        ----a-w-        c:\program files\Common Files\System\wab32.dll
2012-03-16 07:47 . 2012-01-31 10:59        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
2012-03-16 07:35 . 2010-05-04 19:13        231424        ----a-w-        c:\windows\system32\msshsq.dll
2012-03-16 07:33 . 2012-01-09 15:54        613376        ----a-w-        c:\windows\system32\rdpencom.dll
2012-03-16 07:33 . 2012-01-09 13:58        180736        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-03-15 11:42 . 2012-03-15 11:44        --------        d-----w-        c:\windows\system32\ca-ES
2012-03-15 11:42 . 2012-03-15 11:44        --------        d-----w-        c:\windows\system32\eu-ES
2012-03-15 11:42 . 2012-03-15 11:44        --------        d-----w-        c:\windows\system32\vi-VN
2012-03-15 09:57 . 2012-03-15 09:57        --------        d-----w-        c:\windows\system32\EventProviders
2012-03-14 20:24 . 2012-03-14 20:27        --------        d-----w-        c:\users\Lady Sirenety\AppData\Roaming\AVG
2012-03-14 19:52 . 2012-03-14 19:52        --------        d--h--w-        c:\programdata\Common Files
2012-03-14 19:47 . 2012-03-16 19:32        --------        d-----w-        c:\programdata\AVG2012
2012-03-14 19:45 . 2012-03-14 20:23        --------        d-----w-        c:\program files\AVG
2012-03-14 19:43 . 2012-03-16 19:16        --------        d-----w-        c:\programdata\MFAData
2012-03-14 19:41 . 2010-02-18 13:30        200704        ----a-w-        c:\windows\system32\iphlpsvc.dll
2012-03-14 19:41 . 2010-02-18 11:28        25088        ----a-w-        c:\windows\system32\drivers\tunnel.sys
2012-03-13 10:33 . 2012-03-13 10:33        --------        d-----w-        c:\program files\ESET
2012-03-13 09:14 . 2012-03-13 09:14        --------        d-----w-        c:\users\Lady Sirenety\AppData\Roaming\Malwarebytes
2012-03-13 09:14 . 2012-03-13 09:14        --------        d-----w-        c:\programdata\Malwarebytes
2012-03-13 09:14 . 2012-03-13 09:14        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-03-13 09:14 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-09 09:34 . 2012-03-16 19:50        --------        d-----w-        c:\programdata\Avira
2012-03-08 19:19 . 2012-03-08 19:19        --------        d-----w-        c:\users\Lady Sirenety\AppData\Roaming\StreamTorrent
2012-03-08 19:19 . 2012-03-08 19:19        --------        d-----w-        c:\program files\StreamTorrent 1.0
2012-02-29 13:58 . 2012-02-29 13:58        --------        d-----w-        c:\programdata\McAfee
2012-02-26 20:00 . 2012-02-26 20:02        --------        d-----w-        c:\program files\Common Files\Steam
2012-02-25 16:43 . 2012-02-25 16:43        --------        d-----w-        c:\users\Lady Sirenety\AppData\Local\Ilivid Player
2012-02-25 16:36 . 2012-02-25 16:47        --------        d-----w-        c:\program files\iLivid
2012-02-25 16:35 . 2012-02-25 16:35        --------        d-----w-        c:\users\Lady Sirenety\AppData\Local\PackageAware
2012-02-24 09:33 . 2012-03-19 21:23        97208        ----a-w-        c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-02-24 09:33 . 2012-03-19 21:23        16824        ----a-w-        c:\program files\Mozilla Firefox\plugin-container.exe
2012-02-24 09:33 . 2012-02-16 10:41        626688        ----a-w-        c:\program files\Mozilla Firefox\msvcr80.dll
2012-02-24 09:33 . 2012-02-16 10:41        548864        ----a-w-        c:\program files\Mozilla Firefox\msvcp80.dll
2012-02-24 09:33 . 2012-03-19 21:23        101304        ----a-w-        c:\program files\Mozilla Firefox\libEGL.dll
2012-02-24 09:33 . 2012-03-19 21:23        818104        ----a-w-        c:\program files\Mozilla Firefox\mozsqlite3.dll
2012-02-24 09:33 . 2012-03-19 21:23        441272        ----a-w-        c:\program files\Mozilla Firefox\libGLESv2.dll
2012-02-24 09:33 . 2012-03-19 21:23        1969080        ----a-w-        c:\program files\Mozilla Firefox\mozjs.dll
2012-02-24 09:33 . 2012-03-19 21:23        16312        ----a-w-        c:\program files\Mozilla Firefox\mozalloc.dll
2012-02-24 09:33 . 2012-02-16 10:42        2106216        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2012-02-24 09:33 . 2012-02-16 10:42        1998168        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_43.dll
