Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojan Banker (https://www.trojaner-board.de/115604-trojan-banker.html)

lena-laura 22.05.2012 19:52
Trojan Banker
 
Ja, ich werde bald zum Dauergast....habe mir bzw mein Laptop schon wieder etwas eingefangen...
hier nun das malware log

Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.22.02

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
lena-laura :: PC [Administrator]

22.05.2012 16:06:19
mbam-log-2012-05-22 (16-06-19).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 368172
Laufzeit: 3 Stunde(n), 39 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCR\CLSID\{F99BD4F5-D402-4c21-A8BC-510830B6BE37} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F99BD4F5-D402-4C21-A8BC-510830B6BE37} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0

cosinus 23.05.2012 11:16
Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

lena-laura 23.05.2012 19:57
hallo arne,

habe sie dir angehängt.

lieben gruß

lena-laura

cosinus 23.05.2012 20:40
Führ bitte auch ESET aus, danach sehen wir weiter:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


lena-laura 24.05.2012 00:50
hilfeeeeee! das ganze system ist eben zusammengestürzt....irgendwas mit der hardware...frag mich aber nicht was....ich weiß es ja nicht.
bin dann über f7 und da stand noch nicht einmal abgesichterter modus ect...weiter unten dann eine erweiterung mit f8...bin da rauf und dann auf systemwiederherstellung.
nun sind meine kompletten dokumente weg ;-((((((((
und ich hab keine ahnung was hier grad passiert.
den scan konnte ich auch nicht mehr fortführen, da absturz.
was soll ich denn jetzt tun?
nochmal den scan starten?
und besteht die möglichkeit meine dokumente wiederherzustellen???????:confused:

p.s. sämtliche kalendereinträge sind ebenfalls verschwunden und das hatte ich vor 2 tagen schon einmal...

und alle bilder....oh mein gott.....:eek:

cosinus 24.05.2012 21:07
Zitat:
....irgendwas mit der hardware...frag mich aber nicht was....ich weiß es ja nicht.
Achso und ich soll das jetzt wissen weil ich auch auf deinen Monitor schauen konnte? :D

Zitat:
und besteht die möglichkeit meine dokumente wiederherzustellen???????
Du postest vage Infos und ich soll konkrete Aussagen machen? :confused:
Ich sachmal so, in den meisten Fällen kann man an die Daten wieder ran. Aber was ist wenn nicht?
Probier dein Glück => Notfall-Live-System: Datenrettung, Webzugang, etc. - Forum - CHIP Online

Zitat:
und alle bilder....oh mein gott.....:eek:
Naja, dann weißt du ja warum man jetzt in Zukunft immer regelmäßig backups macht und sich nicht erst dann drum kümmert wenn man ein Problem hat :pfeiff:

lena-laura 24.05.2012 22:32
Nee kannst du natürlich nicht wissen, aber du hast definitiv mehr Ahnung als ich.
Also, als ich gestern den eset Scan durchführen wollte, brach der mittendrin ab, weil ich aufgefordert wurde Installation.exe zu installieren. Hab ich aber nicht gemacht, weil ich nichts installiere, wenn die Virenprogramme deaktiviert sind. Macht Sinn oder?
dann gingen bestimmt 20 Pop up Fenster auf, nachdem ich auf nein geklickt habe und Installation.exe ging auch nichtzu schließen...dann brach alles zusammen...und er fuhr runter...ich wieder hoch und dann war da irgendwie kaum noch was auf dem Desktop....dann stürzte das System wieder ab und dann kam das was ich dir bereits geschrieben habe.
Ich hab dann eine systemwiederherstellung gestartet..und trotzdem gingen sämtliche Dokumente verloren.
Nun lass ich denn Scan grad seit bestimmt 3 Std durchlaufen und bin grad bei 50 Prozent...mal sehen ob er diesmal durchläuft.
Sollte das klappen, dann kann ich weiter fortfahren wie von dir beschrieben und dann Versuch ich das mal mit dem link den du mir eben geschickt hast.
So!
Hoffe es ist jetzt etwas transparenter.
Du müsst wissen, dass ich wirklich so gut wie kaum eine Ahnung davon habe. Ich weiß nur, dass ich seit Monaten immer wieder mit Viren zu kämpfen habe und ich auch keine Ahnung habe warum wieso und weshalb. Verstehst? ;)

Meinte install.exe

Ich nochmal ;-) also der Scan läuft jetzt seit fast 6 Std und von an der Prozentzahl ändert sich auch nichts...ist das normal, dass das soooooo lange dauert?

so jetzt aber nach gefühlten 100 stunden das log...


Code:
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=fdd479e945f09e42a96266792f8712a5
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-05-24 11:55:19
# local_time=2012-05-25 01:55:19 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 166557 166557 0 0
# compatibility_mode=5893 16776574 66 85 8982303 89506314 0 0
# compatibility_mode=8192 67108863 100 0 72462 72462 0 0
# scanned=139824
# found=8
# cleaned=0
# scan_time=28597
C:\lena-laura-PC\Backup Set 2010-02-23 142257\Backup Files 2010-02-28 204508\Backup files 1.zip        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I
C:\lena-laura-PC\Backup Set 2010-03-28 200615\Backup Files 2010-03-28 200615\Backup files 1.zip        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I
C:\Users\lena-laura\AppData\Local\temp\YiCSLt7OPLyYwZ.exe.tmp        a variant of Win32/Kryptik.AFZM trojan (unable to clean)        00000000000000000000000000000000        I
D:\pc\Backup Set 2012-04-08 214151\Backup Files 2012-04-08 214151\Backup files 1.zip        Win32/Toggle application (unable to clean)        00000000000000000000000000000000        I
D:\pc\Backup Set 2012-04-08 214151\Backup Files 2012-04-08 214151\Backup files 2.zip        a variant of Win32/SoftonicDownloader.D application (unable to clean)        00000000000000000000000000000000        I
D:\pc\Backup Set 2012-04-08 214151\Backup Files 2012-05-06 232737\Backup files 15.zip        a variant of Win32/Spy.Banker.XSL trojan (unable to clean)        00000000000000000000000000000000        I
D:\pc\Backup Set 2012-04-08 214151\Backup Files 2012-05-06 232737\Backup files 27.zip        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I
D:\pc\Backup Set 2012-04-08 214151\Backup Files 2012-05-06 232737\Backup files 30.zip        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I

cosinus 25.05.2012 10:50
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

lena-laura 25.05.2012 15:00
so...hier das otl log.

Code:
OTL logfile created on: 25.05.2012 15:04:09 - Run 7
OTL by OldTimer - Version 3.2.39.2    Folder = C:\Users\lena-laura\Downloads
 Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,02 Gb Available Physical Memory | 51,21% Memory free
3,98 Gb Paging File | 2,96 Gb Available in Paging File | 74,32% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 80,00 Gb Total Space | 44,77 Gb Free Space | 55,97% Space Free | Partition Type: NTFS
Drive D: | 59,03 Gb Total Space | 5,20 Gb Free Space | 8,81% Space Free | Partition Type: NTFS
 
Computer Name: PC | User Name: lena-laura | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\HitmanPro\hmpsched.exe (SurfRight B.V.)
PRC - C:\Program Files\FILSHtray\FILSHtray.exe (FILSH Media GmbH)
PRC - C:\Users\lena-laura\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\Freecorder\FLVSrvc.exe (Applian Technologies, Inc.)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\EeePC\HotkeyService\HotkeyService.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files\EeePC\SHE\SuperHybridEngine.exe (ASUSTeK Computer Inc.)
PRC - C:\Windows\System32\AsusService.exe ()
PRC - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (NMIndexingService) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe File not found
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (HitmanProScheduler) -- C:\Program Files\HitmanPro\hmpsched.exe (SurfRight B.V.)
SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Fabs) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (WAS) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (W3SVC) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (AppHostSvc) -- C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (AsusService) -- C:\Windows\System32\AsusService.exe ()
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (iprip) -- C:\Windows\System32\iprip.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (USBModem) -- system32\DRIVERS\lgusbmodem.sys File not found
DRV - (UsbDiag) -- system32\DRIVERS\lgusbdiag.sys File not found
DRV - (usbbus) -- system32\DRIVERS\lgusbbus.sys File not found
DRV - (LGVMODEM) -- system32\DRIVERS\lgvmodem.sys File not found
DRV - (lgbusenum) -- system32\DRIVERS\lgbtbus.sys File not found
DRV - (LgBttPort) -- system32\DRIVERS\lgbtport.sys File not found
DRV - (hwusbdev) -- system32\DRIVERS\ewusbdev.sys File not found
DRV - (hwdatacard) -- system32\DRIVERS\ewusbmdm.sys File not found
DRV - (huawei_enumerator) -- system32\DRIVERS\ew_jubusenum.sys File not found
DRV - (ewusbnet) -- system32\DRIVERS\ewusbnet.sys File not found
DRV - (ew_hwusbdev) -- system32\DRIVERS\ew_hwusbdev.sys File not found
DRV - (catchme) -- C:\Users\LENA-L~1\AppData\Local\Temp\catchme.sys File not found
DRV - (btwrchid) -- C:\windows\system32\DRIVERS\btwrchid.sys File not found
DRV - (btwl2cap) -- system32\DRIVERS\btwl2cap.sys File not found
DRV - (btwavdt) -- C:\windows\system32\DRIVERS\btwavdt.sys File not found
DRV - (btwaudio) -- system32\drivers\btwaudio.sys File not found
DRV - (ANDModem) -- system32\DRIVERS\lgandmodem.sys File not found
DRV - (AndGps) -- system32\DRIVERS\lgandgps.sys File not found
DRV - (AndDiag) -- system32\DRIVERS\lganddiag.sys File not found
DRV - (Andbus) -- system32\DRIVERS\lgandbus.sys File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (USB28xxBGA) -- C:\Windows\System32\drivers\emBDA.sys (eMPIA Technology, Inc.)
DRV - (USB28xxOEM) -- C:\Windows\System32\drivers\emOEM.sys (eMPIA Technology, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20) -- C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.)
DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( )
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{6AE1C493-DB3D-410C-8219-6ACFC715776A}: "URL" = hxxp://suche.t-online.de/fast-cgi/tsc?q={searchTerms}&sr=searchbar
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=15362
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 87 01 1B 1A FE F0 CC 01  [binary data]
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=gppc&s={searchTerms}&f=4
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=10588
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes\{14B776FE-D9AF-47B7-91DA-DBE53DD988A7}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=MGX&o=15359&src=kw&q={searchTerms}&locale=&apn_ptnrs=JQ&apn_dtid=YYYYYYYYDE&apn_uid=883CCEB2-1BF6-44CD-9A25-52180C7E4A7D&apn_sauid=167E6059-24CA-4311-BEC8-5F909B5B5C72
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SUNC_de
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\lena-laura\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\lena-laura\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\lena-laura\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.06.17 20:24:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.18 17:22:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.11 02:31:05 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\lena-laura\AppData\Roaming\11012
 
[2011.05.12 19:36:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\lena-laura\AppData\Roaming\mozilla\Extensions
[2012.05.24 02:29:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] (WOT) -- C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] (Softonic Toolbar) -- C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\ffxtlbra@softonic.com
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] (MAGIX Toolbar) -- C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\toolbar@ask.com
[2011.05.17 13:12:44 | 000,002,333 | -H-- | M] () -- C:\Users\lena-laura\AppData\Roaming\Mozilla\Firefox\Profiles\ztgpl636.default\searchplugins\askcom.xml
[2012.04.14 00:26:33 | 000,002,112 | -H-- | M] () -- C:\Users\lena-laura\AppData\Roaming\Mozilla\Firefox\Profiles\ztgpl636.default\searchplugins\wot-safe-search.xml
[2011.11.10 02:17:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012.04.24 16:55:25 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) -- C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
() (No name found) -- C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\EXTENSIONS\DIVXWEBPLAYER@DIVX.COM.XPI
[2012.03.18 17:22:47 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.01.23 12:50:38 | 000,170,080 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2012.02.12 17:09:48 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.04.23 16:07:10 | 000,002,047 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2012.02.12 17:09:48 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Yahoo! Deutschland (Enabled)
CHR - default_search_provider: search_url = hxxp://de.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}
CHR - default_search_provider: suggest_url = hxxp://de-sayt.ff.search.yahoo.com/gossip-de-sayt?output=fxjson&command={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\lena-laura\AppData\Local\Google\Chrome\Application\18.0.1025.151\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\lena-laura\AppData\Local\Google\Chrome\Application\18.0.1025.151\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\lena-laura\AppData\Local\Google\Chrome\Application\18.0.1025.151\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\lena-laura\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\lena-laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\npSkypeChromePlugin.dll
CHR - plugin: PDF-XChange Viewer (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Java(TM) Platform SE 7 U2 (Enabled) = C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\lena-laura\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\lena-laura\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - Extension: AT_Porsche = C:\Users\lena-laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkclphmapdcppbmekmbkcjfanpmoidpg\3_1\
CHR - Extension: Skype Click to Call = C:\Users\lena-laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\lena-laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\
 
O1 HOSTS File: ([2012.02.07 18:04:15 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (MAGIX Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (MAGIX Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Freecorder FLV Service] C:\Program Files\Freecorder\FLVSrvc.exe (Applian Technologies, Inc.)
O4 - HKLM..\Run: [HotKeyMon] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [HotkeyService] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [SuperHybridEngine] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [SynAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated)
O4 - Startup: C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{10D8D06D-13E7-46A5-AEC4-38C5609E3260}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{18A4EB30-28E1-4E04-8664-4351C9AD8B76}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) -  File not found
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: avgnt - hkey= - key= - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
 
