Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Webseiten von Microsoft, Avira etc. nicht mehr aufrufbar (https://www.trojaner-board.de/115951-webseiten-microsoft-avira-etc-mehr-aufrufbar.html)

dennis8 29.05.2012 17:16
Webseiten von Microsoft, Avira etc. nicht mehr aufrufbar
 
Hallo,

ich kann Webseiten von microsoft, avira etc. nicht mehr aufrufen. Werde entweder auf die google Startseite oder eine google Fehlerseite (404) geleitet.
Die Vermutung liegt also nahe, dass ich eine Schadsoftware drauf habe. Ansonsten habe ich bisher keine Veränderungen festgestellt.
Scan mit AntiVir bringt keine Lösung.

Kenne mich da nicht so mit aus, aber vielleicht könnt ihr aus den OTL Ergebnissen etwas lesen.


OTL.txt
OTL Logfile:
Code:
OTL logfile created on: 29.05.2012 17:40:58 - Run 1
OTL by OldTimer - Version 3.2.44.0    Folder = C:\Users\xx\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 66,73% Memory free
5,99 Gb Paging File | 4,83 Gb Available in Paging File | 80,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,71 Gb Total Space | 325,92 Gb Free Space | 71,52% Space Free | Partition Type: NTFS
Drive D: | 10,00 Gb Total Space | 9,92 Gb Free Space | 99,23% Space Free | Partition Type: NTFS
Drive F: | 4,11 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: PC | User Name:  | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.05.29 17:39:44 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\xx\Desktop\OTL.exe
PRC - [2012.05.28 15:06:18 | 000,867,080 | ---- | M] (Acresso Software Inc.) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
PRC - [2011.09.29 16:19:26 | 000,020,880 | ---- | M] () -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
PRC - [2011.09.29 16:19:16 | 003,508,112 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Kies\KiesTrayAgent.exe
PRC - [2011.08.07 19:19:05 | 000,240,288 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil10t_ActiveX.exe
PRC - [2011.07.07 08:16:04 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.03.28 21:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 21:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2011.03.28 16:15:17 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.28 16:14:56 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 23:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 23:29:19 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.09.15 11:11:22 | 000,339,312 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Programme\Common Files\Lexware\Update Manager\LxUpdateManager.exe
PRC - [2010.06.17 21:56:44 | 000,370,176 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe
PRC - [2010.05.11 06:06:40 | 001,885,512 | ---- | M] (Sanford, L.P.) -- C:\Programme\DYMO\DYMO Label Software\DymoQuickPrint.exe
PRC - [2010.05.11 05:53:16 | 000,055,808 | ---- | M] (Sanford, L.P.) -- C:\Programme\DYMO\DYMO Label Software\DLSService.exe
PRC - [2010.04.23 16:20:36 | 001,670,144 | ---- | M] (ESRI) -- C:\Programme\ArcGIS\License10.0\bin\ARCGIS.exe
PRC - [2009.08.18 03:36:36 | 000,348,160 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009.08.18 03:36:08 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2008.11.06 00:59:50 | 001,500,424 | ---- | M] (Acresso Software Inc.) -- C:\Programme\ArcGIS\License10.0\bin\lmgrd.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.12 10:55:10 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\0c2b0d52156447592f33edf4116b7e7d\System.Management.ni.dll
MOD - [2012.05.12 10:53:45 | 000,762,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\65f0d70169a0e73b45307dddbd86f92b\System.Runtime.Remoting.ni.dll
MOD - [2012.05.12 10:53:38 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d234eceae699d070b5a5712ce776c01f\System.Xaml.ni.dll
MOD - [2012.05.11 20:35:34 | 018,000,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\041b1bcf6ae9ab58925791d8198c37e2\PresentationFramework.ni.dll
MOD - [2012.05.11 20:35:19 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\a1de74c8d0dfd15e3246e5dd394013bf\PresentationCore.ni.dll
MOD - [2012.05.11 20:35:10 | 003,858,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4b7adff986a085bb562222d0c5fdf5aa\WindowsBase.ni.dll
MOD - [2012.05.11 20:35:08 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a5fa2a1cfc6e9fdc39d9a8f2baa57bc9\PresentationFramework.Aero.ni.dll
MOD - [2012.05.11 20:32:54 | 013,197,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\9ee9841d9e33fe5dceba4cd7d90f2ae0\System.Windows.Forms.ni.dll
MOD - [2012.05.11 20:32:51 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll
MOD - [2012.05.11 20:32:48 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll
MOD - [2012.05.11 20:32:45 | 001,665,536 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\03b5233f1511f5fdb39eb681b04e5506\System.Drawing.ni.dll
MOD - [2012.05.11 20:32:43 | 009,091,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll
MOD - [2012.05.11 20:32:37 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll
MOD - [2012.02.15 17:04:18 | 000,593,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\a717cdb44ec0d3238c621efa420a9956\System.Messaging.ni.dll
MOD - [2012.02.15 14:25:10 | 002,297,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\f01c5c76d0a19516a37b7bd191a02cda\System.Core.ni.dll