2012-02-24 09:33 . 2012-02-16 10:41        479232        ----a-w-        c:\program files\Mozilla Firefox\msvcm80.dll
2012-02-22 10:49 . 2012-02-22 10:49        --------        d-----w-        c:\users\Lady Sirenety\AppData\Local\APN
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-16 09:36 . 2012-03-16 09:36        135680        ----a-w-        c:\windows\system32\XpsRasterService.dll
2012-03-16 09:36 . 2012-03-16 09:36        1554432        ----a-w-        c:\windows\system32\xpsservices.dll
2012-03-16 09:35 . 2012-03-16 09:35        4096        ----a-w-        c:\windows\system32\drivers\de-DE\dxgkrnl.sys.mui
2012-03-16 09:35 . 2012-03-16 09:35        369664        ----a-w-        c:\windows\system32\WMPhoto.dll
2012-02-29 13:58 . 2011-12-02 12:05        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-23 08:18 . 2011-04-28 09:51        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-03-19 21:23 . 2012-02-24 09:33        97208        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-01-04 19:20        1514152        ----a-w-        c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-04 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-04 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\users\Lady Sirenety\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\users\Lady Sirenety\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12        94208        ----a-w-        c:\users\Lady Sirenety\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 4669440]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
"eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 1286144]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2007-08-15 772616]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 206952]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-06 159744]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Skytel"="Skytel.exe" [2007-06-15 1826816]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-03 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-03 92704]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-01-04 1391272]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-01-31 258512]
.
c:\users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Lady Sirenety\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
2007-05-22 13:49        151552        ----a-w-        c:\acer\AcerTour\Reminder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2007-10-18 09:34        5724184        ----a-w-        c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-03-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-28 10:30]
.
2012-03-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-28 10:30]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uSearchMigratedDefaultURL =
mStart Page =
mLocal Page =
uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/su/*hxxp://de.yahoo.com
IE: Free YouTube Download - c:\users\Lady Sirenety\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Web-Suche - c:\program files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 10.0.0.1
FF - ProfilePath - c:\users\Lady Sirenety\AppData\Roaming\Mozilla\Firefox\Profiles\nuqmv2sc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
HKLM-Run-SweetIM - c:\program files\SweetIM\Messenger\SweetIM.exe
SafeBoot-Wdf01000.sys
MSConfigStartUp-ICQ - d:\program files\ICQ6\ICQ.exe
AddRemove-PriceGong - c:\program files\PriceGong\uninst.exe
.
.
.
**************************************************************************
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien:
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(3988)
c:\users\Lady Sirenety\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\acer\ALaunch\ALaunchSvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\acer\Empowering Technology\eNet\eNet Service.exe
c:\program files\ICQ6Toolbar\ICQ Service.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
c:\acer\Empowering Technology\ePower\ePowerSvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE
c:\windows\system32\conime.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-03-21  14:31:44 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-03-21 13:30
.
Vor Suchlauf: 12 Verzeichnis(se), 13.944.213.504 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 13.774.012.416 Bytes frei
.
- - End Of File - - 4E77799760EABA1B690FBABDEF441F2E
--- --- ---