SafeBootMin: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PEVSystemStart - Service
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: procexp90.Sys - Driver
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: hitmanpro36 - Reg Error: Value error.
SafeBootNet: hitmanpro36.sys - Reg Error: Value error.
SafeBootNet: HitmanPro36Crusader - Reg Error: Value error.
SafeBootNet: HitmanPro36CrusaderBoot - Reg Error: Value error.
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PEVSystemStart - Service
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: procexp90.Sys - Driver
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.24 20:25:48 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{336DC155-6B85-4C38-B551-88D3C6D14AC2}
[2012.05.24 20:25:35 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{0C810983-28DC-4C83-ADD4-8319B9FADA66}
[2012.05.24 20:22:38 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{78CF8D8D-C189-4419-8C64-95E84E346392}
[2012.05.24 20:22:24 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{CA823855-852E-410F-90A9-078D6BA3A373}
[2012.05.24 01:11:20 | 000,000,000 | -H-D | C] -- C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data Recovery
[2012.05.23 21:51:01 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.05.22 20:57:03 | 000,000,000 | -H-D | C] -- C:\Users\lena-laura\AppData\Local\{A8B57478-BBDD-4BEA-8B3F-F85B4504BB20}
[2012.05.22 20:56:46 | 000,000,000 | -H-D | C] -- C:\Users\lena-laura\AppData\Local\{93256030-C81E-4140-AF54-0F4DD77F22F3}
[2012.05.21 02:04:09 | 000,000,000 | -H-D | C] -- C:\Users\lena-laura\AppData\Local\Spotify
[2012.05.21 02:03:39 | 000,000,000 | -H-D | C] -- C:\Users\lena-laura\AppData\Roaming\Spotify
[2012.05.17 15:11:38 | 000,000,000 | -H-D | C] -- C:\Users\lena-laura\AppData\Local\{A97E52D0-D17D-43AC-AEE2-B9FC7E0F9B41}
[2012.05.17 15:11:24 | 000,000,000 | -H-D | C] -- C:\Users\lena-laura\AppData\Local\{26177FF5-8D7A-4573-A273-E3C19331B269}
[2012.05.13 11:40:01 | 000,000,000 | -H-D | C] -- C:\Users\lena-laura\AppData\Roaming\Avira
[2012.05.13 03:43:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.05.13 03:42:57 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\ssmdrv.sys
[2012.05.13 03:42:54 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys
[2012.05.13 03:42:54 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avgntflt.sys
[2012.05.13 03:42:54 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avkmgr.sys
[2012.05.13 03:42:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.05.13 03:42:46 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2012.05.03 19:11:21 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\Documents\MAGIX
[2012.05.03 18:59:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FILSHtray
[2012.05.03 18:59:58 | 000,000,000 | ---D | C] -- C:\Program Files\FILSHtray
[2012.05.03 18:45:15 | 000,000,000 | -H-D | C] -- C:\Users\lena-laura\Documents\MAGIX_MusicEditor
[2012.05.03 18:38:51 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\MAGIX_Music_Maker_MX_Production_Suite_Download-Version
[2012.05.03 18:37:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
[2012.05.03 18:37:36 | 000,000,000 | ---D | C] -- C:\Program Files\MAGIX
[2012.05.03 18:36:55 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2012.05.03 18:35:58 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX
[2012.05.03 18:35:51 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MAGIX Services
[2012.05.03 18:25:09 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\Documents\MAGIX Downloads
[2012.05.03 18:25:07 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\MAGIX
[2012.04.27 01:10:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\E-Cam
[1 C:\Users\lena-laura\AppData\Roaming\*.tmp files -> C:\Users\lena-laura\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.25 15:13:06 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012.05.25 14:22:00 | 000,001,140 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3837843822-382491344-1778226907-1000UA.job
[2012.05.25 14:09:43 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.05.25 13:29:48 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.05.25 13:29:48 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.05.25 13:21:52 | 000,065,536 | ---- | M] () -- C:\windows\System32\Ikeext.etl
[2012.05.24 01:11:23 | 000,000,168 | ---- | M] () -- C:\ProgramData\-9uGVGPZdMB9nVGr
[2012.05.24 01:11:23 | 000,000,000 | ---- | M] () -- C:\ProgramData\-9uGVGPZdMB9nVG
[2012.05.24 01:11:17 | 000,000,256 | ---- | M] () -- C:\ProgramData\9uGVGPZdMB9nVG
[2012.05.24 00:48:23 | 000,010,183 | -H-- | M] () -- C:\Users\lena-laura\Documents\wiso.pdf
[2012.05.23 20:31:43 | 000,642,260 | -H-- | M] () -- C:\Users\lena-laura\Documents\gg.pdf
[2012.05.21 22:50:02 | 000,015,863 | -H-- | M] () -- C:\Users\lena-laura\Documents\tarot 21.5.odt
[2012.05.21 04:03:45 | 000,014,034 | -H-- | M] () -- C:\Users\lena-laura\Documents\wunschgeschichten.odt
[2012.05.21 04:03:23 | 001,643,401 | -H-- | M] () -- C:\Users\lena-laura\Documents\vita rali.odt
[2012.05.21 02:39:18 | 000,903,058 | -H-- | M] () -- C:\Users\lena-laura\Documents\vita rali 4.pdf
[2012.05.21 01:52:05 | 000,018,525 | -H-- | M] () -- C:\Users\lena-laura\Documents\fontane.odt
[2012.05.21 01:51:53 | 000,022,208 | -H-- | M] () -- C:\Users\lena-laura\Documents\neuneu.odt
[2012.05.20 23:28:46 | 000,903,526 | -H-- | M] () -- C:\Users\lena-laura\Documents\vita rali 3.pdf
[2012.05.20 23:23:00 | 000,903,876 | -H-- | M] () -- C:\Users\lena-laura\Documents\vita rali neu 3.pdf
[2012.05.20 22:56:10 | 000,903,402 | -H-- | M] () -- C:\Users\lena-laura\Documents\vita rali.pdf
[2012.05.20 03:49:56 | 000,015,397 | -H-- | M] () -- C:\Users\lena-laura\Documents\06 12.odt
[2012.05.20 03:49:39 | 000,035,382 | -H-- | M] () -- C:\Users\lena-laura\Documents\06 12.pdf
[2012.05.20 03:22:00 | 000,001,088 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3837843822-382491344-1778226907-1000Core.job
[2012.05.15 17:41:17 | 000,037,555 | -H-- | M] () -- C:\Users\lena-laura\Documents\05 12.pdf
[2012.05.15 17:23:05 | 000,014,283 | -H-- | M] () -- C:\Users\lena-laura\Documents\aa fahrtkosten.odt
[2012.05.15 17:22:46 | 000,033,198 | -H-- | M] () -- C:\Users\lena-laura\Documents\AA Fahrtkosten.pdf
[2012.05.15 17:13:04 | 000,033,103 | -H-- | M] () -- C:\Users\lena-laura\Documents\AA Umzug.pdf
[2012.05.15 15:32:56 | 000,015,444 | -H-- | M] () -- C:\Users\lena-laura\Documents\03 2011.odt
[2012.05.15 15:32:47 | 000,036,646 | -H-- | M] () -- C:\Users\lena-laura\Documents\04 12.pdf
[2012.05.15 15:24:36 | 000,016,047 | -H-- | M] () -- C:\Users\lena-laura\Documents\03 12.odt
[2012.05.15 15:22:35 | 000,037,462 | -H-- | M] () -- C:\Users\lena-laura\Documents\03 12.pdf
[2012.05.14 16:19:54 | 000,016,764 | -H-- | M] () -- C:\Users\lena-laura\Documents\aldonza dt.odt
[2012.05.14 02:03:52 | 000,009,858 | -H-- | M] () -- C:\Users\lena-laura\Documents\wohnung.odt
[2012.05.13 03:43:10 | 000,001,900 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012.05.13 03:40:54 | 000,511,800 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012.05.13 03:29:14 | 000,746,988 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012.05.13 03:29:14 | 000,691,754 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012.05.13 03:29:14 | 000,163,682 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012.05.13 03:29:14 | 000,133,856 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012.05.11 02:07:04 | 000,012,059 | -H-- | M] () -- C:\Users\lena-laura\Documents\setlist.odt
[2012.05.08 03:52:46 | 000,014,156 | -H-- | M] () -- C:\Users\lena-laura\Documents\diary may.odt
[2012.05.07 14:14:13 | 000,037,735 | -H-- | M] () -- C:\Users\lena-laura\Documents\02 12.pdf
[2012.05.04 03:00:32 | 000,028,025 | -H-- | M] () -- C:\Users\lena-laura\Documents\buch.odt
[2012.05.03 19:00:01 | 000,000,885 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FILSHtray.lnk
[2012.05.03 18:44:39 | 000,001,105 | ---- | M] () -- C:\Users\Public\Desktop\MAGIX Music Maker MX Production Suite Download-Version.lnk
[2012.05.03 03:56:28 | 000,012,166 | -H-- | M] () -- C:\Users\lena-laura\Documents\3.5.odt
[2012.05.01 00:49:21 | 000,018,212 | -H-- | M] () -- C:\Users\lena-laura\Documents\ksk.odt
[2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys
[2012.04.27 01:10:53 | 000,001,735 | ---- | M] () -- C:\Users\Public\Desktop\E-Cam.lnk
[2012.04.26 02:37:32 | 000,013,776 | -H-- | M] () -- C:\Users\lena-laura\Documents\mv kudamm.odt
[2012.04.26 02:37:11 | 000,018,467 | -H-- | M] () -- C:\Users\lena-laura\Documents\affirmationne.odt
[1 C:\Users\lena-laura\AppData\Roaming\*.tmp files -> C:\Users\lena-laura\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.05.24 01:11:23 | 000,000,168 | ---- | C] () -- C:\ProgramData\-9uGVGPZdMB9nVGr
[2012.05.24 01:11:23 | 000,000,000 | ---- | C] () -- C:\ProgramData\-9uGVGPZdMB9nVG
[2012.05.24 01:11:14 | 000,000,256 | ---- | C] () -- C:\ProgramData\9uGVGPZdMB9nVG
[2012.05.24 00:48:23 | 000,010,183 | -H-- | C] () -- C:\Users\lena-laura\Documents\wiso.pdf
[2012.05.23 20:31:42 | 000,642,260 | -H-- | C] () -- C:\Users\lena-laura\Documents\gg.pdf
[2012.05.21 22:50:00 | 000,015,863 | -H-- | C] () -- C:\Users\lena-laura\Documents\tarot 21.5.odt
[2012.05.21 04:03:42 | 000,014,034 | -H-- | C] () -- C:\Users\lena-laura\Documents\wunschgeschichten.odt
[2012.05.21 02:39:18 | 000,903,058 | -H-- | C] () -- C:\Users\lena-laura\Documents\vita rali 4.pdf
[2012.05.21 01:52:03 | 000,018,525 | -H-- | C] () -- C:\Users\lena-laura\Documents\fontane.odt
[2012.05.20 23:28:36 | 000,903,526 | -H-- | C] () -- C:\Users\lena-laura\Documents\vita rali 3.pdf
[2012.05.20 23:22:51 | 000,903,876 | -H-- | C] () -- C:\Users\lena-laura\Documents\vita rali neu 3.pdf
[2012.05.20 20:01:22 | 000,903,402 | -H-- | C] () -- C:\Users\lena-laura\Documents\vita rali.pdf
[2012.05.20 03:49:54 | 000,015,397 | -H-- | C] () -- C:\Users\lena-laura\Documents\06 12.odt
[2012.05.20 03:49:36 | 000,035,382 | -H-- | C] () -- C:\Users\lena-laura\Documents\06 12.pdf
[2012.05.17 15:41:42 | 001,643,401 | -H-- | C] () -- C:\Users\lena-laura\Documents\vita rali.odt
[2012.05.15 17:41:14 | 000,037,555 | -H-- | C] () -- C:\Users\lena-laura\Documents\05 12.pdf
[2012.05.15 17:23:02 | 000,014,283 | -H-- | C] () -- C:\Users\lena-laura\Documents\aa fahrtkosten.odt
[2012.05.15 17:22:43 | 000,033,198 | -H-- | C] () -- C:\Users\lena-laura\Documents\AA Fahrtkosten.pdf
[2012.05.15 17:13:01 | 000,033,103 | -H-- | C] () -- C:\Users\lena-laura\Documents\AA Umzug.pdf
[2012.05.15 15:32:20 | 000,036,646 | -H-- | C] () -- C:\Users\lena-laura\Documents\04 12.pdf
[2012.05.15 15:24:33 | 000,016,047 | -H-- | C] () -- C:\Users\lena-laura\Documents\03 12.odt
[2012.05.15 15:22:31 | 000,037,462 | -H-- | C] () -- C:\Users\lena-laura\Documents\03 12.pdf
[2012.05.14 16:19:51 | 000,016,764 | -H-- | C] () -- C:\Users\lena-laura\Documents\aldonza dt.odt
[2012.05.14 02:03:47 | 000,009,858 | -H-- | C] () -- C:\Users\lena-laura\Documents\wohnung.odt
[2012.05.13 03:43:10 | 000,001,900 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012.05.11 02:07:02 | 000,012,059 | -H-- | C] () -- C:\Users\lena-laura\Documents\setlist.odt
[2012.05.08 03:52:38 | 000,014,156 | -H-- | C] () -- C:\Users\lena-laura\Documents\diary may.odt
[2012.05.07 14:14:10 | 000,037,735 | -H-- | C] () -- C:\Users\lena-laura\Documents\02 12.pdf
[2012.05.03 19:00:01 | 000,000,885 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FILSHtray.lnk
[2012.05.03 18:44:39 | 000,001,105 | ---- | C] () -- C:\Users\Public\Desktop\MAGIX Music Maker MX Production Suite Download-Version.lnk
[2012.05.03 03:56:26 | 000,012,166 | -H-- | C] () -- C:\Users\lena-laura\Documents\3.5.odt
[2012.05.02 02:59:14 | 000,028,025 | -H-- | C] () -- C:\Users\lena-laura\Documents\buch.odt
[2012.05.01 00:49:18 | 000,018,212 | -H-- | C] () -- C:\Users\lena-laura\Documents\ksk.odt
[2012.04.27 01:10:53 | 000,001,735 | ---- | C] () -- C:\Users\Public\Desktop\E-Cam.lnk
[2012.04.26 02:37:29 | 000,013,776 | -H-- | C] () -- C:\Users\lena-laura\Documents\mv kudamm.odt
[2012.04.07 16:24:46 | 000,511,800 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT
[2012.03.24 21:35:33 | 000,005,120 | ---- | C] () -- C:\Users\lena-laura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.07 17:40:22 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe
[2012.02.07 17:40:22 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2012.02.07 17:40:22 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2012.02.07 17:40:22 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2012.02.07 17:40:22 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2012.02.02 19:46:43 | 000,000,425 | ---- | C] () -- C:\windows\BRWMARK.INI
[2012.02.02 19:46:43 | 000,000,027 | ---- | C] () -- C:\windows\BRPP2KA.INI
[2011.10.20 14:30:59 | 000,000,000 | -H-- | C] () -- C:\Users\lena-laura\AppData\Roaming\wklnhst.dat
[2011.03.20 12:12:35 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.10.05 01:59:32 | 000,005,632 | ---- | C] () -- C:\windows\System32\StarOpen.sys
 
========== LOP Check ==========
 
[2009.10.16 15:37:05 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\T-Mobile
[2009.10.16 15:37:05 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\T-Mobile
[2009.10.16 15:37:05 | 000,000,000 | ---D | M] -- C:\Users\DefaultAppPool\AppData\Roaming\T-Mobile
[2011.01.16 22:38:40 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Alawar Entertainment
[2012.02.29 02:24:11 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Avid
[2010.03.16 21:14:32 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\ICQ
[2012.05.24 02:32:12 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\MAGIX
[2012.05.24 02:29:50 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\MakeMusic
[2010.03.28 19:55:02 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\No23
[2012.05.24 02:29:58 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\OpenOffice.org
[2012.05.24 02:29:59 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\Opera
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\PhotoScape
[2012.05.22 16:27:06 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Spotify
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\T-Mobile
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\T-Mobile Internet Manager
[2011.10.20 14:31:06 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Template
[2012.04.13 19:03:21 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\TestApp
[2010.10.19 23:12:10 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\TitanicMystery
[2012.05.24 02:29:59 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\TuneUp Software
[2010.09.04 14:34:17 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\V-Games
[2011.11.08 02:31:27 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Windows Live Writer
[2012.04.20 05:50:05 | 000,000,000 | ---D | M] -- C:\Users\lena_laura\AppData\Roaming\Opera
[2009.10.16 15:37:05 | 000,000,000 | ---D | M] -- C:\Users\lena_laura\AppData\Roaming\T-Mobile
[2012.04.10 11:57:36 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.05.24 02:29:49 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\Adobe
[2010.02.28 13:59:10 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Ahead
[2011.01.16 22:38:40 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Alawar Entertainment
[2012.03.01 15:59:28 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Apple Computer
[2012.02.29 02:24:11 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Avid
[2012.05.13 11:40:01 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Avira
[2012.04.03 20:10:31 | 000,000,000 | RH-D | M] -- C:\Users\lena-laura\AppData\Roaming\Brother
[2012.05.05 00:04:46 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\DivX
[2012.05.24 02:32:12 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\dvdcss
[2010.02.24 10:04:30 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Google
[2012.04.15 05:43:49 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\HpUpdate
[2010.03.16 21:14:32 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\ICQ
[2009.07.14 06:54:12 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Identities
[2009.10.16 12:43:29 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\InstallShield
[2009.10.16 12:49:24 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Macromedia
[2012.05.24 02:32:12 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\MAGIX
[2012.05.24 02:29:50 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\MakeMusic
[2012.05.24 02:29:50 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\Malwarebytes
[2012.05.24 02:32:13 | 000,000,000 | --SD | M] -- C:\Users\lena-laura\AppData\Roaming\Microsoft
[2012.05.24 02:29:56 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\Mozilla
[2010.03.28 19:55:02 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\No23
[2012.05.24 02:29:58 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\OpenOffice.org
[2012.05.24 02:29:59 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\Opera
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\PhotoScape
[2012.05.25 13:37:36 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\Skype
[2011.11.13 04:40:35 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\skypePM
[2012.05.22 16:27:06 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Spotify
[2012.02.10 02:30:54 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\SUPERAntiSpyware.com
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\T-Mobile
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\T-Mobile Internet Manager
[2011.10.20 14:31:06 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Template
[2012.04.13 19:03:21 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\TestApp
[2010.10.19 23:12:10 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\TitanicMystery
[2012.05.24 02:29:59 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\TuneUp Software
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\U3
[2010.09.04 14:34:17 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\V-Games
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] -- C:\Users\lena-laura\AppData\Roaming\vlc
[2011.11.08 02:31:27 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Windows Live Writer
[2011.09.21 21:25:44 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\WinRAR
[2010.12.26 21:21:32 | 000,000,000 | -H-D | M] -- C:\Users\lena-laura\AppData\Roaming\Yahoo!
 
< %APPDATA%\*.exe /s >
[2009.06.30 11:52:18 | 000,983,040 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\lena-laura\AppData\Roaming\T-Mobile Internet Manager\LiveUpdate.exe
[2009.06.23 16:43:40 | 000,110,592 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\lena-laura\AppData\Roaming\T-Mobile Internet Manager\ouc.exe
[2007.10.23 09:27:20 | 000,110,592 | ---- | M] () -- C:\Users\lena-laura\AppData\Roaming\U3\1100520A2890C80C\cleanup.exe
[2008.05.02 10:41:48 | 003,493,888 | ---- | M] (SanDisk Corporation) -- C:\Users\lena-laura\AppData\Roaming\U3\1100520A2890C80C\Launchpad Removal.exe
[2008.05.04 16:02:26 | 004,603,904 | ---- | M] () -- C:\Users\lena-laura\AppData\Roaming\U3\1100520A2890C80C\LaunchPad.exe
[2007.10.23 09:44:48 | 000,054,584 | ---- | M] () -- C:\Users\lena-laura\AppData\Roaming\U3\1100520A2890C80C\U3AccessGrant.exe
[2008.05.02 10:41:48 | 003,493,888 | -H-- | M] (SanDisk Corporation) -- C:\Users\lena-laura\AppData\Roaming\U3\temp\Launchpad Removal.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\ERDNT\cache\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\ERDNT\cache\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\ERDNT\cache\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2009.06.04 12:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\drivers\iaStor.sys
[2009.06.04 12:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_4f144d6467fc7c22\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\ERDNT\cache\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\ERDNT\cache\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\ERDNT\cache\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\ERDNT\cache\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\ERDNT\cache\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\ERDNT\cache\winlogon.exe
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
========== Files - Unicode (All) ==========
[2012.03.09 17:28:17 | 000,030,044 | -H-- | M] ()(C:\Users\lena-laura\Documents\Capital+M+Artists_K+�+N+S+T+L+E+R+P+R+O+F+I+L_Formular_Akt�.pdf) -- C:\Users\lena-laura\Documents\Capital+M+Artists_K+Ü+N+S+T+L+E+R+P+R+O+F+I+L_Formular_Akt….pdf
[2012.03.09 17:28:17 | 000,030,044 | -H-- | C] ()(C:\Users\lena-laura\Documents\Capital+M+Artists_K+�+N+S+T+L+E+R+P+R+O+F+I+L_Formular_Akt�.pdf) -- C:\Users\lena-laura\Documents\Capital+M+Artists_K+Ü+N+S+T+L+E+R+P+R+O+F+I+L_Formular_Akt….pdf

< End of report >

cosinus 25.05.2012 15:15
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://de.ask.com/?l=dis&o=15362
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 87 01 1B 1A FE F0 CC 01  [binary data]
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = http://start.facemoods.com/?a=gppc&s={searchTerms}&f=4
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=10588
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes\{14B776FE-D9AF-47B7-91DA-DBE53DD988A7}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=MGX&o=15359&src=kw&q={searchTerms}&locale=&apn_ptnrs=JQ&apn_dtid=YYYYYYYYDE&apn_uid=883CCEB2-1BF6-44CD-9A25-52180C7E4A7D&apn_sauid=167E6059-24CA-4311-BEC8-5F909B5B5C72
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SUNC_de
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] (Softonic Toolbar) -- C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\ffxtlbra@softonic.com
[2012.05.24 02:32:14 | 000,000,000 | ---D | M] (MAGIX Toolbar) -- C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\toolbar@ask.com
[2011.05.17 13:12:44 | 000,002,333 | -H-- | M] () -- C:\Users\lena-laura\AppData\Roaming\Mozilla\Firefox\Profiles\ztgpl636.default\searchplugins\askcom.xml
[2011.04.23 16:07:10 | 000,002,047 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
O2 - BHO: (MAGIX Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (MAGIX Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
[2012.05.24 20:25:48 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{336DC155-6B85-4C38-B551-88D3C6D14AC2}
[2012.05.24 20:25:35 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{0C810983-28DC-4C83-ADD4-8319B9FADA66}
[2012.05.24 20:22:38 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{78CF8D8D-C189-4419-8C64-95E84E346392}
[2012.05.24 20:22:24 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{CA823855-852E-410F-90A9-078D6BA3A373}
[2012.05.24 01:11:20 | 000,000,000 | -H-D | C] -- C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data Recovery
[2012.05.24 01:11:23 | 000,000,168 | ---- | M] () -- C:\ProgramData\-9uGVGPZdMB9nVGr
[2012.05.24 01:11:23 | 000,000,000 | ---- | M] () -- C:\ProgramData\-9uGVGPZdMB9nVG
[2012.05.24 01:11:17 | 000,000,256 | ---- | M] () -- C:\ProgramData\9uGVGPZdMB9nVG
:Files
C:\Program Files\Ask.com
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

lena-laura 25.05.2012 15:31
gemacht!