MOD - [2012.02.15 14:24:56 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\42ae8760f0a74ab774e82a64368aa1f6\System.Web.ni.dll
MOD - [2012.02.15 14:24:38 | 014,339,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\02f7846cbc5c02a5dbf50fd34325eb61\PresentationFramework.ni.dll
MOD - [2012.02.15 14:24:22 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll
MOD - [2012.02.15 14:24:14 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll
MOD - [2012.02.15 14:24:11 | 012,234,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\f4b2424c1b32fbd11130482bb899b7ae\PresentationCore.ni.dll
MOD - [2012.02.15 14:24:00 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\47b9e7f070271ff50f988f75ea68fa3e\WindowsBase.ni.dll
MOD - [2012.02.15 14:23:55 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll
MOD - [2012.02.15 14:23:51 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll
MOD - [2012.02.15 14:23:50 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll
MOD - [2011.12.30 20:15:03 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2011.12.29 18:20:24 | 000,115,137 | ---- | M] () -- C:\Users\xx\AppData\Local\Temp\ae201572-4813-4010-9ed2-ee29ddec066a\CliSecureRT.dll
MOD - [2011.09.29 16:19:26 | 000,020,880 | ---- | M] () -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.11.13 01:19:04 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.05.11 05:52:30 | 000,094,208 | ---- | M] () -- C:\Programme\DYMO\DYMO Label Software\DYMO.Common.dll
MOD - [2006.12.10 21:51:08 | 000,077,824 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmltok.dll
MOD - [2006.12.10 21:51:08 | 000,065,536 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmlparse.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2012.05.28 15:06:18 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Running] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.07.07 08:16:04 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.03.28 21:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.11.20 23:29:48 | 000,128,848 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2010.11.20 23:29:32 | 000,068,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\Mcx2Svc.dll -- (Mcx2Svc)
SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009.08.18 03:36:08 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\mprdim.dll -- (RemoteAccess)
SRV - [2009.07.14 03:15:33 | 000,300,544 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\ipnathlp.dll -- (SharedAccess)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.06 00:59:50 | 001,500,424 | ---- | M] (Acresso Software Inc.) [Auto | Running] -- C:\Programme\ArcGIS\License10.0\bin\lmgrd.exe -- (ArcGIS License Manager)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.07.07 08:16:04 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.07 08:16:04 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.11.20 23:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 23:29:12 | 000,246,784 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\udfs.sys -- (udfs)
DRV - [2010.11.20 23:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 23:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dmvsc.sys -- (dmvsc)
DRV - [2010.11.20 23:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 23:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 23:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2010.11.20 23:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 23:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.08.18 04:48:06 | 004,994,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.07.14 03:20:28 | 000,022,096 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\crcdisk.sys -- (crcdisk)
DRV - [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ws2ifsl.sys -- (ws2ifsl)
DRV - [2009.07.14 00:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {2279C29F-823D-4444-815A-CF161E9B6251}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{2279C29F-823D-4444-815A-CF161E9B6251}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.30 17:57:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.05.01 10:08:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xx\AppData\Roaming\mozilla\Extensions
[2012.05.02 12:56:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions
[2012.03.29 20:13:09 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\xx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.05.24 16:34:49 | 000,000,950 | ---- | M] () -- C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\ft2iwcdl.default\searchplugins\icqplugin-1.xml
[2011.11.06 12:45:18 | 000,001,056 | ---- | M] () -- C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\ft2iwcdl.default\searchplugins\icqplugin.xml
[2012.01.09 11:55:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.30 08:26:17 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (ICQ Sparberater) - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - C:\Programme\icq\Internet Explorer\icq.dll (solute gmbh)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DLSService] C:\Program Files\DYMO\DYMO Label Software\DLSService.exe (Sanford, L.P.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - HKCU..\Run: [Cixyi] C:\Users\xx\AppData\Roaming\Xoyz\olow.exe (Asus)
O4 - HKCU..\Run: [DymoQuickPrint] C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe (Sanford, L.P.)