cosinus 21.03.2012 16:15
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Hagen 22.03.2012 13:42
Mit GMER wars tatsächlich Essig. Hier OSAM:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 13:31:16 on 22.03.2012

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 11.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"Dritek General Port I/O" (DritekPortIO) - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\DPortIO.sys
"fwlyraoc" (fwlyraoc) - ? - C:\Users\LADYSI~1\AppData\Local\Temp\fwlyraoc.sys  (Hidden registry entry, rootkit activity | File not found)
"int15" (int15) - ? - C:\Acer\Empowering Technology\eRecovery\int15.sys  (File found, but it contains no detailed information)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"nvlddmkm" (nvlddmkm) - "NVIDIA Corporation" - C:\Windows\System32\DRIVERS\nvlddmkm.sys
"PSDFilter" (PSDFilter) - "HiTRUST" - C:\Windows\System32\DRIVERS\psdfilter.sys
"PSDNSERVER" (PSDNServ) - "HiTRUST" - C:\Windows\System32\drivers\PSDNServ.sys
"psdvdisk" (psdvdisk) - "HiTRUST" - C:\Windows\System32\drivers\psdvdisk.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"SymIMMP" (SymIMMP) - ? - C:\Windows\System32\DRIVERS\SymIM.sys  (File not found)
"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys
"WSVD" (WSVD) - "Wasay" - C:\Windows\system32\drivers\WSVD.sys
"{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}" ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) - "Cyberlink Corp." - C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll
{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0} "EPM-PO Shell Extensions" - ? - epm-po.dll  (File not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -  (File not found | COM-object registry key not found)
{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} "Meine freigegebenen Ordner" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\fsshext.8.5.1302.1018.dll
{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{280CFDE1-1354-4431-92F3-03073BA593FB} "TotalConverter Context Menu Shell Extension" - ? - D:\Program Files\TotalAudioConverter\axTotalConverter.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - D:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Avira SearchFree Toolbar plus Web Protection" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_11.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
{D0C0F75C-683A-4390-A791-1ACFD5599AB8} "Oberon Flash Game Host" - ? - C:\Windows\Downloaded Program Files\OberonGameHost.dll  (File not found) / hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"ICQ7.5" - "ICQ, LLC." - C:\Program Files\ICQ7.5\ICQ.exe
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Acer eDataSecurity Management" - "HiTRUST" - C:\Windows\system32\eDStoolbar.dll
<binary data> "Avira SearchFree Toolbar plus Web Protection" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{D4027C7F-154A-4066-A1AD-4243D8127440} "Avira SearchFree Toolbar plus Web Protection" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Dropbox.lnk" - "Dropbox, Inc." - C:\Users\Lady Sirenety\AppData\Roaming\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)
"OpenOffice.org 2.4.lnk" - ? - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Acer Tour Reminder" - "Acer Inc." - C:\Acer\AcerTour\Reminder.exe
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"ApnUpdater" - "Ask" - "C:\Program Files\Ask.com\Updater\Updater.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"eAudio" - "CyberLink" - "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
"eDataSecurity Loader" - "HiTRUST" - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
"LManager" - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\LManager.exe
"NeroFilterCheck" - "Ahead Software Gmbh" - C:\Windows\system32\NeroCheck.exe
"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter" - "NVIDIA Corporation" - RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
"PlayMovie" - "CyberLink Corp." - "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Java\jre6\bin\jusched.exe"
"WarReg_PopUp" - "Acer Inc." - C:\Acer\WR_PopUp\WarReg_PopUp.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"EPSON Stylus Photo RX420 Series 2KMonitor5E" - "SEIKO EPSON CORPORATION" - C:\Windows\system32\E_FLM9CE.DLL

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"ALaunch Service" (ALaunchService) - ? - C:\Acer\ALaunch\ALaunchSvc.exe
"Avira Browser Schutz" (AntiVirWebService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
"eDSService.exe" (eDataSecurity Service) - "HiTRSUT" - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
"eLock Service" (eLockService) - "Acer Inc." - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
"eNet Service" (eNet Service) - "Acer Inc." - C:\Acer\Empowering Technology\eNet\eNet Service.exe
"ePower Service" (WMIService) - "acer" - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
"eRecovery Service" (eRecoveryService) - "Acer Inc." - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
"eSettings Service" (eSettingsService) - ? - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"ICQ Service" (ICQ Service) - ? - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"MobilityService" (MobilityService) - ? - C:\Acer\Mobility Center\MobilityService.exe  (File found, but it contains no detailed information)
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - "Swearware" - C:\Users\LADYSI~1\Desktop\dds.scr

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"AVSDA" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avsda.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Und das aswMBR Log