Code:
All processes killed
========== OTL ==========
HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Secondary_Page_URL| /E : value set successfully!
HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.
C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.
HKEY_USERS\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D7562AE-8EF6-416d-A838-AB665251703A}\ not found.
Registry key HKEY_USERS\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Microsoft\Internet Explorer\SearchScopes\{14B776FE-D9AF-47B7-91DA-DBE53DD988A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{14B776FE-D9AF-47B7-91DA-DBE53DD988A7}\ not found.
Registry key HKEY_USERS\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_USERS\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\ffxtlbra@softonic.com\defaults\preferences folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\ffxtlbra@softonic.com\defaults folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\ffxtlbra@softonic.com\content\imgs\flgs folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\ffxtlbra@softonic.com\content\imgs folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\ffxtlbra@softonic.com\content folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\ffxtlbra@softonic.com folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\toolbar@ask.com\searchplugins folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\toolbar@ask.com\defaults\preferences folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\toolbar@ask.com\defaults folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\toolbar@ask.com\chrome\skin folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\toolbar@ask.com\chrome\content folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\toolbar@ask.com\chrome folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\toolbar@ask.com folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\Mozilla\Firefox\Profiles\ztgpl636.default\searchplugins\askcom.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrch.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Program Files\Ask.com\Updater\Updater.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3837843822-382491344-1778226907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
C:\Users\lena-laura\AppData\Local\{336DC155-6B85-4C38-B551-88D3C6D14AC2} folder moved successfully.
C:\Users\lena-laura\AppData\Local\{0C810983-28DC-4C83-ADD4-8319B9FADA66} folder moved successfully.
C:\Users\lena-laura\AppData\Local\{78CF8D8D-C189-4419-8C64-95E84E346392} folder moved successfully.
C:\Users\lena-laura\AppData\Local\{CA823855-852E-410F-90A9-078D6BA3A373} folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data Recovery folder moved successfully.
C:\ProgramData\-9uGVGPZdMB9nVGr moved successfully.
C:\ProgramData\-9uGVGPZdMB9nVG moved successfully.
C:\ProgramData\9uGVGPZdMB9nVG moved successfully.
========== FILES ==========
C:\Program Files\Ask.com\Updater folder moved successfully.
C:\Program Files\Ask.com\assets\oobe folder moved successfully.
C:\Program Files\Ask.com\assets folder moved successfully.
C:\Program Files\Ask.com folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: DefaultAppPool
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: lena-laura
->Temp folder emptied: 241408769 bytes
->Temporary Internet Files folder emptied: 367809881 bytes
->Java cache emptied: 32793 bytes
->FireFox cache emptied: 135999596 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 20979634 bytes
->Flash cache emptied: 21172 bytes
 
User: lena_laura
->Temp folder emptied: 1791 bytes
->Temporary Internet Files folder emptied: 64407 bytes
->Java cache emptied: 0 bytes
->Opera cache emptied: 17722184 bytes
->Flash cache emptied: 739 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 81690012 bytes
RecycleBin emptied: 761120 bytes
 
Total Files Cleaned = 826,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: DefaultAppPool
->Flash cache emptied: 0 bytes
 
User: lena-laura
->Flash cache emptied: 0 bytes
 
User: lena_laura
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.43.1 log created on 05252012_162315

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
ich nochmal...hitman pro macht immer beim hochfahren einen quick scan...und jetzt hat der folgendes angezeigt (kann es nicht kopieren)

C:/windows/system32/drivers/ect/
Hosts file is compromised. Hosts files contain Byte order mark (BOM)obfuscation.

was heisst das?