O4 - HKCU..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5759352-0A3C-4DF4-B67E-99428EFF0E84}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009.12.04 19:52:28 | 000,000,041 | R--- | M] () - F:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{9aba0abc-3230-11e1-b5d3-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{9aba0abc-3230-11e1-b5d3-806e6f6e6963}\Shell\AutoRun\command - "" = F:\ESRI.exe -- [2010.08.27 02:37:17 | 005,403,032 | R--- | M] (ESRI)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.29 17:39:44 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\xx\Desktop\OTL.exe
[2012.05.29 17:19:43 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{D658E1F5-8797-4EC4-BB0C-99C2D7DD1602}
[2012.05.29 17:19:21 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{AA231AA0-461A-42F5-AC79-F8AA71522E47}
[2012.05.28 21:27:54 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{07F2B0D4-2A42-445E-89C6-A6C6D506DE84}
[2012.05.28 21:27:33 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{C5629840-B195-415E-93F7-5B6EDF0F7472}
[2012.05.28 19:23:50 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{00343808-B43E-4FDF-8ABB-EA139981E271}
[2012.05.28 19:23:28 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{9B64C16F-7202-473A-B752-F4F2FAB9604F}
[2012.05.28 18:06:58 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{60A3A18D-70D4-45A1-942D-1B4AEFE4AD90}
[2012.05.28 18:06:37 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{4C0D9836-7A22-43D5-98A7-D48EDD5C220A}
[2012.05.28 16:39:16 | 000,000,000 | ---D | C] -- C:\Users\x\AppData\Local\{A466910F-A396-4E96-A407-5D79E6F6A32D}
[2012.05.28 16:38:54 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9CC06A2B-6EE2-4F7C-9769-35013BC140D9}
[2012.05.28 15:06:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Macrovision
[2012.05.28 15:06:29 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2012.05.28 15:06:18 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Macrovision Shared
[2012.05.28 15:06:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS
[2012.05.28 15:06:04 | 000,000,000 | ---D | C] -- C:\Program Files\ArcGIS
[2012.05.28 14:56:53 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C2893615-A733-4A5D-ACA6-E232C27EC629}
[2012.05.28 14:27:10 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0A92EDC7-577C-4C6C-BC9F-AC8BB71C824C}
[2012.05.28 14:26:46 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{BCB4E447-9936-4C1E-ADE9-B4037BAFF057}
[2012.05.28 11:46:13 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{60A4B995-9CBD-4557-B94C-EF12AD74C514}
[2012.05.28 11:45:51 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{742DB147-F5C4-4343-BE2E-CC8BE54003A2}
[2012.05.28 09:33:22 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{E27A8F2E-58A4-4CAA-AF5A-0C5F187A6A38}
[2012.05.28 09:33:01 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{93D8BFA6-314C-4E34-ACB2-1AABCDF0045B}
[2012.05.27 13:32:00 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F2BB5EC1-2DF6-479E-90DC-9BD0A82EC8C4}
[2012.05.27 13:31:39 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A7323F44-DC1F-4B70-BEA8-13383F129BF0}
[2012.05.27 12:25:18 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{40D01E2C-8FD5-4A74-A578-0E334774B93C}
[2012.05.27 12:24:57 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3E76BDB9-3830-4457-BA64-F2EEB8CD4F90}
[2012.05.27 09:31:26 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{08713810-3D9F-4A88-9F35-1BDD1051B8F1}
[2012.05.27 09:31:05 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{8645FB2B-0576-4819-90D9-697F3C40E25B}
[2012.05.27 08:06:44 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{298615DD-D5BC-493D-8CB2-CB82C97C072F}
[2012.05.27 08:06:22 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{497FA8D0-6319-429C-A945-3B2688E82840}
[2012.05.26 23:21:30 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C72D7920-63D0-4D44-A550-C1EFBA4AF678}
[2012.05.26 23:21:09 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A360A2E4-CC63-4692-A71C-3FF661A3A59F}
[2012.05.26 23:18:17 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{8F4A5933-DAAF-40B0-9E1E-AB605CF887C2}
[2012.05.26 22:27:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Roaming\Xoyz