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-03-22 13:32:35
-----------------------------
13:32:35.209    OS Version: Windows 6.0.6002 Service Pack 2
13:32:35.209    Number of processors: 2 586 0x6802
13:32:35.209    ComputerName: LADYSIRENETY  UserName:
13:32:36.332    Initialize success
13:32:44.638    AVAST engine download error: 0
13:32:56.791    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
13:32:56.791    Disk 0 Vendor: TOSHIBA_MK1646GSX LB113J Size: 152627MB BusType: 3
13:32:56.978    Disk 0 MBR read successfully
13:32:56.978    Disk 0 MBR scan
13:32:56.978    Disk 0 unknown MBR code
13:32:57.071    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        9993 MB offset 63
13:32:57.103    Disk 0 Partition 2 80 (A) 06        FAT16 NTFS        71448 MB offset 20467712
13:32:57.134    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        71184 MB offset 166793216
13:32:57.352    Disk 0 scanning sectors +312578048
13:32:57.805    Disk 0 scanning C:\Windows\system32\drivers
13:33:28.942    Service scanning
13:33:51.157    Modules scanning
13:34:05.056    Disk 0 trace - called modules:
13:34:05.618    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
13:34:05.618    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8515b100]
13:34:05.618    3 CLASSPNP.SYS[877c48b3] -> nt!IofCallDriver -> [0x84a3d918]
13:34:05.633    5 acpi.sys[8260e6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84a20820]
13:34:05.633    Scan finished successfully
13:34:45.944    Disk 0 MBR has been saved successfully to "C:\Users\Lady Sirenety\Desktop\MBR.dat"
13:34:45.944    The log file has been saved successfully to "C:\Users\Lady Sirenety\Desktop\aswMBR.txt"

cosinus 22.03.2012 15:26
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

Hagen 27.03.2012 10:34
Sorry für die lange Abwesenheit. Hatte private Verpflichtungen. Ich war mir nicht ganz sicher, was du genau wolltest, also habe ich nach dem Fix Create a log gedrückt, neu gestartet und dann wieder gescannt. Hier beide Logs in chronologischer Abfolge

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-03-27 11:08:31
-----------------------------
11:08:31.678    OS Version: Windows 6.0.6002 Service Pack 2
11:08:31.678    Number of processors: 2 586 0x6802
11:08:31.678    ComputerName: LADYSIRENETY  UserName:
11:08:53.097    Initialize success
11:09:15.831    Verifying
11:09:25.877    Disk 0 Windows 600 MBR fixed successfully
11:13:14.418    Verifying
11:13:24.464    Disk 0 Windows 600 MBR fixed successfully
11:13:54.369    Disk 0 MBR has been saved successfully to "C:\Users\Lady Sirenety\Desktop\MBR.dat"
11:13:54.369    The log file has been saved successfully to "C:\Users\Lady Sirenety\Desktop\aswMBR.txt"
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-03-27 11:22:10
-----------------------------
11:22:10.646    OS Version: Windows 6.0.6002 Service Pack 2
11:22:10.646    Number of processors: 2 586 0x6802
11:22:10.646    ComputerName: LADYSIRENETY  UserName:
11:22:31.597    Initialize success
11:22:42.165    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
11:22:42.165    Disk 0 Vendor: TOSHIBA_MK1646GSX LB113J Size: 152627MB BusType: 3
11:22:42.181    Disk 0 MBR read successfully
11:22:42.181    Disk 0 MBR scan
11:22:42.197    Disk 0 Windows VISTA default MBR code
11:22:42.197    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        9993 MB offset 63
11:22:42.212    Disk 0 Partition 2 80 (A) 06        FAT16 NTFS        71448 MB offset 20467712
11:22:42.228    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        71184 MB offset 166793216
11:22:42.243    Disk 0 scanning sectors +312578048
11:22:42.306    Disk 0 scanning C:\Windows\system32\drivers
11:22:51.510    Service scanning
11:23:16.626    Modules scanning
11:23:26.064    Disk 0 trace - called modules:
11:23:26.079    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
11:23:26.079    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x852c9ac8]
11:23:26.095    3 CLASSPNP.SYS[877bd8b3] -> nt!IofCallDriver -> [0x84a3ef08]
11:23:26.095    5 acpi.sys[826146bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84a41840]
11:23:26.111    Scan finished successfully
11:27:35.679    Disk 0 MBR has been saved successfully to "C:\Users\Lady Sirenety\Desktop\MBR.dat"
11:27:35.679    The log file has been saved successfully to "C:\Users\Lady Sirenety\Desktop\aswMBRscanlog.txt"