cosinus 25.05.2012 15:38
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

lena-laura 25.05.2012 15:48
Code:
16:40:32.0542 4632        TDSS rootkit removing tool 2.7.37.0 May 23 2012 08:15:30
16:40:33.0025 4632        ============================================================
16:40:33.0025 4632        Current date / time: 2012/05/25 16:40:33.0025
16:40:33.0025 4632        SystemInfo:
16:40:33.0025 4632       
16:40:33.0025 4632        OS Version: 6.1.7601 ServicePack: 1.0
16:40:33.0025 4632        Product type: Workstation
16:40:33.0025 4632        ComputerName: PC
16:40:33.0025 4632        UserName: lena-laura
16:40:33.0025 4632        Windows directory: C:\windows
16:40:33.0025 4632        System windows directory: C:\windows
16:40:33.0025 4632        Processor architecture: Intel x86
16:40:33.0025 4632        Number of processors: 2
16:40:33.0025 4632        Page size: 0x1000
16:40:33.0025 4632        Boot type: Normal boot
16:40:33.0025 4632        ============================================================
16:40:34.0695 4632        Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
16:40:34.0710 4632        ============================================================
16:40:34.0710 4632        \Device\Harddisk0\DR0:
16:40:34.0710 4632        MBR partitions:
16:40:34.0710 4632        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xA000000
16:40:34.0710 4632        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xA000800, BlocksNum 0x7610800
16:40:34.0710 4632        ============================================================
16:40:34.0741 4632        C: <-> \Device\Harddisk0\DR0\Partition0
16:40:34.0788 4632        D: <-> \Device\Harddisk0\DR0\Partition1
16:40:34.0788 4632        ============================================================
16:40:34.0788 4632        Initialize success
16:40:34.0788 4632        ============================================================
16:42:42.0144 5120        ============================================================
16:42:42.0144 5120        Scan started
16:42:42.0144 5120        Mode: Manual; SigCheck; TDLFS;
16:42:42.0144 5120        ============================================================
16:42:43.0502 5120        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\windows\system32\drivers\1394ohci.sys
16:42:43.0861 5120        1394ohci - ok
16:42:43.0954 5120        ACPI            (cea80c80bed809aa0da6febc04733349) C:\windows\system32\drivers\ACPI.sys
16:42:44.0063 5120        ACPI - ok
16:42:44.0110 5120        AcpiPmi        (1efbc664abff416d1d07db115dcb264f) C:\windows\system32\drivers\acpipmi.sys
16:42:44.0235 5120        AcpiPmi - ok
16:42:44.0360 5120        AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
16:42:44.0438 5120        AdobeFlashPlayerUpdateSvc - ok
16:42:44.0531 5120        adp94xx        (21e785ebd7dc90a06391141aac7892fb) C:\windows\system32\DRIVERS\adp94xx.sys
16:42:44.0641 5120        adp94xx - ok
16:42:44.0703 5120        adpahci        (0c676bc278d5b59ff5abd57bbe9123f2) C:\windows\system32\DRIVERS\adpahci.sys
16:42:44.0797 5120        adpahci - ok
16:42:44.0843 5120        adpu320        (7c7b5ee4b7b822ec85321fe23a27db33) C:\windows\system32\DRIVERS\adpu320.sys
16:42:44.0906 5120        adpu320 - ok
16:42:44.0968 5120        AeLookupSvc    (8b5eefeec1e6d1a72a06c526628ad161) C:\windows\System32\aelupsvc.dll
16:42:45.0062 5120        AeLookupSvc - ok
16:42:45.0140 5120        AFD            (9ebbba55060f786f0fcaa3893bfa2806) C:\windows\system32\drivers\afd.sys
16:42:45.0249 5120        AFD - ok
16:42:45.0311 5120        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\windows\system32\drivers\agp440.sys
16:42:45.0389 5120        agp440 - ok
16:42:45.0467 5120        aic78xx        (8b30250d573a8f6b4bd23195160d8707) C:\windows\system32\DRIVERS\djsvs.sys
16:42:45.0545 5120        aic78xx - ok
16:42:45.0608 5120        ALG            (18a54e132947cd98fea9accc57f98f13) C:\windows\System32\alg.exe
16:42:45.0717 5120        ALG - ok
16:42:45.0779 5120        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\windows\system32\drivers\aliide.sys
16:42:45.0842 5120        aliide - ok
16:42:45.0873 5120        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\windows\system32\drivers\amdagp.sys
16:42:45.0951 5120        amdagp - ok
16:42:45.0982 5120        amdide          (cd5914170297126b6266860198d1d4f0) C:\windows\system32\drivers\amdide.sys
16:42:46.0060 5120        amdide - ok
16:42:46.0107 5120        AmdK8          (00dda200d71bac534bf56a9db5dfd666) C:\windows\system32\DRIVERS\amdk8.sys
16:42:46.0201 5120        AmdK8 - ok
16:42:46.0247 5120        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\windows\system32\DRIVERS\amdppm.sys
16:42:46.0357 5120        AmdPPM - ok
16:42:46.0435 5120        amdsata        (d320bf87125326f996d4904fe24300fc) C:\windows\system32\drivers\amdsata.sys
16:42:46.0513 5120        amdsata - ok
16:42:46.0575 5120        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\windows\system32\DRIVERS\amdsbs.sys
16:42:46.0653 5120        amdsbs - ok
16:42:46.0669 5120        amdxata        (46387fb17b086d16dea267d5be23a2f2) C:\windows\system32\drivers\amdxata.sys
16:42:46.0747 5120        amdxata - ok
16:42:46.0762 5120        Andbus - ok
16:42:46.0793 5120        AndDiag - ok
16:42:46.0825 5120        AndGps - ok
16:42:46.0871 5120        ANDModem - ok
16:42:47.0137 5120        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Program Files\Avira\AntiVir Desktop\sched.exe
16:42:47.0215 5120        AntiVirSchedulerService - ok
16:42:47.0261 5120        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
16:42:47.0324 5120        AntiVirService - ok
16:42:47.0449 5120        AppHostSvc      (d1af38fbac0dc7e6d796b0ed01707ee0) C:\windows\system32\inetsrv\apphostsvc.dll
16:42:47.0573 5120        AppHostSvc - ok
16:42:47.0620 5120        AppID          (aea177f783e20150ace5383ee368da19) C:\windows\system32\drivers\appid.sys
16:42:47.0870 5120        AppID - ok
16:42:47.0901 5120        AppIDSvc        (62a9c86cb6085e20db4823e4e97826f5) C:\windows\System32\appidsvc.dll
16:42:48.0041 5120        AppIDSvc - ok
16:42:48.0088 5120        Appinfo        (fb1959012294d6ad43e5304df65e3c26) C:\windows\System32\appinfo.dll
16:42:48.0213 5120        Appinfo - ok
16:42:48.0385 5120        Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
16:42:48.0431 5120        Apple Mobile Device - ok
16:42:48.0509 5120        arc            (2932004f49677bd84dbc72edb754ffb3) C:\windows\system32\DRIVERS\arc.sys
16:42:48.0587 5120        arc - ok
16:42:48.0619 5120        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\windows\system32\DRIVERS\arcsas.sys
16:42:48.0697 5120        arcsas - ok
16:42:48.0915 5120        aspnet_state    (776acefa0ca9df0faa51a5fb2f435705) C:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
16:42:48.0993 5120        aspnet_state - ok
16:42:49.0071 5120        AsusService    (c4fb2613d3c75364bb159b9c23a00e7a) C:\Windows\System32\AsusService.exe
16:42:49.0118 5120        AsusService ( UnsignedFile.Multi.Generic ) - warning
16:42:49.0118 5120        AsusService - detected UnsignedFile.Multi.Generic (1)
16:42:49.0149 5120        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\windows\system32\DRIVERS\asyncmac.sys
16:42:49.0289 5120        AsyncMac - ok
16:42:49.0336 5120        atapi          (338c86357871c167a96ab976519bf59e) C:\windows\system32\drivers\atapi.sys
16:42:49.0399 5120        atapi - ok
16:42:49.0555 5120        athr            (b01751cc563aecac09bbe36aaa21fbef) C:\windows\system32\DRIVERS\athr.sys
16:42:49.0695 5120        athr - ok
16:42:49.0789 5120        AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\windows\System32\Audiosrv.dll
16:42:49.0976 5120        AudioEndpointBuilder - ok
16:42:50.0007 5120        Audiosrv        (ce3b4e731638d2ef62fcb419be0d39f0) C:\windows\System32\Audiosrv.dll
16:42:50.0179 5120        Audiosrv - ok
16:42:50.0319 5120        avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\windows\system32\DRIVERS\avgntflt.sys
16:42:50.0444 5120        avgntflt - ok
16:42:50.0537 5120        avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\windows\system32\DRIVERS\avipbb.sys
16:42:50.0600 5120        avipbb - ok
16:42:50.0647 5120        avkmgr          (53e56450da16a1a7f0d002f511113f67) C:\windows\system32\DRIVERS\avkmgr.sys
16:42:50.0709 5120        avkmgr - ok
16:42:50.0771 5120        AxInstSV        (6e30d02aac9cac84f421622e3a2f6178) C:\windows\System32\AxInstSV.dll
16:42:50.0912 5120        AxInstSV - ok
16:42:51.0005 5120        b06bdrv        (1a231abec60fd316ec54c66715543cec) C:\windows\system32\DRIVERS\bxvbdx.sys
16:42:51.0130 5120        b06bdrv - ok
16:42:51.0193 5120        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\windows\system32\DRIVERS\b57nd60x.sys
16:42:51.0286 5120        b57nd60x - ok
16:42:51.0442 5120        BBSvc          (0d1ea7509f394d8b705b239ee71f5118) C:\Program Files\Microsoft\BingBar\BBSvc.EXE
16:42:51.0536 5120        BBSvc - ok
16:42:51.0598 5120        BDESVC          (ee1e9c3bb8228ae423dd38db69128e71) C:\windows\System32\bdesvc.dll
16:42:51.0723 5120        BDESVC - ok
16:42:51.0754 5120        Beep            (505506526a9d467307b3c393dedaf858) C:\windows\system32\drivers\Beep.sys
16:42:51.0926 5120        Beep - ok
16:42:52.0082 5120        BFE            (1e2bac209d184bb851e1a187d8a29136) C:\windows\System32\bfe.dll
16:42:52.0253 5120        BFE - ok
16:42:52.0363 5120        BITS            (e585445d5021971fae10393f0f1c3961) C:\windows\system32\qmgr.dll
16:42:52.0534 5120        BITS - ok
16:42:52.0597 5120        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\windows\system32\DRIVERS\blbdrive.sys
16:42:52.0675 5120        blbdrive - ok
16:42:52.0846 5120        Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe
16:42:52.0940 5120        Bonjour Service - ok
16:42:53.0002 5120        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\windows\system32\DRIVERS\bowser.sys
16:42:53.0111 5120        bowser - ok
16:42:53.0158 5120        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\windows\system32\DRIVERS\BrFiltLo.sys
16:42:53.0283 5120        BrFiltLo - ok
16:42:53.0314 5120        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\windows\system32\DRIVERS\BrFiltUp.sys
16:42:53.0423 5120        BrFiltUp - ok
16:42:53.0517 5120        BridgeMP        (77361d72a04f18809d0efb6cceb74d4b) C:\windows\system32\DRIVERS\bridge.sys
16:42:53.0704 5120        BridgeMP - ok
16:42:53.0845 5120        Browser        (6e11f33d14d020f58d5e02e4d67dfa19) C:\windows\System32\browser.dll
16:42:54.0016 5120        Browser - ok
16:42:54.0141 5120        Brserid        (845b8ce732e67f3b4133164868c666ea) C:\windows\System32\Drivers\Brserid.sys
16:42:54.0266 5120        Brserid - ok
16:42:54.0313 5120        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\windows\System32\Drivers\BrSerWdm.sys
16:42:54.0406 5120        BrSerWdm - ok
16:42:54.0437 5120        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\windows\System32\Drivers\BrUsbMdm.sys
16:42:54.0547 5120        BrUsbMdm - ok
16:42:54.0593 5120        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\windows\System32\Drivers\BrUsbSer.sys
16:42:54.0687 5120        BrUsbSer - ok
16:42:54.0749 5120        BthEnum        (2865a5c8e98c70c605f417908cebb3a4) C:\windows\system32\drivers\BthEnum.sys
16:42:54.0874 5120        BthEnum - ok
16:42:54.0937 5120        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\windows\system32\DRIVERS\bthmodem.sys
16:42:55.0030 5120        BTHMODEM - ok
16:42:55.0077 5120        BthPan          (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\windows\system32\DRIVERS\bthpan.sys
16:42:55.0186 5120        BthPan - ok
16:42:55.0264 5120        BTHPORT        (c2fbf6d271d9a94d839c416bf186ead9) C:\windows\System32\Drivers\BTHport.sys
16:42:55.0389 5120        BTHPORT - ok
16:42:55.0483 5120        bthserv        (1df19c96eef6c29d1c3e1a8678e07190) C:\windows\system32\bthserv.dll
16:42:55.0670 5120        bthserv - ok
16:42:55.0685 5120        BTHUSB          (c81e9413a25a439f436b1d4b6a0cf9e9) C:\windows\System32\Drivers\BTHUSB.sys
16:42:55.0763 5120        BTHUSB - ok
16:42:55.0779 5120        btwaudio - ok
16:42:55.0810 5120        btwavdt - ok
16:42:55.0841 5120        btwl2cap - ok
16:42:55.0857 5120        btwrchid - ok
16:42:56.0013 5120        catchme - ok
16:42:56.0075 5120        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\windows\system32\DRIVERS\cdfs.sys
16:42:56.0247 5120        cdfs - ok
16:42:56.0325 5120        cdrom          (be167ed0fdb9c1fa1133953c18d5a6c9) C:\windows\system32\drivers\cdrom.sys
16:42:56.0419 5120        cdrom - ok
16:42:56.0481 5120        CertPropSvc    (319c6b309773d063541d01df8ac6f55f) C:\windows\System32\certprop.dll
16:42:56.0637 5120        CertPropSvc - ok
16:42:56.0684 5120        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\windows\system32\DRIVERS\circlass.sys
16:42:56.0762 5120        circlass - ok
16:42:56.0809 5120        CISVC          (3e2afafa158c9ed670c106842bdcc81e) C:\windows\system32\CISVC.EXE
16:42:56.0918 5120        CISVC - ok
16:42:56.0980 5120        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\windows\system32\CLFS.sys
16:42:57.0058 5120        CLFS - ok
16:42:57.0152 5120        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:42:57.0230 5120        clr_optimization_v2.0.50727_32 - ok
16:42:57.0355 5120        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:42:57.0448 5120        clr_optimization_v4.0.30319_32 - ok
16:42:57.0479 5120        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\windows\system32\DRIVERS\CmBatt.sys
16:42:57.0557 5120        CmBatt - ok
16:42:57.0604 5120        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\windows\system32\drivers\cmdide.sys
16:42:57.0682 5120        cmdide - ok
16:42:57.0760 5120        CNG            (6427525d76f61d0c519b008d3680e8e7) C:\windows\system32\Drivers\cng.sys
16:42:57.0885 5120        CNG - ok
16:42:57.0932 5120        Compbatt        (a6023d3823c37043986713f118a89bee) C:\windows\system32\DRIVERS\compbatt.sys
16:42:57.0994 5120        Compbatt - ok
16:42:58.0057 5120        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\windows\system32\drivers\CompositeBus.sys
16:42:58.0150 5120        CompositeBus - ok
16:42:58.0181 5120        COMSysApp - ok
16:42:58.0275 5120        crcdisk        (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\windows\system32\DRIVERS\crcdisk.sys
16:42:58.0353 5120        crcdisk - ok
16:42:58.0431 5120        CryptSvc        (a585bebf7d054bd9618eda0922d5484a) C:\windows\system32\cryptsvc.dll
16:42:58.0618 5120        CryptSvc - ok
16:42:58.0727 5120        DcomLaunch      (7660f01d3b38aca1747e397d21d790af) C:\windows\system32\rpcss.dll
16:42:58.0930 5120        DcomLaunch - ok
16:42:58.0993 5120        defragsvc      (8d6e10a2d9a5eed59562d9b82cf804e1) C:\windows\System32\defragsvc.dll
16:42:59.0180 5120        defragsvc - ok
16:42:59.0242 5120        DfsC            (f024449c97ec1e464aaffda18593db88) C:\windows\system32\Drivers\dfsc.sys
16:42:59.0398 5120        DfsC - ok
16:42:59.0570 5120        Dhcp            (e9e01eb683c132f7fa27cd607b8a2b63) C:\windows\system32\dhcpcore.dll
16:42:59.0757 5120        Dhcp - ok
16:42:59.0788 5120        discache        (1a050b0274bfb3890703d490f330c0da) C:\windows\system32\drivers\discache.sys
16:42:59.0975 5120        discache - ok
16:43:00.0022 5120        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\windows\system32\DRIVERS\disk.sys
16:43:00.0100 5120        Disk - ok
16:43:00.0147 5120        Dnscache        (33ef4861f19a0736b11314aad9ae28d0) C:\windows\System32\dnsrslvr.dll
16:43:00.0256 5120        Dnscache - ok
16:43:00.0319 5120        dot3svc        (366ba8fb4b7bb7435e3b9eacb3843f67) C:\windows\System32\dot3svc.dll
16:43:00.0506 5120        dot3svc - ok
16:43:00.0615 5120        DPS            (8ec04ca86f1d68da9e11952eb85973d6) C:\windows\system32\dps.dll
16:43:00.0802 5120        DPS - ok
16:43:00.0927 5120        drmkaud        (b918e7c5f9bf77202f89e1a9539f2eb4) C:\windows\system32\drivers\drmkaud.sys
16:43:01.0021 5120        drmkaud - ok
16:43:01.0130 5120        DXGKrnl        (23f5d28378a160352ba8f817bd8c71cb) C:\windows\System32\drivers\dxgkrnl.sys
16:43:01.0255 5120        DXGKrnl - ok
16:43:01.0317 5120        EapHost        (8600142fa91c1b96367d3300ad0f3f3a) C:\windows\System32\eapsvc.dll
16:43:01.0504 5120        EapHost - ok
16:43:02.0019 5120        ebdrv          (024e1b5cac09731e4d868e64dbfb4ab0) C:\windows\system32\DRIVERS\evbdx.sys
16:43:02.0347 5120        ebdrv - ok
16:43:02.0534 5120        EFS            (81951f51e318aecc2d68559e47485cc4) C:\windows\System32\lsass.exe
16:43:02.0643 5120        EFS - ok
16:43:02.0768 5120        elxstor        (0ed67910c8c326796faa00b2bf6d9d3c) C:\windows\system32\DRIVERS\elxstor.sys
16:43:02.0877 5120        elxstor - ok
16:43:02.0924 5120        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\windows\system32\drivers\errdev.sys
16:43:03.0017 5120        ErrDev - ok
16:43:03.0127 5120        EventSystem    (f6916efc29d9953d5d0df06882ae8e16) C:\windows\system32\es.dll
16:43:03.0314 5120        EventSystem - ok
16:43:03.0407 5120        ewusbnet - ok
16:43:03.0439 5120        ew_hwusbdev - ok
16:43:03.0517 5120        exfat          (2dc9108d74081149cc8b651d3a26207f) C:\windows\system32\drivers\exfat.sys
16:43:03.0688 5120        exfat - ok
16:43:03.0797 5120        Fabs - ok
16:43:03.0860 5120        fastfat        (7e0ab74553476622fb6ae36f73d97d35) C:\windows\system32\drivers\fastfat.sys
16:43:04.0031 5120        fastfat - ok
16:43:04.0141 5120        Fax            (967ea5b213e9984cbe270205df37755b) C:\windows\system32\fxssvc.exe
16:43:04.0281 5120        Fax - ok
16:43:04.0328 5120        fdc            (e817a017f82df2a1f8cfdbda29388b29) C:\windows\system32\DRIVERS\fdc.sys
16:43:04.0406 5120        fdc - ok
16:43:04.0453 5120        fdPHost        (f3222c893bd2f5821a0179e5c71e88fb) C:\windows\system32\fdPHost.dll
16:43:04.0624 5120        fdPHost - ok
16:43:04.0702 5120        FDResPub        (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\windows\system32\fdrespub.dll
16:43:04.0874 5120        FDResPub - ok
16:43:04.0921 5120        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\windows\system32\drivers\fileinfo.sys
16:43:04.0983 5120        FileInfo - ok
16:43:05.0014 5120        Filetrace      (42c51dc94c91da21cb9196eb64c45db9) C:\windows\system32\drivers\filetrace.sys
16:43:05.0201 5120        Filetrace - ok
16:43:05.0654 5120        FirebirdServerMAGIXInstance (5bd96d8c5411ace71a7eaacaf0ef2903) C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
16:43:05.0919 5120        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - warning
16:43:05.0919 5120        FirebirdServerMAGIXInstance - detected UnsignedFile.Multi.Generic (1)
16:43:06.0106 5120        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\windows\system32\DRIVERS\flpydisk.sys
16:43:06.0200 5120        flpydisk - ok
16:43:06.0262 5120        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\windows\system32\drivers\fltmgr.sys
16:43:06.0340 5120        FltMgr - ok
16:43:06.0481 5120        FontCache      (b3a5ec6b6b6673db7e87c2bcdbddc074) C:\windows\system32\FntCache.dll
16:43:06.0621 5120        FontCache - ok
16:43:06.0730 5120        FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
16:43:06.0793 5120        FontCache3.0.0.0 - ok
16:43:06.0839 5120        FsDepends      (1a16b57943853e598cff37fe2b8cbf1d) C:\windows\system32\drivers\FsDepends.sys
16:43:06.0917 5120        FsDepends - ok
16:43:06.0964 5120        fssfltr        (bfaaa92861526bb0adcd01e964ab6609) C:\windows\system32\DRIVERS\fssfltr.sys
16:43:07.0027 5120        fssfltr - ok
16:43:07.0307 5120        fsssvc          (40cdfad174b3d5e80f95dda003c0b97f) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
16:43:07.0479 5120        fsssvc - ok
16:43:07.0666 5120        Fs_Rec          (7dae5ebcc80e45d3253f4923dc424d05) C:\windows\system32\drivers\Fs_Rec.sys
16:43:07.0744 5120        Fs_Rec - ok
16:43:07.0822 5120        fvevol          (8a73e79089b282100b9393b644cb853b) C:\windows\system32\DRIVERS\fvevol.sys
16:43:07.0916 5120        fvevol - ok
16:43:07.0978 5120        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\windows\system32\DRIVERS\gagp30kx.sys
16:43:08.0041 5120        gagp30kx - ok
16:43:08.0119 5120        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\windows\system32\DRIVERS\GEARAspiWDM.sys
16:43:08.0165 5120        GEARAspiWDM - ok
16:43:08.0290 5120        gpsvc          (e897eaf5ed6ba41e081060c9b447a673) C:\windows\System32\gpsvc.dll
16:43:08.0493 5120        gpsvc - ok
16:43:08.0618 5120        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\windows\system32\drivers\hcw85cir.sys
16:43:08.0711 5120        hcw85cir - ok
16:43:08.0805 5120        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\windows\system32\drivers\HdAudio.sys
16:43:08.0930 5120        HdAudAddService - ok
16:43:08.0992 5120        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\windows\system32\drivers\HDAudBus.sys
16:43:09.0086 5120        HDAudBus - ok
16:43:09.0133 5120        HidBatt        (1d58a7f3e11a9731d0eaaaa8405acc36) C:\windows\system32\DRIVERS\HidBatt.sys
16:43:09.0226 5120        HidBatt - ok
16:43:09.0273 5120        HidBth          (89448f40e6df260c206a193a4683ba78) C:\windows\system32\DRIVERS\hidbth.sys
16:43:09.0367 5120        HidBth - ok
16:43:09.0398 5120        HidIr          (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\windows\system32\DRIVERS\hidir.sys
16:43:09.0507 5120        HidIr - ok
16:43:09.0554 5120        hidserv        (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\windows\System32\hidserv.dll
16:43:09.0741 5120        hidserv - ok
16:43:09.0835 5120        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\windows\system32\drivers\hidusb.sys
16:43:09.0913 5120        HidUsb - ok
16:43:10.0037 5120        HitmanProScheduler (6ae9f23151a8f4835c6197dea77a63fb) C:\Program Files\HitmanPro\hmpsched.exe
16:43:10.0084 5120        HitmanProScheduler - ok
16:43:10.0147 5120        hkmsvc          (196b4e3f4cccc24af836ce58facbb699) C:\windows\system32\kmsvc.dll
16:43:10.0318 5120        hkmsvc - ok
16:43:10.0412 5120        HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\windows\system32\ListSvc.dll
16:43:10.0521 5120        HomeGroupListener - ok
16:43:10.0599 5120        HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\windows\system32\provsvc.dll
16:43:10.0708 5120        HomeGroupProvider - ok
16:43:10.0771 5120        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\windows\system32\drivers\HpSAMD.sys
16:43:10.0849 5120        HpSAMD - ok
16:43:10.0958 5120        HTTP            (871917b07a141bff43d76d8844d48106) C:\windows\system32\drivers\HTTP.sys
16:43:11.0145 5120        HTTP - ok
16:43:11.0207 5120        huawei_enumerator - ok
16:43:11.0285 5120        hwdatacard - ok
16:43:11.0332 5120        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\windows\system32\drivers\hwpolicy.sys
16:43:11.0410 5120        hwpolicy - ok