[2012.05.26 22:27:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Roaming\Xosaax
[2012.05.26 22:27:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Roaming\Hepou
[2012.05.26 17:53:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{FFCD3756-4629-47D6-BFF5-5A170CFFB1CA}
[2012.05.26 17:53:33 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{27336804-5A83-43AC-81C3-32C5CEE32017}
[2012.05.26 08:17:35 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2EE7A628-23D2-414C-8DD1-AFCAC7D6FA5D}
[2012.05.26 08:17:24 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6A5BCAA0-C426-45A3-9B15-A8C44404A808}
[2012.05.25 20:53:05 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0212FF09-A0C0-4ECD-A468-9110CFE6725E}
[2012.05.25 20:52:43 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{BF670025-0425-4642-A295-D86D54D2C513}
[2012.05.25 20:22:45 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D10CE2B9-B337-45E1-9CB3-8DB6F4A69899}
[2012.05.25 20:22:35 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0902F138-D908-4BA6-B33E-03AD914688AF}
[2012.05.25 20:01:18 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B9C93B3D-D966-4E3E-B29D-5A548DD1BB0D}
[2012.05.25 20:00:57 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{991697C6-980C-4C93-AA83-1B389BE88F91}
[2012.05.25 18:54:32 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{FBFCCF18-255C-4230-9E4C-0C9A848F2E74}
[2012.05.25 18:54:11 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9D186EBA-944A-49D6-A9BC-68680FC00CE9}
[2012.05.25 18:28:25 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{36FD2A69-1B65-466E-B9CA-4371A77DBAB7}
[2012.05.25 18:28:03 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{30D82AA4-E94E-4AF7-899E-FBA93112FA87}
[2012.05.25 18:20:24 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{661C5169-CE36-4504-91C0-A1454A4E435D}
[2012.05.25 18:20:03 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D19FF07F-33B7-47CC-906A-8A4A6144BBDE}
[2012.05.25 18:14:07 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{005694A0-279A-49FE-976D-62B20C1896E7}
[2012.05.25 18:13:44 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{8E13B2F4-58B0-4F84-9119-A1511D79B306}
[2012.05.25 17:36:37 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D27F983F-334E-497C-BC95-059A896624CC}
[2012.05.25 17:36:15 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{02EE096A-3A16-4FDB-9BE0-A93DE98B3543}
[2012.05.25 17:15:48 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6B41EA12-2D5C-45D2-8C56-2D98784C43DD}
[2012.05.25 17:15:26 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2F88112A-BDBC-47B5-9943-168FEE9FC28A}
[2012.05.25 15:04:28 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{BA2C61DA-E263-4BDF-AEBC-FA6AE7125492}
[2012.05.25 15:04:07 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C90C043B-207B-4701-85C3-C3B99367A4C0}
[2012.05.25 14:53:01 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{80AE2BD3-C9F1-42D1-8E90-BCBBAF399F03}
[2012.05.25 14:52:39 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0CDC75E3-09A3-4338-B5CA-D067661946A8}
[2012.05.25 14:40:08 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{4336CBBF-1F93-45F4-AAB8-424572EDB844}
[2012.05.25 14:21:26 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C0D44067-34E0-4C16-8313-84869C33B2BA}
[2012.05.25 14:21:05 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{1A712885-A1A4-4A08-9FC4-7069359768CB}
[2012.05.25 13:41:27 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{66D49911-84EE-4FCC-80F7-C931F5E07D37}
[2012.05.25 13:41:06 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6F3A567F-CCDE-48A0-A3C1-C13AFFE3FDB8}
[2012.05.25 13:28:20 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{4BB2EF86-55F7-4472-B062-D9175200C633}
[2012.05.25 13:27:57 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{44227E19-32EF-4E95-A6E6-86CE232C10D7}
[2012.05.25 11:25:21 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6072DCFA-9723-4A65-973F-1B9FCDA63124}
[2012.05.25 11:25:00 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{FD950060-AD4E-445F-8719-795B73DDD1DB}
[2012.05.25 10:50:35 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B57D63CA-4B55-42D5-BD23-EAA1793CDBAE}
[2012.05.25 10:50:14 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{79E392EE-9CB1-4145-88DA-488ED6C3B9E5}