cosinus 27.03.2012 12:27
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Hagen 30.03.2012 15:46
alter..............:nono:ich hab grad beschlossen meinen Laptop in Zukunft passwort zu schützen und auf die Frage meiner lieben Mitbewohner "Kann ich mal deinen Laptop benutzen während du auf der Arbeit bist? Meiner spinnt irgendwie" Mit "NEEEEEEIIIIIIIIIIIN!!!!!!" zu antworten. Die meisten Seiten/Cookies kannte ich nicht mal. Hier war grad ein Donnerwetter sondersgleichen. Guck dir den zweiten Log an und du weißt wieso

Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.30.02

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Lady Sirenety :: LADYSIRENETY [Administrator]

30.03.2012 12:03:18
mbam-log-2012-03-30 (12-03-18).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 312326
Laufzeit: 1 Stunde(n), 51 Minute(n), 40 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 03/30/2012 at 04:07 PM

Application Version : 5.0.1146

Core Rules Database Version : 8402
Trace Rules Database Version: 6214

Scan type      : Complete Scan
Total Scan Time : 02:05:38

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Administrator

Memory items scanned      : 815
Memory threats detected  : 0
Registry items scanned    : 33273
Registry threats detected : 0
File items scanned        : 223974
File threats detected    : 735

Adware.Tracking Cookie
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\lady_sirenety@ad2.adfarm1.adition[1].txt [ /ad2.adfarm1.adition ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\lady_sirenety@ad3.adfarm1.adition[1].txt [ /ad3.adfarm1.adition ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\lady_sirenety@ad4.adfarm1.adition[1].txt [ /ad4.adfarm1.adition ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\lady_sirenety@adform[1].txt [ /adform ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\lady_sirenety@content.yieldmanager[1].txt [ /content.yieldmanager ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\lady_sirenety@content.yieldmanager[3].txt [ /content.yieldmanager ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\lady_sirenety@doubleclick[2].txt [ /doubleclick ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\lady_sirenety@imrworldwide[2].txt [ /imrworldwide ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\lady_sirenety@invitemedia[1].txt [ /invitemedia ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\lady_sirenety@sevenoneintermedia.112.2o7[1].txt [ /sevenoneintermedia.112.2o7 ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\lady_sirenety@track.adform[2].txt [ /track.adform ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\KQ4ERVBH.txt [ /zanox.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\HZ8NSMS6.txt [ /revsci.net ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\NV3ZOA3A.txt [ /smartadserver.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\526RKEL2.txt [ /fl01.ct2.comclick.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\YJ91RHE8.txt [ /dyntracker.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\SL2DYUW9.txt [ /mediaplex.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\2W0VN5FE.txt [ /serving-sys.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\22P6Z1HK.txt [ /traffictrack.de ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\515T1QTK.txt [ /adfarm1.adition.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\ECVDUKV7.txt [ /atdmt.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\L0EOD6V3.txt [ /tradedoubler.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\1O53EXU3.txt [ /apmebf.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\4VNVY1JZ.txt [ /ad.yieldmanager.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\UM3Y61M5.txt [ /webmasterplan.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\0586J3MU.txt [ /ads.creative-serving.com ]
        C:\Users\Lady Sirenety\AppData\Roaming\Microsoft\Windows\Cookies\V44CIKHC.txt [ /bs.serving-sys.com ]
        C:\USERS\LADY SIRENETY\Cookies\lady_sirenety@ad2.adfarm1.adition[1].txt [ Cookie:lady sirenety@ad2.adfarm1.adition.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\lady_sirenety@track.adform[2].txt [ Cookie:lady sirenety@track.adform.net/ ]
        C:\USERS\LADY SIRENETY\Cookies\KQ4ERVBH.txt [ Cookie:lady sirenety@zanox.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\lady_sirenety@doubleclick[2].txt [ Cookie:lady sirenety@doubleclick.net/ ]
        C:\USERS\LADY SIRENETY\Cookies\lady_sirenety@ad4.adfarm1.adition[1].txt [ Cookie:lady sirenety@ad4.adfarm1.adition.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\NV3ZOA3A.txt [ Cookie:lady sirenety@smartadserver.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\526RKEL2.txt [ Cookie:lady sirenety@fl01.ct2.comclick.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\YJ91RHE8.txt [ Cookie:lady sirenety@dyntracker.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\SL2DYUW9.txt [ Cookie:lady sirenety@mediaplex.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\lady_sirenety@ad3.adfarm1.adition[1].txt [ Cookie:lady sirenety@ad3.adfarm1.adition.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\lady_sirenety@sevenoneintermedia.112.2o7[1].txt [ Cookie:lady sirenety@sevenoneintermedia.112.2o7.net/ ]
        C:\USERS\LADY SIRENETY\Cookies\2W0VN5FE.txt [ Cookie:lady sirenety@serving-sys.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\22P6Z1HK.txt [ Cookie:lady sirenety@traffictrack.de/ ]
        C:\USERS\LADY SIRENETY\Cookies\515T1QTK.txt [ Cookie:lady sirenety@adfarm1.adition.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\lady_sirenety@imrworldwide[2].txt [ Cookie:lady sirenety@imrworldwide.com/cgi-bin ]
        C:\USERS\LADY SIRENETY\Cookies\lady_sirenety@content.yieldmanager[1].txt [ Cookie:lady sirenety@content.yieldmanager.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\L0EOD6V3.txt [ Cookie:lady sirenety@tradedoubler.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\lady_sirenety@invitemedia[1].txt [ Cookie:lady sirenety@invitemedia.com/ ]
        C:\USERS\LADY SIRENETY\Cookies\4VNVY1JZ.txt [ Cookie:lady sirenety@ad.yieldmanager.com/ ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .microsoftinternetexplorer.112.2o7.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .doubleclick.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .traffictrack.de [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .c.gigcount.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .imrworldwide.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .imrworldwide.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .statcounter.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adserver.gesichterparty.de [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad3.adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .rambler.ru [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .rambler.ru [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .yadro.ru [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .yadro.ru [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        studivz.adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .apmebf.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .mediaplex.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ads.pointroll.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .pointroll.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .pointroll.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ads.pointroll.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ads.pointroll.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ads.pointroll.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ads.pointroll.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ads.pointroll.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ads.pointroll.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .112.2o7.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        flagcounter.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        eas4.emediate.eu [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .247realmedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .server.cpmstar.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ru4.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .apmebf.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adbrite.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .specificclick.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adviva.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.dyntracker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adxvalue.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .bs.serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .media6degrees.