16:43:11.0441 5120        hwusbdev - ok
16:43:11.0535 5120        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\windows\system32\drivers\i8042prt.sys
16:43:11.0660 5120        i8042prt - ok
16:43:11.0769 5120        iaStor          (d483687eace0c065ee772481a96e05f5) C:\windows\system32\DRIVERS\iaStor.sys
16:43:11.0847 5120        iaStor - ok
16:43:11.0941 5120        iaStorV        (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\windows\system32\drivers\iaStorV.sys
16:43:12.0034 5120        iaStorV - ok
16:43:12.0206 5120        idsvc          (c521d7eb6497bb1af6afa89e322fb43c) C:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:43:12.0346 5120        idsvc - ok
16:43:12.0892 5120        igfx            (9467514ea189475a6e7fdc5d7bde9d3f) C:\windows\system32\DRIVERS\igdkmd32.sys
16:43:13.0267 5120        igfx - ok
16:43:13.0485 5120        iirsp          (4173ff5708f3236cf25195fecd742915) C:\windows\system32\DRIVERS\iirsp.sys
16:43:13.0563 5120        iirsp - ok
16:43:13.0703 5120        IKEEXT          (f95622f161474511b8d80d6b093aa610) C:\windows\System32\ikeext.dll
16:43:13.0891 5120        IKEEXT - ok
16:43:14.0374 5120        IntcAzAudAddService (db96b8bd676bb24bd4f1dc53ca1f182c) C:\windows\system32\drivers\RTKVHDA.sys
16:43:14.0671 5120        IntcAzAudAddService - ok
16:43:14.0873 5120        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\windows\system32\drivers\intelide.sys
16:43:14.0936 5120        intelide - ok
16:43:15.0014 5120        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\windows\system32\DRIVERS\intelppm.sys
16:43:15.0092 5120        intelppm - ok
16:43:15.0154 5120        IPBusEnum      (acb364b9075a45c0736e5c47be5cae19) C:\windows\system32\ipbusenum.dll
16:43:15.0326 5120        IPBusEnum - ok
16:43:15.0388 5120        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\windows\system32\DRIVERS\ipfltdrv.sys
16:43:15.0560 5120        IpFilterDriver - ok
16:43:15.0653 5120        iphlpsvc        (4d65a07b795d6674312f879d09aa7663) C:\windows\System32\iphlpsvc.dll
16:43:15.0856 5120        iphlpsvc - ok
16:43:15.0903 5120        IPMIDRV        (4bd7134618c1d2a27466a099062547bf) C:\windows\system32\drivers\IPMIDrv.sys
16:43:15.0981 5120        IPMIDRV - ok
16:43:16.0012 5120        IPNAT          (a5fa468d67abcdaa36264e463a7bb0cd) C:\windows\system32\drivers\ipnat.sys
16:43:16.0199 5120        IPNAT - ok
16:43:16.0465 5120        iPod Service    (49918803b661367023bf325cf602afdc) C:\Program Files\iPod\bin\iPodService.exe
16:43:16.0605 5120        iPod Service - ok
16:43:16.0730 5120        iprip          (72dd56197db4af4de203efe0d9e5901e) C:\windows\System32\iprip.dll
16:43:16.0839 5120        iprip - ok
16:43:16.0901 5120        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\windows\system32\drivers\irenum.sys
16:43:17.0026 5120        IRENUM - ok
16:43:17.0089 5120        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\windows\system32\drivers\isapnp.sys
16:43:17.0167 5120        isapnp - ok
16:43:17.0229 5120        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\windows\system32\drivers\msiscsi.sys
16:43:17.0307 5120        iScsiPrt - ok
16:43:17.0369 5120        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\windows\system32\drivers\kbdclass.sys
16:43:17.0432 5120        kbdclass - ok
16:43:17.0510 5120        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\windows\system32\drivers\kbdhid.sys
16:43:17.0588 5120        kbdhid - ok
16:43:17.0650 5120        kbfiltr        (3eb803312987ff44265c87cb960df6ab) C:\windows\system32\DRIVERS\kbfiltr.sys
16:43:17.0697 5120        kbfiltr - ok
16:43:17.0759 5120        KeyIso          (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
16:43:17.0837 5120        KeyIso - ok
16:43:17.0884 5120        KSecDD          (f4647bb23db9038a7536cf6b68f4207f) C:\windows\system32\Drivers\ksecdd.sys
16:43:17.0947 5120        KSecDD - ok
16:43:17.0993 5120        KSecPkg        (e73cae53bbb72ba26918492c6b4c229d) C:\windows\system32\Drivers\ksecpkg.sys
16:43:18.0071 5120        KSecPkg - ok
16:43:18.0165 5120        KtmRm          (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\windows\system32\msdtckrm.dll
16:43:18.0352 5120        KtmRm - ok
16:43:18.0430 5120        L1C            (a158cea8644b8a5c1ec0e9a81b70f65a) C:\windows\system32\DRIVERS\L1C62x86.sys
16:43:18.0524 5120        L1C - ok
16:43:18.0586 5120        LanmanServer    (d64af876d53eca3668bb97b51b4e70ab) C:\windows\System32\srvsvc.dll
16:43:18.0742 5120        LanmanServer - ok
16:43:18.0820 5120        LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\windows\System32\wkssvc.dll
16:43:18.0992 5120        LanmanWorkstation - ok
16:43:19.0101 5120        LgBttPort - ok
16:43:19.0132 5120        lgbusenum - ok
16:43:19.0163 5120        LGVMODEM - ok
16:43:19.0226 5120        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\windows\system32\DRIVERS\lltdio.sys
16:43:19.0397 5120        lltdio - ok
16:43:19.0522 5120        lltdsvc        (5700673e13a2117fa3b9020c852c01e2) C:\windows\System32\lltdsvc.dll
16:43:19.0709 5120        lltdsvc - ok
16:43:19.0803 5120        lmhosts        (55ca01ba19d0006c8f2639b6c045e08b) C:\windows\System32\lmhsvc.dll
16:43:19.0975 5120        lmhosts - ok
16:43:20.0037 5120        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\windows\system32\DRIVERS\lsi_fc.sys
16:43:20.0115 5120        LSI_FC - ok
16:43:20.0162 5120        LSI_SAS        (8ade1c877256a22e49b75d1cc9161f9c) C:\windows\system32\DRIVERS\lsi_sas.sys
16:43:20.0240 5120        LSI_SAS - ok
16:43:20.0271 5120        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\windows\system32\DRIVERS\lsi_sas2.sys
16:43:20.0349 5120        LSI_SAS2 - ok
16:43:20.0380 5120        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\windows\system32\DRIVERS\lsi_scsi.sys
16:43:20.0458 5120        LSI_SCSI - ok
16:43:20.0505 5120        luafv          (6703e366cc18d3b6e534f5cf7df39cee) C:\windows\system32\drivers\luafv.sys
16:43:20.0630 5120        luafv - ok
16:43:20.0817 5120        McComponentHostService (f453d1e6d881e8f8717e20ccd4199e85) C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
16:43:20.0864 5120        McComponentHostService - ok
16:43:20.0911 5120        megasas        (0fff5b045293002ab38eb1fd1fc2fb74) C:\windows\system32\DRIVERS\megasas.sys
16:43:20.0989 5120        megasas - ok
16:43:21.0035 5120        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\windows\system32\DRIVERS\MegaSR.sys
16:43:21.0129 5120        MegaSR - ok
16:43:21.0176 5120        MMCSS          (146b6f43a673379a3c670e86d89be5ea) C:\windows\system32\mmcss.dll
16:43:21.0363 5120        MMCSS - ok
16:43:21.0394 5120        Modem          (f001861e5700ee84e2d4e52c712f4964) C:\windows\system32\drivers\modem.sys
16:43:21.0613 5120        Modem - ok
16:43:21.0737 5120        monitor        (79d10964de86b292320e9dfe02282a23) C:\windows\system32\DRIVERS\monitor.sys
16:43:21.0831 5120        monitor - ok
16:43:21.0893 5120        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\windows\system32\drivers\mouclass.sys
16:43:21.0956 5120        mouclass - ok
16:43:22.0003 5120        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\windows\system32\DRIVERS\mouhid.sys
16:43:22.0096 5120        mouhid - ok
16:43:22.0159 5120        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\windows\system32\drivers\mountmgr.sys
16:43:22.0221 5120        mountmgr - ok
16:43:22.0283 5120        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\windows\system32\drivers\mpio.sys
16:43:22.0361 5120        mpio - ok
16:43:22.0408 5120        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\windows\system32\drivers\mpsdrv.sys
16:43:22.0564 5120        mpsdrv - ok
16:43:22.0673 5120        MpsSvc          (9835584e999d25004e1ee8e5f3e3b881) C:\windows\system32\mpssvc.dll
16:43:22.0876 5120        MpsSvc - ok
16:43:23.0017 5120        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\windows\system32\drivers\mrxdav.sys
16:43:23.0110 5120        MRxDAV - ok
16:43:23.0173 5120        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\windows\system32\DRIVERS\mrxsmb.sys
16:43:23.0297 5120        mrxsmb - ok
16:43:23.0344 5120        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\windows\system32\DRIVERS\mrxsmb10.sys
16:43:23.0453 5120        mrxsmb10 - ok
16:43:23.0500 5120        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\windows\system32\DRIVERS\mrxsmb20.sys
16:43:23.0594 5120        mrxsmb20 - ok
16:43:23.0641 5120        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\windows\system32\drivers\msahci.sys
16:43:23.0703 5120        msahci - ok
16:43:23.0765 5120        msdsm          (55055f8ad8be27a64c831322a780a228) C:\windows\system32\drivers\msdsm.sys
16:43:23.0875 5120        msdsm - ok
16:43:23.0921 5120        MSDTC          (e1bce74a3bd9902b72599c0192a07e27) C:\windows\System32\msdtc.exe
16:43:24.0031 5120        MSDTC - ok
16:43:24.0109 5120        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\windows\system32\drivers\Msfs.sys
16:43:24.0265 5120        Msfs - ok
16:43:24.0296 5120        mshidkmdf      (3e1e5767043c5af9367f0056295e9f84) C:\windows\System32\drivers\mshidkmdf.sys
16:43:24.0467 5120        mshidkmdf - ok
16:43:24.0499 5120        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\windows\system32\drivers\msisadrv.sys
16:43:24.0577 5120        msisadrv - ok
16:43:24.0655 5120        MSiSCSI        (90f7d9e6b6f27e1a707d4a297f077828) C:\windows\system32\iscsiexe.dll
16:43:24.0826 5120        MSiSCSI - ok
16:43:24.0857 5120        msiserver - ok
16:43:24.0904 5120        MSKSSRV        (8c0860d6366aaffb6c5bb9df9448e631) C:\windows\system32\drivers\MSKSSRV.sys
16:43:25.0091 5120        MSKSSRV - ok
16:43:25.0123 5120        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\windows\system32\drivers\MSPCLOCK.sys
16:43:25.0279 5120        MSPCLOCK - ok
16:43:25.0294 5120        MSPQM          (f456e973590d663b1073e9c463b40932) C:\windows\system32\drivers\MSPQM.sys
16:43:25.0435 5120        MSPQM - ok
16:43:25.0481 5120        MsRPC          (0e008fc4819d238c51d7c93e7b41e560) C:\windows\system32\drivers\MsRPC.sys
16:43:25.0544 5120        MsRPC - ok
16:43:25.0591 5120        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\windows\system32\drivers\mssmbios.sys
16:43:25.0637 5120        mssmbios - ok
16:43:25.0684 5120        MSTEE          (b42c6b921f61a6e55159b8be6cd54a36) C:\windows\system32\drivers\MSTEE.sys
16:43:25.0809 5120        MSTEE - ok
16:43:25.0887 5120        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\windows\system32\DRIVERS\MTConfig.sys
16:43:25.0965 5120        MTConfig - ok
16:43:25.0996 5120        Mup            (159fad02f64e6381758c990f753bcc80) C:\windows\system32\Drivers\mup.sys
16:43:26.0043 5120        Mup - ok
16:43:26.0121 5120        napagent        (61d57a5d7c6d9afe10e77dae6e1b445e) C:\windows\system32\qagentRT.dll
16:43:26.0324 5120        napagent - ok
16:43:26.0464 5120        NativeWifiP    (26384429fcd85d83746f63e798ab1480) C:\windows\system32\DRIVERS\nwifi.sys
16:43:26.0573 5120        NativeWifiP - ok
16:43:26.0667 5120        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\windows\system32\drivers\ndis.sys
16:43:26.0807 5120        NDIS - ok
16:43:26.0885 5120        NdisCap        (0e1787aa6c9191d3d319e8bafe86f80c) C:\windows\system32\DRIVERS\ndiscap.sys
16:43:27.0073 5120        NdisCap - ok
16:43:27.0104 5120        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\windows\system32\DRIVERS\ndistapi.sys
16:43:27.0275 5120        NdisTapi - ok
16:43:27.0322 5120        Ndisuio        (d8a65dafb3eb41cbb622745676fcd072) C:\windows\system32\DRIVERS\ndisuio.sys
16:43:27.0494 5120        Ndisuio - ok
16:43:27.0603 5120        NdisWan        (38fbe267e7e6983311179230facb1017) C:\windows\system32\DRIVERS\ndiswan.sys
16:43:27.0775 5120        NdisWan - ok
16:43:27.0899 5120        NDProxy        (a4bdc541e69674fbff1a8ff00be913f2) C:\windows\system32\drivers\NDProxy.sys
16:43:28.0055 5120        NDProxy - ok
16:43:28.0133 5120        Net Driver HPZ12 (510c138564486ff926a3f773205c63d1) C:\windows\system32\HPZinw12.dll
16:43:28.0165 5120        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
16:43:28.0165 5120        Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
16:43:28.0227 5120        NetBIOS        (80b275b1ce3b0e79909db7b39af74d51) C:\windows\system32\DRIVERS\netbios.sys
16:43:28.0414 5120        NetBIOS - ok
16:43:28.0523 5120        NetBT          (280122ddcf04b378edd1ad54d71c1e54) C:\windows\system32\DRIVERS\netbt.sys
16:43:28.0711 5120        NetBT - ok
16:43:28.0820 5120        Netlogon        (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
16:43:28.0898 5120        Netlogon - ok
16:43:28.0991 5120        Netman          (7cccfca7510684768da22092d1fa4db2) C:\windows\System32\netman.dll
16:43:29.0179 5120        Netman - ok
16:43:29.0319 5120        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
16:43:29.0397 5120        NetMsmqActivator - ok
16:43:29.0413 5120        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
16:43:29.0491 5120        NetPipeActivator - ok
16:43:29.0569 5120        netprofm        (8c338238c16777a802d6a9211eb2ba50) C:\windows\System32\netprofm.dll
16:43:29.0756 5120        netprofm - ok
16:43:29.0803 5120        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
16:43:29.0865 5120        NetTcpActivator - ok
16:43:29.0881 5120        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
16:43:29.0943 5120        NetTcpPortSharing - ok
16:43:29.0990 5120        nfrd960        (1d85c4b390b0ee09c7a46b91efb2c097) C:\windows\system32\DRIVERS\nfrd960.sys
16:43:30.0037 5120        nfrd960 - ok
16:43:30.0099 5120        NlaSvc          (912084381d30d8b89ec4e293053f4710) C:\windows\System32\nlasvc.dll
16:43:30.0255 5120        NlaSvc - ok
16:43:30.0349 5120        NMIndexingService - ok
16:43:30.0395 5120        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\windows\system32\drivers\Npfs.sys
16:43:30.0551 5120        Npfs - ok
16:43:30.0614 5120        nsi            (ba387e955e890c8a88306d9b8d06bf17) C:\windows\system32\nsisvc.dll
16:43:30.0785 5120        nsi - ok
16:43:30.0817 5120        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\windows\system32\drivers\nsiproxy.sys
16:43:30.0988 5120        nsiproxy - ok
16:43:31.0191 5120        Ntfs            (81189c3d7763838e55c397759d49007a) C:\windows\system32\drivers\Ntfs.sys
16:43:31.0363 5120        Ntfs - ok
16:43:31.0409 5120        Null            (f9756a98d69098dca8945d62858a812c) C:\windows\system32\drivers\Null.sys
16:43:31.0565 5120        Null - ok
16:43:31.0628 5120        nvraid          (b3e25ee28883877076e0e1ff877d02e0) C:\windows\system32\drivers\nvraid.sys
16:43:31.0706 5120        nvraid - ok
16:43:31.0768 5120        nvstor          (4380e59a170d88c4f1022eff6719a8a4) C:\windows\system32\drivers\nvstor.sys
16:43:31.0846 5120        nvstor - ok
16:43:31.0924 5120        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\windows\system32\drivers\nv_agp.sys
16:43:31.0987 5120        nv_agp - ok
16:43:32.0158 5120        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
16:43:32.0252 5120        odserv - ok
16:43:32.0299 5120        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\windows\system32\drivers\ohci1394.sys
16:43:32.0392 5120        ohci1394 - ok
16:43:32.0439 5120        ose            (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:43:32.0501 5120        ose - ok
16:43:32.0579 5120        p2pimsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\windows\system32\pnrpsvc.dll
16:43:32.0704 5120        p2pimsvc - ok
16:43:32.0782 5120        p2psvc          (59c3ddd501e39e006dac31bf55150d91) C:\windows\system32\p2psvc.dll
16:43:32.0876 5120        p2psvc - ok
16:43:32.0938 5120        Parport        (2ea877ed5dd9713c5ac74e8ea7348d14) C:\windows\system32\DRIVERS\parport.sys
16:43:33.0032 5120        Parport - ok
16:43:33.0079 5120        partmgr        (3f34a1b4c5f6475f320c275e63afce9b) C:\windows\system32\drivers\partmgr.sys
16:43:33.0157 5120        partmgr - ok
16:43:33.0188 5120        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\windows\system32\DRIVERS\parvdm.sys
16:43:33.0281 5120        Parvdm - ok
16:43:33.0328 5120        PcaSvc          (358ab7956d3160000726574083dfc8a6) C:\windows\System32\pcasvc.dll
16:43:33.0422 5120        PcaSvc - ok
16:43:33.0500 5120        pci            (673e55c3498eb970088e812ea820aa8f) C:\windows\system32\drivers\pci.sys
16:43:33.0578 5120        pci - ok
16:43:33.0609 5120        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\windows\system32\drivers\pciide.sys
16:43:33.0687 5120        pciide - ok
16:43:33.0749 5120        pcmcia          (f396431b31693e71e8a80687ef523506) C:\windows\system32\DRIVERS\pcmcia.sys
16:43:33.0827 5120        pcmcia - ok
16:43:33.0874 5120        pcw            (250f6b43d2b613172035c6747aeeb19f) C:\windows\system32\drivers\pcw.sys
16:43:33.0952 5120        pcw - ok
16:43:34.0046 5120        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\windows\system32\drivers\peauth.sys
16:43:34.0233 5120        PEAUTH - ok
16:43:34.0529 5120        pla            (414bba67a3ded1d28437eb66aeb8a720) C:\windows\system32\pla.dll
16:43:34.0779 5120        pla - ok
16:43:35.0013 5120        PlugPlay        (ec7bc28d207da09e79b3e9faf8b232ca) C:\windows\system32\umpnpmgr.dll
16:43:35.0138 5120        PlugPlay - ok
16:43:35.0216 5120        Pml Driver HPZ12 (37e5e8ffbad35605daeec3224ea0e465) C:\windows\system32\HPZipm12.dll
16:43:35.0231 5120        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
16:43:35.0231 5120        Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
16:43:35.0278 5120        PNRPAutoReg    (63ff8572611249931eb16bb8eed6afc8) C:\windows\system32\pnrpauto.dll
16:43:35.0387 5120        PNRPAutoReg - ok
16:43:35.0450 5120        PNRPsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\windows\system32\pnrpsvc.dll
16:43:35.0543 5120        PNRPsvc - ok
16:43:35.0637 5120        PolicyAgent    (53946b69ba0836bd95b03759530c81ec) C:\windows\System32\ipsecsvc.dll
16:43:35.0809 5120        PolicyAgent - ok
16:43:35.0887 5120        Power          (f87d30e72e03d579a5199ccb3831d6ea) C:\windows\system32\umpo.dll
16:43:36.0058 5120        Power - ok
16:43:36.0167 5120        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\windows\system32\DRIVERS\raspptp.sys
16:43:36.0339 5120        PptpMiniport - ok
16:43:36.0370 5120        Processor      (85b1e3a0c7585bc4aae6899ec6fcf011) C:\windows\system32\DRIVERS\processr.sys
16:43:36.0464 5120        Processor - ok
16:43:36.0542 5120        ProfSvc        (43ca4ccc22d52fb58e8988f0198851d0) C:\windows\system32\profsvc.dll
16:43:36.0667 5120        ProfSvc - ok
16:43:36.0713 5120        ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
16:43:36.0776 5120        ProtectedStorage - ok
16:43:36.0854 5120        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\windows\system32\DRIVERS\pacer.sys
16:43:36.0979 5120        Psched - ok
16:43:37.0150 5120        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\windows\system32\DRIVERS\ql2300.sys
16:43:37.0306 5120        ql2300 - ok
16:43:37.0509 5120        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\windows\system32\DRIVERS\ql40xx.sys
16:43:37.0587 5120        ql40xx - ok
16:43:37.0665 5120        QWAVE          (31ac809e7707eb580b2bdb760390765a) C:\windows\system32\qwave.dll
16:43:37.0790 5120        QWAVE - ok
16:43:37.0837 5120        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\windows\system32\drivers\qwavedrv.sys
16:43:37.0915 5120        QWAVEdrv - ok
16:43:37.0961 5120        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\windows\system32\DRIVERS\rasacd.sys
16:43:38.0133 5120        RasAcd - ok
16:43:38.0195 5120        RasAgileVpn    (57ec4aef73660166074d8f7f31c0d4fd) C:\windows\system32\DRIVERS\AgileVpn.sys
16:43:38.0367 5120        RasAgileVpn - ok
16:43:38.0414 5120        RasAuto        (a60f1839849c0c00739787fd5ec03f13) C:\windows\System32\rasauto.dll
16:43:38.0585 5120        RasAuto - ok
16:43:38.0617 5120        Rasl2tp        (d9f91eafec2815365cbe6d167e4e332a) C:\windows\system32\DRIVERS\rasl2tp.sys
16:43:38.0804 5120        Rasl2tp - ok
16:43:38.0897 5120        RasMan          (cb9e04dc05eacf5b9a36ca276d475006) C:\windows\System32\rasmans.dll
16:43:39.0085 5120        RasMan - ok
16:43:39.0147 5120        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\windows\system32\DRIVERS\raspppoe.sys
16:43:39.0319 5120        RasPppoe - ok
16:43:39.0381 5120        RasSstp        (44101f495a83ea6401d886e7fd70096b) C:\windows\system32\DRIVERS\rassstp.sys
16:43:39.0537 5120        RasSstp - ok
16:43:39.0615 5120        rdbss          (d528bc58a489409ba40334ebf96a311b) C:\windows\system32\DRIVERS\rdbss.sys
16:43:39.0787 5120        rdbss - ok
16:43:39.0833 5120        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\windows\system32\DRIVERS\rdpbus.sys
16:43:39.0911 5120        rdpbus - ok
16:43:39.0958 5120        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\windows\system32\DRIVERS\RDPCDD.sys
16:43:40.0083 5120        RDPCDD - ok
16:43:40.0145 5120        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\windows\system32\drivers\rdpencdd.sys
16:43:40.0270 5120        RDPENCDD - ok
16:43:40.0317 5120        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\windows\system32\drivers\rdprefmp.sys
16:43:40.0457 5120        RDPREFMP - ok
16:43:40.0504 5120        RDPWD          (244c83332f44589ae98fc347f11b2693) C:\windows\system32\drivers\RDPWD.sys
16:43:40.0582 5120        RDPWD - ok
16:43:40.0645 5120        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\windows\system32\drivers\rdyboost.sys
16:43:40.0707 5120        rdyboost - ok
16:43:40.0769 5120        RemoteAccess    (7b5e1419717fac363a31cc302895217a) C:\windows\System32\mprdim.dll
16:43:40.0894 5120        RemoteAccess - ok
16:43:40.0957 5120        RemoteRegistry  (cb9a8683f4ef2bf99e123d79950d7935) C:\windows\system32\regsvc.dll
16:43:41.0113 5120        RemoteRegistry - ok
16:43:41.0175 5120        RFCOMM          (cb928d9e6daf51879dd6ba8d02f01321) C:\windows\system32\DRIVERS\rfcomm.sys
16:43:41.0253 5120        RFCOMM - ok
16:43:41.0300 5120        RpcEptMapper    (78d072f35bc45d9e4e1b61895c152234) C:\windows\System32\RpcEpMap.dll
16:43:41.0425 5120        RpcEptMapper - ok
16:43:41.0471 5120        RpcLocator      (94d36c0e44677dd26981d2bfeef2a29d) C:\windows\system32\locator.exe
16:43:41.0534 5120        RpcLocator - ok
16:43:41.0612 5120        RpcSs          (7660f01d3b38aca1747e397d21d790af) C:\windows\system32\rpcss.dll
16:43:41.0737 5120        RpcSs - ok
16:43:41.0815 5120        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\windows\system32\DRIVERS\rspndr.sys
16:43:41.0939 5120        rspndr - ok
16:43:41.0971 5120        SamSs          (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
16:43:42.0033 5120        SamSs - ok
16:43:42.0111 5120        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\windows\system32\drivers\sbp2port.sys
16:43:42.0173 5120        sbp2port - ok