[2012.05.25 10:41:41 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D61537C7-748E-4253-9BAB-D558B9CACDF7}
[2012.05.25 10:13:47 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2DA1F4CF-60B8-4A21-9ECA-43AE78B58F34}
[2012.05.25 10:13:26 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9633F56D-8A9F-4AB5-A1C7-900C06F8E223}
[2012.05.25 09:04:52 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2CD74460-0169-4C4F-93BA-8054E880654C}
[2012.05.25 09:04:30 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{5F422A0A-7077-4FE1-8075-F8BC710BEE20}
[2012.05.24 21:15:16 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3D51B460-9A23-4E73-AD69-589D4626996A}
[2012.05.24 21:15:05 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{12E8F401-A437-4A61-8BDA-D5739D0282ED}
[2012.05.24 17:51:27 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{1A6CF54A-1DA7-431B-9AAE-1AB1D51D7BA6}
[2012.05.24 17:51:17 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C3E01E22-024B-42AA-AA52-75C7B8372DF0}
[2012.05.24 16:33:15 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F45A194D-EB75-4760-9DB6-B63145077EBB}
[2012.05.24 16:32:55 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{92C60E8E-3A1B-4DB2-84D8-69F47DD3B1A0}
[2012.05.15 08:17:20 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D0954CB4-37AE-472D-A5B4-C9E439C69AF3}
[2012.05.15 08:16:59 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{5D91AEDB-7660-4BF1-BAF1-9B4CD0DDF35E}
[2012.05.15 07:47:28 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{4B7BE732-4192-4A7A-9458-D31D55AF1E12}
[2012.05.15 07:47:07 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{48E98118-8B2F-4165-AA48-7C6C97E88530}
[2012.05.14 23:38:34 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{251A22EB-D166-4D5D-83FE-25E3610794B3}
[2012.05.14 23:38:11 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{170A0DB5-E29E-4876-923C-D3AC2A845D48}
[2012.05.14 21:49:53 | 000,000,000 | ---D | C] -- C:\Users\xx\Desktop\foto
[2012.05.14 19:14:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F2106E34-EF5E-41F6-A465-95AF095F8326}
[2012.05.14 19:14:35 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{980F52DF-29B1-4D9F-BB0C-CDE9293B46AB}
[2012.05.14 17:34:12 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{403769FC-DB4A-47CF-A76D-3A3F7DEF03F2}
[2012.05.14 17:33:50 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{59935BE2-0D72-4FA2-9979-D3816613771F}
[2012.05.14 15:13:21 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{99C23DCB-5137-4C21-82D0-87EFA1EDCE86}
[2012.05.14 15:13:00 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{FC79BC1D-4B90-41C0-B364-0FC27F1EE0D0}
[2012.05.14 13:18:50 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{DF4FF6A1-40AE-48D4-912F-1E96D5F8AF09}
[2012.05.14 13:18:29 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F78FABA6-39FC-4975-88C1-69B283F7DBF2}
[2012.05.14 13:10:27 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{45B84C9B-5721-46AF-BC0D-86D98F9C9CD8}
[2012.05.14 13:10:06 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{CC8ABC48-0BDD-47DB-AE56-E538946DA09F}
[2012.05.14 10:58:53 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9446AD88-5D0B-451B-A05E-4D10B0E4CDCA}
[2012.05.14 10:58:31 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{41E7FBDE-067E-4B63-B1C9-5A4125FCF8AD}
[2012.05.14 08:36:39 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{8B13BDB3-C698-43D7-8652-85C67F47FCAA}
[2012.05.14 08:36:16 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B062D5CD-82F9-43A6-8768-E782CE348249}
[2012.05.13 18:53:27 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D5353F02-D786-4EAF-804E-E8FAD1597E57}
[2012.05.13 18:53:05 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{03AADE15-E763-4587-AC15-390CF6E3B8D8}
[2012.05.13 17:11:27 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{294CABAC-7487-4F8B-8651-60E287963CE5}
[2012.05.13 12:12:24 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0F59A9D5-C817-4D25-B6E5-5D59CEE61B79}
[2012.05.13 12:12:00 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{16715EA2-2E4E-44B5-B360-F7F63472FB80}
[2012.05.13 10:32:17 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{FDBB505A-A4B1-46C0-A348-93CF9E1D7ED4}