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .lucidmedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .advertising.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        eas.apm.emediate.eu [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        track.adform.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .media6degrees.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .media6degrees.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ru4.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.youporn.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.youporn.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        rts.pgmediaserve.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        rts.pgmediaserve.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        rts.pgmediaserve.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .de.partypoker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .youporn.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .youporn.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .youporn.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .advertising.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .at.atwola.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .advertising.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .advertising.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        eas.apm.emediate.eu [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        eas.apm.emediate.eu [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .fastclick.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zanox-affiliate.de [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.zanox-affiliate.de [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.dyntracker.de [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        eas.apm.emediate.eu [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        track.adform.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adform.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .longporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .longporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .longporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.longporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.longporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.longporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .freepornsubmits.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .freepornsubmits.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .freepornsubmits.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .freepornsubmits.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.pornrabbit.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.longporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        boomporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        boomporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        boomporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        boomporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.porn2012.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.porn2012.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.porn2012.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.porn2012.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        streampornvideo.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        streampornvideo.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ero-advertising.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ads.trafficjunky.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .sexad.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ads.crakmedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adbrite.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .unitymedia.de [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .unitymedia.de [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .technoratimedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .technoratimedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad1.adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .advertising.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .advertising.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradetracker.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad4.adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.active-tracking.de [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.active-tracking.de [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.active-tracking.de [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad2.adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .yieldmanager.net [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .mediaplex.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .micklemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zedo.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zedo.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zedo.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zedo.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zedo.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .accounts.google.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .accounts.google.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        accounts.google.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        accounts.google.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .server.cpmstar.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .micklemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .micklemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .micklemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adlegend.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adlegend.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zanox.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.zanox.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .server.cpmstar.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .server.cpmstar.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .server.cpmstar.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .syndication.traffichaus.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .syndication.traffichaus.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .syndication.traffichaus.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .girlsteachsex.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ads2.zeusclicks.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .purpleporno.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .purpleporno.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .purpleporno.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.bustyteenstgp.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.bustyteenstgp.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adxpansion.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .exoclick.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .officecunts.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .officecunts.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .officecunts.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .uniformcunts.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .uniformcunts.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .uniformcunts.com [ C:\USERS\LADY SIRENETY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        data-ero-advertising.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\LQMBR8Y9 ]
        delivery.ibanner.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\LQMBR8Y9 ]
        files.youporn.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\LQMBR8Y9 ]