16:43:42.0220 5120        SCardSvr        (8fc518ffe9519c2631d37515a68009c4) C:\windows\System32\SCardSvr.dll
16:43:42.0407 5120        SCardSvr - ok
16:43:42.0454 5120        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\windows\system32\DRIVERS\scfilter.sys
16:43:42.0610 5120        scfilter - ok
16:43:42.0766 5120        Schedule        (a04bb13f8a72f8b6e8b4071723e4e336) C:\windows\system32\schedsvc.dll
16:43:42.0985 5120        Schedule - ok
16:43:43.0031 5120        SCPolicySvc    (319c6b309773d063541d01df8ac6f55f) C:\windows\System32\certprop.dll
16:43:43.0187 5120        SCPolicySvc - ok
16:43:43.0250 5120        SDRSVC          (08236c4bce5edd0a0318a438af28e0f7) C:\windows\System32\SDRSVC.dll
16:43:43.0359 5120        SDRSVC - ok
16:43:43.0499 5120        SeaPort        (78779ee07231c658b483b1f38b5088df) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
16:43:43.0593 5120        SeaPort - ok
16:43:43.0640 5120        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\windows\system32\drivers\secdrv.sys
16:43:43.0811 5120        secdrv - ok
16:43:43.0858 5120        seclogon        (a59b3a4442c52060cc7a85293aa3546f) C:\windows\system32\seclogon.dll
16:43:43.0999 5120        seclogon - ok
16:43:44.0030 5120        SENS            (dcb7fcdcc97f87360f75d77425b81737) C:\windows\system32\sens.dll
16:43:44.0155 5120        SENS - ok
16:43:44.0201 5120        Serenum        (9ad8b8b515e3df6acd4212ef465de2d1) C:\windows\system32\DRIVERS\serenum.sys
16:43:44.0279 5120        Serenum - ok
16:43:44.0326 5120        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\windows\system32\DRIVERS\serial.sys
16:43:44.0404 5120        Serial - ok
16:43:44.0451 5120        sermouse        (79bffb520327ff916a582dfea17aa813) C:\windows\system32\DRIVERS\sermouse.sys
16:43:44.0513 5120        sermouse - ok
16:43:44.0623 5120        SessionEnv      (4ae380f39a0032eab7dd953030b26d28) C:\windows\system32\sessenv.dll
16:43:44.0763 5120        SessionEnv - ok
16:43:44.0794 5120        sffdisk        (9f976e1eb233df46fce808d9dea3eb9c) C:\windows\system32\drivers\sffdisk.sys
16:43:44.0872 5120        sffdisk - ok
16:43:44.0903 5120        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\windows\system32\drivers\sffp_mmc.sys
16:43:44.0981 5120        sffp_mmc - ok
16:43:44.0997 5120        sffp_sd        (6d4ccaedc018f1cf52866bbbaa235982) C:\windows\system32\drivers\sffp_sd.sys
16:43:45.0075 5120        sffp_sd - ok
16:43:45.0106 5120        sfloppy        (db96666cc8312ebc45032f30b007a547) C:\windows\system32\DRIVERS\sfloppy.sys
16:43:45.0169 5120        sfloppy - ok
16:43:45.0247 5120        SharedAccess    (d1a079a0de2ea524513b6930c24527a2) C:\windows\System32\ipnathlp.dll
16:43:45.0403 5120        SharedAccess - ok
16:43:45.0465 5120        ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\windows\System32\shsvcs.dll
16:43:45.0605 5120        ShellHWDetection - ok
16:43:45.0652 5120        simptcp        (f5aaa8cdda25b6387af590d676d25bad) C:\windows\System32\tcpsvcs.exe
16:43:45.0761 5120        simptcp - ok
16:43:45.0808 5120        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\windows\system32\drivers\sisagp.sys
16:43:45.0886 5120        sisagp - ok
16:43:45.0949 5120        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\windows\system32\DRIVERS\SiSRaid2.sys
16:43:46.0011 5120        SiSRaid2 - ok
16:43:46.0058 5120        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\windows\system32\DRIVERS\sisraid4.sys
16:43:46.0136 5120        SiSRaid4 - ok
16:43:46.0292 5120        SkypeUpdate    (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files\Skype\Updater\Updater.exe
16:43:46.0354 5120        SkypeUpdate - ok
16:43:46.0432 5120        Smb            (3e21c083b8a01cb70ba1f09303010fce) C:\windows\system32\DRIVERS\smb.sys
16:43:46.0588 5120        Smb - ok
16:43:46.0682 5120        SNMPTRAP        (6a984831644eca1a33ffeae4126f4f37) C:\windows\System32\snmptrap.exe
16:43:46.0744 5120        SNMPTRAP - ok
16:43:46.0791 5120        spldr          (95cf1ae7527fb70f7816563cbc09d942) C:\windows\system32\drivers\spldr.sys
16:43:46.0853 5120        spldr - ok
16:43:46.0931 5120        Spooler        (866a43013535dc8587c258e43579c764) C:\windows\System32\spoolsv.exe
16:43:47.0072 5120        Spooler - ok
16:43:47.0446 5120        sppsvc          (cf87a1de791347e75b98885214ced2b8) C:\windows\system32\sppsvc.exe
16:43:47.0789 5120        sppsvc - ok
16:43:48.0039 5120        sppuinotify    (b0180b20b065d89232a78a40fe56eaa6) C:\windows\system32\sppuinotify.dll
16:43:48.0211 5120        sppuinotify - ok
16:43:48.0320 5120        srv            (e4c2764065d66ea1d2d3ebc28fe99c46) C:\windows\system32\DRIVERS\srv.sys
16:43:48.0429 5120        srv - ok
16:43:48.0491 5120        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\windows\system32\DRIVERS\srv2.sys
16:43:48.0601 5120        srv2 - ok
16:43:48.0647 5120        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\windows\system32\DRIVERS\srvnet.sys
16:43:48.0725 5120        srvnet - ok
16:43:48.0772 5120        sscdbus        (d5dffeaa1e15d4effabb9d9a3068ac5b) C:\windows\system32\DRIVERS\sscdbus.sys
16:43:48.0866 5120        sscdbus - ok
16:43:48.0897 5120        sscdmdfl        (8a1be0c347814f482f493aea619d57f6) C:\windows\system32\DRIVERS\sscdmdfl.sys
16:43:48.0975 5120        sscdmdfl - ok
16:43:49.0037 5120        sscdmdm        (5ab0b1987f682a59b15b78f84c6ad7d0) C:\windows\system32\DRIVERS\sscdmdm.sys
16:43:49.0100 5120        sscdmdm - ok
16:43:49.0162 5120        SSDPSRV        (d887c9fd02ac9fa880f6e5027a43e118) C:\windows\System32\ssdpsrv.dll
16:43:49.0334 5120        SSDPSRV - ok
16:43:49.0412 5120        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\windows\system32\DRIVERS\ssmdrv.sys
16:43:49.0459 5120        ssmdrv - ok
16:43:49.0505 5120        SstpSvc        (d318f23be45d5e3a107469eb64815b50) C:\windows\system32\sstpsvc.dll
16:43:49.0677 5120        SstpSvc - ok
16:43:49.0724 5120        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\windows\system32\DRIVERS\stexstor.sys
16:43:49.0802 5120        stexstor - ok
16:43:49.0895 5120        StiSvc          (e1fb3706030fb4578a0d72c2fc3689e4) C:\windows\System32\wiaservc.dll
16:43:50.0051 5120        StiSvc - ok
16:43:50.0098 5120        swenum          (e58c78a848add9610a4db6d214af5224) C:\windows\system32\drivers\swenum.sys
16:43:50.0176 5120        swenum - ok
16:43:50.0254 5120        swprv          (a28bd92df340e57b024ba433165d34d7) C:\windows\System32\swprv.dll
16:43:50.0441 5120        swprv - ok
16:43:50.0519 5120        SynTP          (8bd10dc8809dc69a1c5a795cb10add76) C:\windows\system32\DRIVERS\SynTP.sys
16:43:50.0566 5120        SynTP - ok
16:43:50.0722 5120        SysMain        (36650d618ca34c9d357dfd3d89b2c56f) C:\windows\system32\sysmain.dll
16:43:50.0847 5120        SysMain - ok
16:43:50.0909 5120        TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\windows\System32\TabSvc.dll
16:43:51.0003 5120        TabletInputService - ok
16:43:51.0081 5120        TapiSrv        (613bf4820361543956909043a265c6ac) C:\windows\System32\tapisrv.dll
16:43:51.0206 5120        TapiSrv - ok
16:43:51.0253 5120        TBS            (b799d9fdb26111737f58288d8dc172d9) C:\windows\System32\tbssvc.dll
16:43:51.0393 5120        TBS - ok
16:43:51.0627 5120        Tcpip          (7fa2e0f8b072bd04b77b421480b6cc22) C:\windows\system32\drivers\tcpip.sys
16:43:51.0752 5120        Tcpip - ok
16:43:51.0814 5120        TCPIP6          (7fa2e0f8b072bd04b77b421480b6cc22) C:\windows\system32\DRIVERS\tcpip.sys
16:43:51.0970 5120        TCPIP6 - ok
16:43:52.0017 5120        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\windows\system32\drivers\tcpipreg.sys
16:43:52.0142 5120        tcpipreg - ok
16:43:52.0204 5120        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\windows\system32\drivers\tdpipe.sys
16:43:52.0267 5120        TDPIPE - ok
16:43:52.0313 5120        TDTCP          (2c2c5afe7ee4f620d69c23c0617651a8) C:\windows\system32\drivers\tdtcp.sys
16:43:52.0376 5120        TDTCP - ok
16:43:52.0438 5120        tdx            (b459575348c20e8121d6039da063c704) C:\windows\system32\DRIVERS\tdx.sys
16:43:52.0594 5120        tdx - ok
16:43:52.0657 5120        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\windows\system32\drivers\termdd.sys
16:43:52.0719 5120        TermDD - ok
16:43:52.0844 5120        TermService    (382c804c92811be57829d8e550a900e2) C:\windows\System32\termsrv.dll
16:43:53.0031 5120        TermService - ok
16:43:53.0093 5120        Themes          (42fb6afd6b79d9fe07381609172e7ca4) C:\windows\system32\themeservice.dll
16:43:53.0218 5120        Themes - ok
16:43:53.0265 5120        THREADORDER    (146b6f43a673379a3c670e86d89be5ea) C:\windows\system32\mmcss.dll
16:43:53.0437 5120        THREADORDER - ok
16:43:53.0483 5120        TlntSvr        (ce92b84ed806f1c5c340a51dfd3e49bc) C:\windows\System32\tlntsvr.exe
16:43:53.0577 5120        TlntSvr - ok
16:43:53.0639 5120        TrkWks          (4792c0378db99a9bc2ae2de6cfff0c3a) C:\windows\System32\trkwks.dll
16:43:53.0811 5120        TrkWks - ok
16:43:53.0889 5120        TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\windows\servicing\TrustedInstaller.exe
16:43:54.0061 5120        TrustedInstaller - ok
16:43:54.0123 5120        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\windows\system32\DRIVERS\tssecsrv.sys
16:43:54.0279 5120        tssecsrv - ok
16:43:54.0373 5120        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\windows\system32\drivers\tsusbflt.sys
16:43:54.0466 5120        TsUsbFlt - ok
16:43:54.0529 5120        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\windows\system32\DRIVERS\tunnel.sys
16:43:54.0700 5120        tunnel - ok
16:43:54.0747 5120        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\windows\system32\DRIVERS\uagp35.sys
16:43:54.0825 5120        uagp35 - ok
16:43:54.0903 5120        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\windows\system32\DRIVERS\udfs.sys
16:43:55.0059 5120        udfs - ok
16:43:55.0153 5120        UI0Detect      (8344fd4fce927880aa1aa7681d4927e5) C:\windows\system32\UI0Detect.exe
16:43:55.0246 5120        UI0Detect - ok
16:43:55.0324 5120        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\windows\system32\drivers\uliagpkx.sys
16:43:55.0387 5120        uliagpkx - ok
16:43:55.0449 5120        umbus          (d295bed4b898f0fd999fcfa9b32b071b) C:\windows\system32\drivers\umbus.sys
16:43:55.0543 5120        umbus - ok
16:43:55.0589 5120        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\windows\system32\DRIVERS\umpass.sys
16:43:55.0683 5120        UmPass - ok
16:43:55.0761 5120        upnphost        (833fbb672460efce8011d262175fad33) C:\windows\System32\upnphost.dll
16:43:55.0948 5120        upnphost - ok
16:43:56.0073 5120        USB28xxBGA      (ae246f574c9089e284d9d34b63694c45) C:\windows\system32\DRIVERS\emBDA.sys
16:43:56.0182 5120        USB28xxBGA - ok
16:43:56.0323 5120        USB28xxOEM      (3b2a32c73238f537eb5e695d12acfb74) C:\windows\system32\DRIVERS\emOEM.sys
16:43:56.0447 5120        USB28xxOEM - ok
16:43:56.0510 5120        USBAAPL        (83cafcb53201bbac04d822f32438e244) C:\windows\system32\Drivers\usbaapl.sys
16:43:56.0603 5120        USBAAPL - ok
16:43:56.0681 5120        usbaudio        (1d9f2bd026e8e2d45033a4df3f16b78c) C:\windows\system32\drivers\usbaudio.sys
16:43:56.0791 5120        usbaudio - ok
16:43:56.0806 5120        usbbus - ok
16:43:56.0869 5120        usbccgp        (bd9c55d7023c5de374507acc7a14e2ac) C:\windows\system32\DRIVERS\usbccgp.sys
16:43:56.0962 5120        usbccgp - ok
16:43:57.0009 5120        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\windows\system32\drivers\usbcir.sys
16:43:57.0103 5120        usbcir - ok
16:43:57.0134 5120        UsbDiag - ok
16:43:57.0196 5120        usbehci        (f92de757e4b7ce9c07c5e65423f3ae3b) C:\windows\system32\drivers\usbehci.sys
16:43:57.0259 5120        usbehci - ok
16:43:57.0321 5120        usbhub          (8dc94aec6a7e644a06135ae7506dc2e9) C:\windows\system32\DRIVERS\usbhub.sys
16:43:57.0415 5120        usbhub - ok
16:43:57.0446 5120        USBModem - ok
16:43:57.0508 5120        usbohci        (e185d44fac515a18d9deddc23c2cdf44) C:\windows\system32\drivers\usbohci.sys
16:43:57.0586 5120        usbohci - ok
16:43:57.0633 5120        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\windows\system32\DRIVERS\usbprint.sys
16:43:57.0727 5120        usbprint - ok
16:43:57.0789 5120        usbscan        (576096ccbc07e7c4ea4f5e6686d6888f) C:\windows\system32\DRIVERS\usbscan.sys
16:43:57.0898 5120        usbscan - ok
16:43:57.0945 5120        USBSTOR        (f991ab9cc6b908db552166768176896a) C:\windows\system32\DRIVERS\USBSTOR.SYS
16:43:58.0054 5120        USBSTOR - ok
16:43:58.0101 5120        usbuhci        (68df884cf41cdada664beb01daf67e3d) C:\windows\system32\drivers\usbuhci.sys
16:43:58.0179 5120        usbuhci - ok
16:43:58.0241 5120        usbvideo        (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\windows\System32\Drivers\usbvideo.sys
16:43:58.0335 5120        usbvideo - ok
16:43:58.0397 5120        UxSms          (081e6e1c91aec36758902a9f727cd23c) C:\windows\System32\uxsms.dll
16:43:58.0569 5120        UxSms - ok
16:43:58.0616 5120        VaultSvc        (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
16:43:58.0709 5120        VaultSvc - ok
16:43:58.0787 5120        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\windows\system32\drivers\vdrvroot.sys
16:43:58.0865 5120        vdrvroot - ok
16:43:58.0959 5120        vds            (c3cd30495687c2a2f66a65ca6fd89be9) C:\windows\System32\vds.exe
16:43:59.0146 5120        vds - ok
16:43:59.0193 5120        vga            (17c408214ea61696cec9c66e388b14f3) C:\windows\system32\DRIVERS\vgapnp.sys
16:43:59.0287 5120        vga - ok
16:43:59.0318 5120        VgaSave        (8e38096ad5c8570a6f1570a61e251561) C:\windows\System32\drivers\vga.sys
16:43:59.0489 5120        VgaSave - ok
16:43:59.0552 5120        vhdmp          (5461686cca2fda57b024547733ab42e3) C:\windows\system32\drivers\vhdmp.sys
16:43:59.0645 5120        vhdmp - ok
16:43:59.0692 5120        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\windows\system32\drivers\viaagp.sys
16:43:59.0770 5120        viaagp - ok
16:43:59.0801 5120        ViaC7          (e02f079a6aa107f06b16549c6e5c7b74) C:\windows\system32\DRIVERS\viac7.sys
16:43:59.0895 5120        ViaC7 - ok
16:43:59.0942 5120        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\windows\system32\drivers\viaide.sys
16:44:00.0020 5120        viaide - ok
16:44:00.0051 5120        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\windows\system32\drivers\volmgr.sys
16:44:00.0129 5120        volmgr - ok
16:44:00.0223 5120        volmgrx        (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\windows\system32\drivers\volmgrx.sys
16:44:00.0316 5120        volmgrx - ok
16:44:00.0394 5120        volsnap        (f497f67932c6fa693d7de2780631cfe7) C:\windows\system32\drivers\volsnap.sys
16:44:00.0488 5120        volsnap - ok
16:44:00.0550 5120        vsmraid        (9dfa0cc2f8855a04816729651175b631) C:\windows\system32\DRIVERS\vsmraid.sys
16:44:00.0628 5120        vsmraid - ok
16:44:00.0784 5120        VSS            (209a3b1901b83aeb8527ed211cce9e4c) C:\windows\system32\vssvc.exe
16:44:01.0034 5120        VSS - ok
16:44:01.0081 5120        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\windows\system32\DRIVERS\vwifibus.sys
16:44:01.0174 5120        vwifibus - ok
16:44:01.0221 5120        vwififlt        (7090d3436eeb4e7da3373090a23448f7) C:\windows\system32\DRIVERS\vwififlt.sys
16:44:01.0315 5120        vwififlt - ok
16:44:01.0377 5120        vwifimp        (a3f04cbea6c2a10e6cb01f8b47611882) C:\windows\system32\DRIVERS\vwifimp.sys
16:44:01.0486 5120        vwifimp - ok
16:44:01.0580 5120        W32Time        (55187fd710e27d5095d10a472c8baf1c) C:\windows\system32\w32time.dll
16:44:01.0751 5120        W32Time - ok
16:44:01.0923 5120        W3SVC          (57c8c20bfa5bef6bd851ebac67a8ced0) C:\windows\system32\inetsrv\iisw3adm.dll
16:44:02.0017 5120        W3SVC - ok
16:44:02.0079 5120        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\windows\system32\DRIVERS\wacompen.sys
16:44:02.0173 5120        WacomPen - ok
16:44:02.0219 5120        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\windows\system32\DRIVERS\wanarp.sys
16:44:02.0375 5120        WANARP - ok
16:44:02.0407 5120        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\windows\system32\DRIVERS\wanarp.sys
16:44:02.0547 5120        Wanarpv6 - ok
16:44:02.0625 5120        WAS            (57c8c20bfa5bef6bd851ebac67a8ced0) C:\windows\system32\inetsrv\iisw3adm.dll
16:44:02.0719 5120        WAS - ok
16:44:02.0906 5120        wbengine        (691e3285e53dca558e1a84667f13e15a) C:\windows\system32\wbengine.exe
16:44:03.0077 5120        wbengine - ok
16:44:03.0140 5120        WbioSrvc        (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\windows\System32\wbiosrvc.dll
16:44:03.0265 5120        WbioSrvc - ok
16:44:03.0327 5120        wcncsvc        (34eee0dfaadb4f691d6d5308a51315dc) C:\windows\System32\wcncsvc.dll
16:44:03.0467 5120        wcncsvc - ok
16:44:03.0514 5120        WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\windows\System32\WcsPlugInService.dll
16:44:03.0608 5120        WcsPlugInService - ok
16:44:03.0701 5120        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\windows\system32\DRIVERS\wd.sys
16:44:03.0779 5120        Wd - ok
16:44:03.0857 5120        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\windows\system32\drivers\Wdf01000.sys
16:44:03.0967 5120        Wdf01000 - ok
16:44:04.0045 5120        WdiServiceHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\windows\system32\wdi.dll
16:44:04.0169 5120        WdiServiceHost - ok
16:44:04.0201 5120        WdiSystemHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\windows\system32\wdi.dll
16:44:04.0310 5120        WdiSystemHost - ok
16:44:04.0388 5120        WebClient      (a9d880f97530d5b8fee278923349929d) C:\windows\System32\webclnt.dll
16:44:04.0513 5120        WebClient - ok
16:44:04.0575 5120        Wecsvc          (760f0afe937a77cff27153206534f275) C:\windows\system32\wecsvc.dll
16:44:04.0731 5120        Wecsvc - ok
16:44:04.0762 5120        wercplsupport  (ac804569bb2364fb6017370258a4091b) C:\windows\System32\wercplsupport.dll
16:44:04.0918 5120        wercplsupport - ok
16:44:04.0965 5120        WerSvc          (08e420d873e4fd85241ee2421b02c4a4) C:\windows\System32\WerSvc.dll
16:44:05.0137 5120        WerSvc - ok
16:44:05.0199 5120        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\windows\system32\DRIVERS\wfplwf.sys
16:44:05.0355 5120        WfpLwf - ok
16:44:05.0402 5120        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\windows\system32\drivers\wimmount.sys
16:44:05.0480 5120        WIMMount - ok
16:44:05.0651 5120        WinDefend      (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll
16:44:05.0776 5120        WinDefend - ok
16:44:05.0839 5120        WinHttpAutoProxySvc - ok
16:44:05.0948 5120        Winmgmt        (f62e510b6ad4c21eb9fe8668ed251826) C:\windows\system32\wbem\WMIsvc.dll
16:44:06.0135 5120        Winmgmt - ok
16:44:06.0338 5120        WinRM          (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\windows\system32\WsmSvc.dll
16:44:06.0603 5120        WinRM - ok
16:44:06.0743 5120        WinUsb          (a67e5f9a400f3bd1be3d80613b45f708) C:\windows\system32\drivers\WinUsb.sys
16:44:06.0837 5120        WinUsb - ok
16:44:06.0977 5120        Wlansvc        (16935c98ff639d185086a3529b1f2067) C:\windows\System32\wlansvc.dll
16:44:07.0133 5120        Wlansvc - ok
16:44:07.0477 5120        wlidsvc        (fb01d4ae207b9efdbabfc55dc95c7e31) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
16:44:07.0664 5120        wlidsvc - ok
16:44:07.0882 5120        WmiAcpi        (0217679b8fca58714c3bf2726d2ca84e) C:\windows\system32\drivers\wmiacpi.sys
16:44:07.0960 5120        WmiAcpi - ok
16:44:08.0069 5120        wmiApSrv        (6eb6b66517b048d87dc1856ddf1f4c3f) C:\windows\system32\wbem\WmiApSrv.exe
16:44:08.0163 5120        wmiApSrv - ok
16:44:08.0413 5120        WMPNetworkSvc  (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe
16:44:08.0584 5120        WMPNetworkSvc - ok
16:44:08.0647 5120        WPCSvc          (a2f0ec770a92f2b3f9de6d518e11409c) C:\windows\System32\wpcsvc.dll
16:44:08.0740 5120        WPCSvc - ok
16:44:08.0787 5120        WPDBusEnum      (aa53356d60af47eacc85bc617a4f3f66) C:\windows\system32\wpdbusenum.dll
16:44:08.0912 5120        WPDBusEnum - ok
16:44:09.0005 5120        ws2ifsl        (6db3276587b853bf886b69528fdb048c) C:\windows\system32\drivers\ws2ifsl.sys
16:44:09.0177 5120        ws2ifsl - ok
16:44:09.0239 5120        wscsvc          (6f5d49efe0e7164e03ae773a3fe25340) C:\windows\system32\wscsvc.dll
16:44:09.0349 5120        wscsvc - ok
16:44:09.0380 5120        WSearch - ok
16:44:09.0676 5120        wuauserv        (3026418a50c5b4761befa632cedb7406) C:\windows\system32\wuaueng.dll
16:44:09.0957 5120        wuauserv - ok
16:44:10.0285 5120        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\windows\system32\drivers\WudfPf.sys
16:44:10.0441 5120        WudfPf - ok
16:44:10.0487 5120        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\windows\system32\DRIVERS\WUDFRd.SYS
16:44:10.0643 5120        WUDFRd - ok
16:44:10.0721 5120        wudfsvc        (8d1e1e529a2c9e9b6a85b55a345f7629) C:\windows\System32\WUDFSvc.dll
16:44:10.0877 5120        wudfsvc - ok
16:44:10.0940 5120        WwanSvc        (ff2d745b560f7c71b31f30f4d49f73d2) C:\windows\System32\wwansvc.dll
16:44:11.0065 5120        WwanSvc - ok
16:44:11.0174 5120        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
16:44:11.0689 5120        \Device\Harddisk0\DR0 - ok
16:44:11.0704 5120        Boot (0x1200)  (e82e8cb223b133dc906e7ae36c7c522a) \Device\Harddisk0\DR0\Partition0
16:44:11.0704 5120        \Device\Harddisk0\DR0\Partition0 - ok
16:44:11.0751 5120        Boot (0x1200)  (6d96bbb3aa2ca1cd7babdcd8baa76a22) \Device\Harddisk0\DR0\Partition1
16:44:11.0767 5120        \Device\Harddisk0\DR0\Partition1 - ok
16:44:11.0767 5120        ============================================================
16:44:11.0767 5120        Scan finished
16:44:11.0767 5120        ============================================================
16:44:11.0829 5128        Detected object count: 4
16:44:11.0829 5128        Actual detected object count: 4
16:46:56.0624 5128        AsusService ( UnsignedFile.Multi.Generic ) - skipped by user
16:46:56.0624 5128        AsusService ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:46:56.0640 5128        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - skipped by user
16:46:56.0640 5128        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:46:56.0656 5128        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
16:46:56.0656 5128        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:46:56.0656 5128        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
16:46:56.0656 5128        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 25.05.2012 22:49
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

lena-laura 25.05.2012 23:46
so hier das combofix log.
in der leiste unten rechts sind ein paar symbole verschwunden...u.a.auch das avira symbol...wo sind die denn hin? weisst du das?

Code:
ComboFix 12-05-25.03 - lena-laura 26.05.2012  0:13.2.2 - x86
Microsoft Windows 7 Starter  6.1.7601.1.1252.49.1031.18.2039.1288 [GMT 2:00]
ausgeführt von:: c:\users\lena-laura\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\lena-laura\AppData\Roaming\AcroIEHelpe.txt
c:\users\lena-laura\AppData\Roaming\srvblck5.tmp
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-04-25 bis 2012-05-25  ))))))))))))))))))))))))))))))
.
.
2012-05-25 22:34 . 2012-05-25 22:34        --------        d-----w-        c:\users\lena-laura\AppData\Local\temp
2012-05-25 22:34 . 2012-05-25 22:34        --------        d-----w-        c:\users\Public\AppData\Local\temp
2012-05-25 22:34 . 2012-05-25 22:34        --------        d-----w-        c:\users\lena_laura\AppData\Local\temp
2012-05-25 22:34 . 2012-05-25 22:34        --------        d-----w-        c:\users\DefaultAppPool\AppData\Local\temp
2012-05-25 22:34 . 2012-05-25 22:34        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-05-23 19:51 . 2012-05-23 19:51        --------        d-----w-        c:\program files\ESET
2012-05-21 00:04 . 2012-05-22 12:41        --------        d--h--w-        c:\users\lena-laura\AppData\Local\Spotify
2012-05-21 00:03 . 2012-05-22 14:27        --------        d--h--w-        c:\users\lena-laura\AppData\Roaming\Spotify
2012-05-13 09:40 . 2012-05-13 09:40        --------        d--h--w-        c:\users\lena-laura\AppData\Roaming\Avira
2012-05-13 01:42 . 2012-04-27 08:20        137928        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-05-13 01:42 . 2012-04-24 22:32        83392        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-05-13 01:42 . 2012-04-16 19:17        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2012-05-13 01:42 . 2012-05-13 01:42        --------        d-----w-        c:\programdata\Avira
2012-05-13 01:42 . 2012-05-13 01:42        --------        d-----w-        c:\program files\Avira
2012-05-12 09:10 . 2012-03-30 10:23        1291632        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2012-05-12 09:10 . 2012-03-31 04:29        936960        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-12 09:09 . 2012-03-31 04:39        3968368        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-05-12 09:09 . 2012-03-31 04:39        3913072        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-12 09:09 . 2012-03-31 02:36        2343424        ----a-w-        c:\windows\system32\win32k.sys
2012-05-12 09:09 . 2012-03-17 07:27        56176        ----a-w-        c:\windows\system32\drivers\partmgr.sys
2012-05-12 09:09 . 2012-03-03 05:31        1077248        ----a-w-        c:\windows\system32\DWrite.dll
2012-05-03 16:59 . 2012-05-03 17:00        --------        d-----w-        c:\program files\FILSHtray
2012-05-03 16:37 . 2012-05-03 16:38        --------        d-----w-        c:\program files\MAGIX
2012-05-03 16:35 . 2012-05-04 21:45        --------        d-----w-        c:\programdata\MAGIX
2012-05-03 16:35 . 2012-05-03 16:38        --------        d-----w-        c:\program files\Common Files\MAGIX Services
2012-05-03 16:25 . 2012-05-24 00:32        --------        d-----w-        c:\users\lena-laura\AppData\Roaming\MAGIX
2012-04-26 23:07 . 2002-12-02 13:22        5632        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-04 21:13 . 2012-04-11 13:17        419488        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-05-04 21:13 . 2011-06-03 14:35        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-13 21:14 . 2012-04-13 21:14        12872        ----a-w-        c:\windows\system32\bootdelete.exe
2012-04-04 13:56 . 2012-02-06 11:44        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-01 05:46 . 2012-04-12 01:02        19824        ----a-w-        c:\windows\system32\drivers\fs_rec.sys
2012-03-01 05:37 . 2012-04-12 01:02        172544        ----a-w-        c:\windows\system32\wintrust.dll
2012-03-01 05:33 . 2012-04-12 01:02        159232        ----a-w-        c:\windows\system32\imagehlp.dll
2012-03-01 05:29 . 2012-04-12 01:02        5120        ----a-w-        c:\windows\system32\wmi.dll
2012-02-28 01:18 . 2012-04-12 01:30        1799168        ----a-w-        c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-12 01:30        1427456        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-02-28 01:11 . 2012-04-12 01:30        1127424        ----a-w-        c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-12 01:30        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2012-03-18 15:22 . 2011-05-12 17:36        97208        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-02-29 17148552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-20 1545512]
"HotkeyService"="AsusSender.exe" [2009-09-11 33768]
"HotKeyMon"="AsusSender.exe" [2009-09-11 33768]
"SuperHybridEngine"="AsusSender.exe" [2009-09-11 33768]
"SynAsusAcpi"="c:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-07-20 83240]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-29 7744032]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"Freecorder FLV Service"="c:\program files\Freecorder\FLVSrvc.exe" [2011-03-24 167936]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-12-24 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-09-30 252296]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-01 348624]
.
c:\users\lena-laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
FILSHtray.lnk - c:\program files\FILSHtray\FILSHtray.exe [2012-4-18 594432]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2012-05-01 22:31        348624        ----a-w-        c:\program files\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 AsusService;Asus Launcher Service;c:\windows\System32\AsusService.exe [2009-08-18 219136]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 257696]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus.sys [x]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag.sys [x]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps.sys [x]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem.sys [x]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-04-26 2702848]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtport.sys [x]
R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [x]
R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmodem.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-04-16 36000]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2012-05-01 86224]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-05-24 1840128]
S2 HitmanProScheduler;HitmanPro Scheduler;c:\program files\HitmanPro\hmpsched.exe [2012-04-20 105288]
S2 iprip;RIP-Überwachung;c:\windows\System32\svchost.exe [2009-07-14 20992]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [2009-07-27 51712]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
iissvcs        REG_MULTI_SZ          w3svc was
apphost        REG_MULTI_SZ          apphostsvc
ipripsvc        REG_MULTI_SZ          iprip
.
Inhalt des "geplante Tasks" Ordners
.
2012-05-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 21:13]
.
2012-05-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3837843822-382491344-1778226907-1000Core.job
- c:\users\lena-laura\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-19 12:04]
.
2012-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3837843822-382491344-1778226907-1000UA.job
- c:\users\lena-laura\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-19 12:04]
.
2012-02-27 c:\windows\Tasks\Norton Security Scan for lena-laura.job
- c:\progra~1\NORTON~2\Engine\351~1.10\Nss.exe [2012-02-27 07:02]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
mStart Page =
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\lena-laura\AppData\Roaming\Mozilla\Firefox\Profiles\ztgpl636.default\
FF - user.js: extensions.softonic_i.newTab - false
FF - user.js: extensions.softonic_i.tlbrSrchUrl - hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=
FF - user.js: extensions.softonic_i.id - b0a1e4500000000000000625d3f6b5b0
FF - user.js: extensions.softonic_i.instlDay - 15399
FF - user.js: extensions.softonic_i.vrsn - 1.5.11.5
FF - user.js: extensions.softonic_i.vrsni - 1.5.11.5
FF - user.js: extensions.softonic_i.vrsnTs - 1.5.11.51:14
FF - user.js: extensions.softonic_i.prtnrId - softonic
FF - user.js: extensions.softonic_i.prdct - softonic
FF - user.js: extensions.softonic_i.aflt - SD
FF - user.js: extensions.softonic_i.smplGrp - eng7
FF - user.js: extensions.softonic_i.tlbrId - de12JANdefault
FF - user.js: extensions.softonic_i.instlRef - MON00015
FF - user.js: extensions.softonic_i.dfltLng - de
FF - user.js: extensions.softonic_i.excTlbr - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\SUPERAntiSpyware\SASSEH.DLL
Notify-!SASWinLogon - c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3837843822-382491344-1778226907-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-05-26  00:40:29
ComboFix-quarantined-files.txt  2012-05-25 22:40
ComboFix2.txt  2012-02-07 16:09
.
Vor Suchlauf: 15 Verzeichnis(se), 47.701.848.064 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 47.653.535.744 Bytes frei
.
- - End Of File - - E979CC8EB60BE9AF8936ED34CB8330E0

cosinus 26.05.2012 00:03
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

lena-laura 26.05.2012 01:34
hey arne,

gmer ist nicht abgestürzt, dafür windows...pc hat sich runtergefahren und als ich ihn wieder hochgefahhren habe bekam ich die meldung dass windows nicht mehr richtig arbeitet. naja...ich versuchs morgen einfach nochmal.

lg

----------------

eben schon wieder.
wollte den scan mit asw durchführen und dann wurde der bildschirm blau, weisse schrift und system ist runtergefahren.
ich hab keine ahnung was, wieso und weshalb. ich weiß nur, dass ich keine scans durchführen kann, wenn das system immer wieder abstürzt und runterfährt.
was kann ich jetzt machen?

cosinus 26.05.2012 14:32
GMER erstmal sein lassen oder kannst du die anderen Scans auch nicht machen?

lena-laura 26.05.2012 15:37
alsooo...osam ging ja (denke weil der scan kürzer war) hier das log.

dann habe ich eben den akku rausgenommen und über strom laufen lassen und siehe da...der scan hat funktioniert.
habe jetzt das bluescreen thema in einer anderen kategorie eröffnet, da ich nicht sicher war, ob das hier hin gehört.
im anhang die asw.txt datei....