        .atdmt.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        fidelity.rotator.hadj7.adjuggler.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        fidelity.rotator.hadj7.adjuggler.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        fidelity.rotator.hadj7.adjuggler.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        tracking.mlsat02.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .247realmedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adxpose.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .yieldmanager.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .rambler.ru [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .technoratimedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .technoratimedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .sexlist.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        counter8.sextracker.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .sextracker.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .banners.fuckbookhookups.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .banners.fuckbookhookups.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .banners.fuckbookhookups.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .banners.fuckbookhookups.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .banners.fuckbookhookups.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .banners.fuckbookhookups.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .exoclick.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.netdebit-counter.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .stats.ilivid.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        topmedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        topmedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .harrenmedianetwork.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        topmedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .topmedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .topmedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .topmedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        e2.emediate.se [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.usenext.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adinterax.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adinterax.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tradetracker.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.solocpm.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .guj.122.2o7.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        s08.flagcounter.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        audit.median.hu [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        banners.victor.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.dyntracker.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        banners.victor.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        banners.victor.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        banners.victor.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        banners.victor.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .pro-market.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .pro-market.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .dyntracker.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.usenext.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.usenext.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        tracking.hostgator.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adlegend.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adlegend.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        banners.victor.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .banners.victor.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .rambler.ru [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        adserver2.clipkit.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.tldadserv.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .counter.sexsuche.tv [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        counter2.sexmoney.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        sales.liveperson.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.pregnantandfucked.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.pregnantandfucked.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.pregnantandfucked.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.pregnantandfucked.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.pregnantandfucked.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.pregnantandfucked.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.pregnantandfucked.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.pregnantandfucked.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.allofteens.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.allofteens.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.allofteens.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.allofteens.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .pornpros.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .pornpros.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .pornpros.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .crocoporn.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .crocoporn.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .crocoporn.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .crocoporn.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .allofteens.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .allofteens.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .allofteens.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.allofteens.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .hellporno.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .hellporno.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .hellporno.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .hellporno.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        galleries.adult-empire.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.allofteens.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        galleries2.adult-empire.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.allofteens.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.allofteens.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .exoclick.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        lpa.trackfox2.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .a.trackfox2.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .a.trackfox2.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        e2.emediate.se [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .c.gigcount.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.dyntracker.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .mobildiscounter.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.adserver01.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .avgtechnologies.112.2o7.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        a.visualrevenue.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.youngpornvideos.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .youngpornvideos.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .youngpornvideos.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .youngpornvideos.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .freepornstv.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .freepornstv.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .zoosextv.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        zoosextv.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .sexxxyteentube.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        sexxxyteentube.net [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .maturetubeporn.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .maturetubeporn.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .maturetubeporn.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .porn.sc [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .porn.sc [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .porn.sc [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .porn.sc [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .witchsextube.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .gfporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .gfporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .gfporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .gfporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .sushiporntube.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .trafficholder.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .allofadult.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .allofadult.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .allofadult.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        stats.mmpg.de [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\LADY SIRENETY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NUQMV2SC.DEFAULT\COOKIES.SQLITE ]

Trojan.Agent/Gen-Malintent
        D:\PROGRAM FILES\WINRAR\DEFAULT.SFX

cosinus 30.03.2012 15:52
Ja solche Seiten treiben den ein oder anderen schonmal gern die Schamesröte ins Gesicht http://cosgan.de/images/midi/konfus/c050.gif :D

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Hagen 12.04.2012 10:45
Sorry, mein e-mail programm hat mich nicht informiert, dass es eine Antwort gab. System läuft wieder rund.

Danke für den Tipp mit den Cookies. Werds so machen wie du, mit zwei versch. Browsern

cosinus 12.04.2012 15:07
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:57 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131