lg
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 02:11:00 on 08.02.2012

OS: Windows 7 Starter Edition (Build 7600), 32-bit
Default Browser: Mozilla Corporation Firefox 9.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskUserS-1-5-21-3837843822-382491344-1778226907-1000Core.job" - "Google Inc." - C:\Users\lena-laura\AppData\Local\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-3837843822-382491344-1778226907-1000UA.job" - "Google Inc." - C:\Users\lena-laura\AppData\Local\Google\Update\GoogleUpdate.exe
"Norton Security Scan for lena-laura.job" - "Symantec Corporation" - C:\Program Files\Norton Security Scan\Engine\2.7.6.3\Nss.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\windows\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile USB Driver" (USBAAPL) - "Apple, Inc." - C:\windows\System32\Drivers\usbaapl.sys
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\windows\System32\DRIVERS\avipbb.sys
"Bluetooth AVDT" (btwavdt) - ? - C:\windows\system32\DRIVERS\btwavdt.sys  (File not found)
"Bluetooth L2CAP Service" (btwl2cap) - ? - C:\windows\System32\DRIVERS\btwl2cap.sys  (File not found)
"Bluetooth-Audiogerät" (btwaudio) - ? - C:\windows\System32\drivers\btwaudio.sys  (File not found)
"btwrchid" (btwrchid) - ? - C:\windows\system32\DRIVERS\btwrchid.sys  (File not found)
"catchme" (catchme) - ? - C:\Users\LENA-L~1\AppData\Local\Temp\catchme.sys  (File not found)
"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\windows\System32\DRIVERS\fssfltr.sys
"Huawei DataCard USB Modem and USB Serial" (hwdatacard) - ? - C:\windows\System32\DRIVERS\ewusbmdm.sys  (File not found)
"Huawei DataCard USB PNP Device" (hwusbdev) - ? - C:\windows\System32\DRIVERS\ewusbdev.sys  (File not found)
"Huawei MobileBroadband USB PNP Device" (ew_hwusbdev) - ? - C:\windows\System32\DRIVERS\ew_hwusbdev.sys  (File not found)
"HUAWEI USB-NDIS miniport" (ewusbnet) - ? - C:\windows\System32\DRIVERS\ewusbnet.sys  (File not found)
"huawei_enumerator" (huawei_enumerator) - ? - C:\windows\System32\DRIVERS\ew_jubusenum.sys  (File not found)
"LG Bluetooth Bus Enumerator" (lgbusenum) - ? - C:\windows\System32\DRIVERS\lgbtbus.sys  (File not found)
"LGE Android Platform Composite USB Device" (Andbus) - ? - C:\windows\System32\DRIVERS\lgandbus.sys  (File not found)
"LGE Android Platform USB GPS NMEA Port" (AndGps) - ? - C:\windows\System32\DRIVERS\lgandgps.sys  (File not found)
"LGE Android Platform USB Modem" (ANDModem) - ? - C:\windows\System32\DRIVERS\lgandmodem.sys  (File not found)
"LGE Android Platform USB Serial Port" (AndDiag) - ? - C:\windows\System32\DRIVERS\lganddiag.sys  (File not found)
"LGE Bluetooth TransPort" (LgBttPort) - ? - C:\windows\System32\DRIVERS\lgbtport.sys  (File not found)
"LGE Mobile Composite USB Device" (usbbus) - ? - C:\windows\System32\DRIVERS\lgusbbus.sys  (File not found)
"LGE Mobile USB Modem" (USBModem) - ? - C:\windows\System32\DRIVERS\lgusbmodem.sys  (File not found)
"LGE Mobile USB Serial Port" (UsbDiag) - ? - C:\windows\System32\DRIVERS\lgusbdiag.sys  (File not found)
"LGE Virtual Modem" (LGVMODEM) - ? - C:\windows\System32\DRIVERS\lgvmodem.sys  (File not found)
"pxldapow" (pxldapow) - ? - C:\Users\LENA-L~1\AppData\Local\Temp\pxldapow.sys  (Hidden registry entry, rootkit activity | File not found)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{7D4D6379-F301-4311-BEBA-E26EB0561882} "{7D4D6379-F301-4311-BEBA-E26EB0561882}" - ? -  (File not found | COM-object registry key not found)
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} "Album Download IE Asynchronous Pluggable Protocol Interface" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll  (File not found)
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll
{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler" - ? -  (File not found | COM-object registry key not found)
{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler" - ? -  (File not found | COM-object registry key not found)
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
{E0D79304-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79305-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79306-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79307-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "WLMD Message Handler" - ? -  (File not found | COM-object registry key not found)
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{555D4D79-4BD2-4094-A395-CFC534424A05} "{555D4D79-4BD2-4094-A395-CFC534424A05}" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "{21FA44EF-376D-4D53-9B0F-8A89D3229068}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} "QuickTime Object" - "Apple Inc." - C:\Program Files\QuickTime\QTPlugin.ocx / hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "@C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Security Packages" - "Microsoft Corp." - C:\windows\system32\livessp.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"OpenOffice.org 3.3.lnk" - ? - C:\Program Files\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"APSDaemon" - "Apple Inc." - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"FILSHtray" - "FILSH Media GmbH" - "C:\Program Files\FILSHtray\FILSHtray.exe"
"Freecorder FLV Service" - "Applian Technologies, Inc." - "C:\Program Files\Freecorder\FLVSrvc.exe" /run
"HotKeyMon" - "ASUSTek Computer Inc." - AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
"HotkeyService" - "ASUSTek Computer Inc." - AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
"HP Software Update" - "Hewlett-Packard" - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"SuperHybridEngine" - "ASUSTek Computer Inc." - AsusSender.exe C:\Program Files\EeePC\SHE\SuperHybridEngine.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Asus Launcher Service" (AsusService) - ? - C:\Windows\System32\AsusService.exe  (File found, but it contains no detailed information)
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Bing Bar Update Service" (BBSvc) - "Microsoft Corporation." - C:\Program Files\Microsoft\BingBar\BBSvc.EXE
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\windows\system32\HPZinw12.dll
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\windows\system32\HPZipm12.dll
"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\BingBar\SeaPort.EXE
"Windows Live Family Safety Service" (fsssvc) - "Microsoft Corporation" - C:\Program Files\Windows Live\Family Safety\fsssvc.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"WindowsLive Local NSP" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
"WindowsLive NSP" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 26.05.2012 15:39
Warum postest du jetzt so einen Mischmasch..das eine Log in CODE-Tags, das andere angehangen, kannst du nicht beide in CODE-Tags posten :(

lena-laura 26.05.2012 15:47
weil ich dir noch mehr arbeit machen möchte...quatsch ;-)
die datei wurde als txt abgespeichert und das hat mich verwirrt und ich dachte ich tue dann gutes damit, dir es auch als txt zu schicken.
so jetzt hier in code tags ;-))
is ja keine böse absicht von mir.

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-26 15:50:47
-----------------------------
15:50:47.368    OS Version: Windows 6.1.7601 Service Pack 1
15:50:47.368    Number of processors: 2 586 0x1C02
15:50:47.378    ComputerName: PC  UserName:
15:50:50.122    Initialize success
15:51:11.142    AVAST engine defs: 12052501
15:54:16.092    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
15:54:16.104    Disk 0 Vendor: Hitachi_ PBBO Size: 152627MB BusType: 3
15:54:16.134    Disk 0 MBR read successfully
15:54:16.145    Disk 0 MBR scan
15:54:16.166    Disk 0 Windows 7 default MBR code
15:54:16.190    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        81920 MB offset 2048
15:54:16.239    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        60449 MB offset 167774208
15:54:16.276    Disk 0 Partition 3 00    1B  Hidd FAT32 MSDOS5.0    10240 MB offset 291573760
15:54:16.312    Disk 0 Partition 4 00    EF      EFI FAT    A1397      15 MB offset 312545280
15:54:16.344    Disk 0 scanning sectors +312576705
15:54:16.534    Disk 0 scanning C:\windows\system32\drivers
15:54:43.675    Service scanning
15:55:49.741    Modules scanning
15:56:10.286    Disk 0 trace - called modules:
15:56:10.380    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ndis.sys athr.sys iaStor.sys
15:56:10.411    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x853571c0]
15:56:10.458    3 CLASSPNP.SYS[8887d59e] -> nt!IofCallDriver -> [0x8495d388]
15:56:10.489    5 ACPI.sys[880c43d4] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x84552028]
15:56:11.753    AVAST engine scan C:\windows
15:56:17.509    AVAST engine scan C:\windows\system32
16:03:41.910    AVAST engine scan C:\windows\system32\drivers
16:04:13.846    AVAST engine scan C:\Users\lena-laura
16:08:57.134    AVAST engine scan C:\ProgramData
16:11:46.973    Scan finished successfully
16:32:11.372    Disk 0 MBR has been saved successfully to "C:\Users\lena-laura\Downloads\MBR.dat"
16:32:11.419    The log file has been saved successfully to "C:\Users\lena-laura\Downloads\aswMBR.txt"


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-26 15:50:47
-----------------------------
15:50:47.368    OS Version: Windows 6.1.7601 Service Pack 1
15:50:47.368    Number of processors: 2 586 0x1C02
15:50:47.378    ComputerName: PC  UserName:
15:50:50.122    Initialize success
15:51:11.142    AVAST engine defs: 12052501
15:54:16.092    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
15:54:16.104    Disk 0 Vendor: Hitachi_ PBBO Size: 152627MB BusType: 3
15:54:16.134    Disk 0 MBR read successfully
15:54:16.145    Disk 0 MBR scan
15:54:16.166    Disk 0 Windows 7 default MBR code
15:54:16.190    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        81920 MB offset 2048
15:54:16.239    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        60449 MB offset 167774208
15:54:16.276    Disk 0 Partition 3 00    1B  Hidd FAT32 MSDOS5.0    10240 MB offset 291573760
15:54:16.312    Disk 0 Partition 4 00    EF      EFI FAT    A1397      15 MB offset 312545280
15:54:16.344    Disk 0 scanning sectors +312576705
15:54:16.534    Disk 0 scanning C:\windows\system32\drivers
15:54:43.675    Service scanning
15:55:49.741    Modules scanning
15:56:10.286    Disk 0 trace - called modules:
15:56:10.380    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ndis.sys athr.sys iaStor.sys
15:56:10.411    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x853571c0]
15:56:10.458    3 CLASSPNP.SYS[8887d59e] -> nt!IofCallDriver -> [0x8495d388]
15:56:10.489    5 ACPI.sys[880c43d4] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x84552028]
15:56:11.753    AVAST engine scan C:\windows
15:56:17.509    AVAST engine scan C:\windows\system32
16:03:41.910    AVAST engine scan C:\windows\system32\drivers
16:04:13.846    AVAST engine scan C:\Users\lena-laura
16:08:57.134    AVAST engine scan C:\ProgramData
16:11:46.973    Scan finished successfully
16:32:11.372    Disk 0 MBR has been saved successfully to "C:\Users\lena-laura\Downloads\MBR.dat"
16:32:11.419    The log file has been saved successfully to "C:\Users\lena-laura\Downloads\aswMBR.txt"
16:33:42.947    Disk 0 MBR has been saved successfully to "C:\Users\lena-laura\Downloads\MBR.dat"
16:33:42.994    The log file has been saved successfully to "C:\Users\lena-laura\Downloads\aswMBR.txt"

cosinus 28.05.2012 14:20
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

lena-laura 28.05.2012 23:39
hallo arne,

hier nun das malware log...eben hat mir avira wieder ne meldung spy.banker angezeigt....mal schauen was beim nächsten scan rauskommt...

Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.24.03

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
lena-laura :: PC [Administrator]

28.05.2012 19:56:38
mbam-log-2012-05-28 (19-56-38).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 366327
Laufzeit: 4 Stunde(n), 38 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F99BD4F5-D402-4c21-A8BC-510830B6BE37} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 05/29/2012 at 04:52 AM

Application Version : 5.0.1150

Core Rules Database Version : 8650
Trace Rules Database Version: 6462

Scan type      : Complete Scan
Total Scan Time : 04:04:43

Operating System Information
Windows 7 Starter 32-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 719
Memory threats detected  : 0
Registry items scanned    : 34411
Registry threats detected : 0
File items scanned        : 189682
File threats detected    : 443

Adware.Tracking Cookie
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\U240WDBV.txt [ /imrworldwide.com ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\H2H70QGC.txt [ /tracking.quisma.com ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\V5G0H6M4.txt [ /ad.yieldmanager.com ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\SEHNPAD4.txt [ /eas.apm.emediate.eu ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\FO8KNPUC.txt [ /atdmt.com ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\2WOTGETI.txt [ /invitemedia.com ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\Y480PM31.txt [ /serving-sys.com ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\HJ1A90OO.txt [ /doubleclick.net ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\IU7SUN4C.txt [ /adfarm1.adition.com ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\XG42SR29.txt [ /track.adform.net ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\KOF1G98C.txt [ /apmebf.com ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\FO6FQJ8F.txt [ /bs.serving-sys.com ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\Z3QVZVB2.txt [ /zanox.com ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\DWUQM3X3.txt [ /c.atdmt.com ]
        C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Cookies\PMEQJAC9.txt [ /adform.net ]
        C:\USERS\LENA-LAURA\Cookies\U240WDBV.txt [ Cookie:lena-laura@imrworldwide.com/cgi-bin ]
        C:\USERS\LENA-LAURA\Cookies\SEHNPAD4.txt [ Cookie:lena-laura@eas.apm.emediate.eu/ ]
        C:\USERS\LENA-LAURA\Cookies\FO8KNPUC.txt [ Cookie:lena-laura@atdmt.com/ ]
        C:\USERS\LENA-LAURA\Cookies\HJ1A90OO.txt [ Cookie:lena-laura@doubleclick.net/ ]
        C:\USERS\LENA-LAURA\Cookies\KOF1G98C.txt [ Cookie:lena-laura@apmebf.com/ ]
        C:\USERS\LENA-LAURA\Cookies\FO6FQJ8F.txt [ Cookie:lena-laura@bs.serving-sys.com/ ]
        C:\USERS\LENA-LAURA\Cookies\Z3QVZVB2.txt [ Cookie:lena-laura@zanox.com/ ]
        C:\USERS\LENA-LAURA\Cookies\DWUQM3X3.txt [ Cookie:lena-laura@c.atdmt.com/ ]
        C:\USERS\LENA-LAURA\Cookies\PMEQJAC9.txt [ Cookie:lena-laura@adform.net/ ]
        .hiddencounter.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        7.rotator.wigetmedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        adserver.adreactor.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .urbia.wwe-media.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        conversion.buddymedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .buddymedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        kursnet-finden.arbeitsagentur.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .travel.mediamatic.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        s2.netxmedia.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        adserver.gb5.motorpresse.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        tracking.dc-storm.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        tracking.dc-storm.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .linksynergy.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .linksynergy.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .linksynergy.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .toplist.cz [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .pornoxo.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .pornoxo.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.pornoxo.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .parispornmovies.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .parispornmovies.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .freeporn.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .freeporn.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .riverisland.122.2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .bwincom.122.2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .uk.at.atwola.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        supremeadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        supremeadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .pagetrackr.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .pagetrackr.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .getclicky.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .static.getclicky.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        adserver.exploretalent.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        in.getclicky.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        count.asnetworks.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .ipcmedia.122.2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .guj.122.2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .gostats.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .technoratimedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .technoratimedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adserver.adtechus.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wnmysld5kfq.stats.esomniture.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        s09.flagcounter.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        tracking.sim-technik.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .ar.atwola.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .myroitracking.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        server.adformdsp.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        adserver.w3anythink.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        adserver.w3anythink.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        7.rotator.wigetmedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .legolas-media.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .harrenmedianetwork.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .realmedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .realmedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .yieldmanager.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        stat.easydate.biz [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        stat.ed.cupidplc.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .deutschepostag.112.2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adxpose.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.usenext.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tracking.mindshare.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        adserver.advertisingbox.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .opodo.122.2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.dyntracker.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        tracking.s24.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wfl4omdpaap.stats.esomniture.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        server.adformdsp.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adformdsp.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        thewrap.rotator.hadj7.adjuggler.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        thewrap.rotator.hadj7.adjuggler.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        media.gan-online.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        banner.testberichte.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        supremeadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .cmpmedica.112.2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        adserver2.vinogusto.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .secmedia.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .secmedia.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        partners.webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .www.multicounter.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        srv.clickfuse.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        srv.clickfuse.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        srv.clickfuse.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        adserver1.mokono.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        tomtailor.dyntracker.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .verticaltechmedia.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.dyntracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .microsoftsto.112.2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.dyntracker.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ads.247activemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .gostats.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        media.gan-online.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.dyntracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ads1.moonchildmedia.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        counter2.sexmoney.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .quartermedia.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .quartermedia.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .discount24.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .discount24.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .discount24.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tripod.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tripod.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tripod.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tripod.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .tripod.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]
        www.blogcounter.de [ C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\COOKIES.SQLITE ]

cosinus 29.05.2012 09:15
Wird der immer wieder gefunden oder ist der jetzt weg?

lena-laura 29.05.2012 14:43
hey arne,

ich lass grad nochmal malware durchlaufen. bis jetzt siehts gut aus.
nur was ich mich grad frage ist, wenn ein virus in quarantäne verschoben wurde, dann ist er doch eigentlich immer noch da.
soll ich dir mal das log von avira mitposten oder ist das irrelevant?
desweiteren habe ich 2 mails erhalten...denke das ist der verschlüsselungstrojaner...hab sie nicht geöffnet bzw den anhang nicht geöffnet...soll ich das ganze dann mal an marcus (wie beschrieben) weiterschicken?

lieben gruß
lena-laura

cosinus 30.05.2012 08:01
Zitat:
nur was ich mich grad frage ist, wenn ein virus in quarantäne verschoben wurde, dann ist er doch eigentlich immer noch da.
Diese Denke kommt weil du dir nicht im Klaren bist was Quarantäne bedeutet. Vllt kennt man den aus dem medizinischen bzw. Krankenhausbereich => Quarantäne

Überleg doch mal was eine Quarantäne ist. Ob da die schädliche Datei drinbleibt oder nicht, das hat keine Auswirkungen. Schädlinge in der Quarantäne können nichts mehr anrichten, sie sind dort isoliert. Du solltest grundsätzlich mit der Quarantäne arbeiten, denn falls der Virenscanner durch einen Fehlalarm was wichtiges löscht, kannst Du notfalls noch über die Quarantäne an die Datei ran.

lena-laura 31.05.2012 20:41
hallo arne,

hab jetzt nochmal nen scan mit malware durchlaufen lassen. sah sauber aus.
hab ganz ganz lieben dank für dein hilfe!!!!!!!!!!! :dankeschoen:

bis bestimmt irgendwann mal wieder ;-)

lieben gruß

lena-laura

cosinus 31.05.2012 21:22
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:33 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132