[2012.05.13 10:31:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9E02B95A-658F-4869-9518-B44A23339039}
[2012.05.13 09:41:57 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0F58300E-F15D-4A14-BEDE-331DF02BF81D}
[2012.05.13 09:41:35 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D59414A1-08DC-4BF3-A2CA-480A2384EE9A}
[2012.05.12 20:00:30 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{7037CA83-CB45-41AB-99F2-63702BC94DCC}
[2012.05.12 20:00:08 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{77B3F4C8-C0F6-4DAF-A6ED-5986C851AB8F}
[2012.05.12 19:32:04 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{101DE2CB-3367-4432-96B2-9521156E4369}
[2012.05.12 19:31:43 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A7A94A89-0437-4E88-869E-C638F2E35CB5}
[2012.05.12 16:49:55 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0D36C219-509F-46D9-9342-2628DA79D09C}
[2012.05.12 16:49:33 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6FCFFA4F-D50A-49C8-8DA4-4E8DD4A9F5AF}
[2012.05.12 15:07:49 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{EDF750BF-1DDF-4572-8A69-612F63F83F9D}
[2012.05.12 15:07:39 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{8603F018-6FB5-4A47-AFEB-BF8386DB0349}
[2012.05.12 12:00:02 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{80929EA8-30FE-46FF-981D-4315D7C586E4}
[2012.05.12 11:59:41 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2B99FF08-7BF7-48A9-A400-2A041BD9CB8E}
[2012.05.12 11:52:08 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{8C3C472F-80DE-4C43-BBB1-D3B4D1A64FAE}
[2012.05.12 10:19:25 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C839D9AC-27D7-40AD-92CC-5CFE4B0B8CFF}
[2012.05.12 10:19:03 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{241CE05E-4B76-4046-A602-7767ECE3E770}
[2012.05.11 19:14:38 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F17E0A7E-2E16-4C1E-AFCC-7BFDE120A4EC}
[2012.05.11 19:14:17 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{459DCCE8-527C-4C81-9B1F-5BFA73AF7007}
[2012.05.11 15:53:49 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2348FE0D-6ABC-46B1-BE73-D77BFD1646B9}
[2012.05.11 15:53:28 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0E63C6AB-CBDF-4136-BE63-3D48FBF29AC2}
[2012.05.11 15:15:28 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A162A7AC-72F9-4FF3-99B8-D5301D934BAF}
[2012.05.11 15:15:06 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C343F827-5C7C-40D2-92B7-6C496E736B86}
[2012.05.11 14:30:39 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{DCB0EC85-1F7F-46A2-BE7D-1B0B627C4164}
[2012.05.11 14:30:17 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3913FE54-E832-47BA-BDE8-F1F6198C6BA8}
[2012.05.11 13:33:26 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3164D095-720D-4DAF-8FA7-A8A16220ECC7}
[2012.05.11 13:33:04 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{1ECEA121-FF7D-4036-B850-BB0D4931D87C}
[2012.05.11 13:17:59 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{75B2FDD6-8DFD-4974-B7CC-20A7BB3F6D2F}
[2012.05.11 11:34:32 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{7450978E-9E5D-4E72-95C7-69998C51895D}
[2012.05.11 11:14:09 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{36815B47-A848-4FF9-B1C2-3672A06D31CD}
[2012.05.11 11:13:58 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3AC47F3B-568A-4DFD-A8E5-3F12FC12FAAE}
[2012.05.11 10:24:16 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{1ABE7749-4367-4733-8D7C-76A9B867E100}
[2012.05.11 10:18:49 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{1F8AD832-18C3-4E86-87E0-5836E213F0DA}
[2012.05.11 10:00:01 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{E075EA29-2EAD-4B58-8C4B-C63CC0F73C27}
[2012.05.11 08:50:53 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{4519251C-E854-492B-9DA3-5B50BE0A7A90}
[2012.05.11 08:50:31 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0976E110-010A-440F-AA14-D0D6BF1A183E}
[2012.05.10 20:38:03 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{43185240-A453-45F6-90FD-4B08889F8382}
[2012.05.10 19:41:20 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9E8EA6A8-A810-45FD-BBA5-88CF75CA6FF3}
[2012.05.10 18:03:51 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{78A68F4A-A060-42BA-AA9A-42A3D542E181}
[2012.05.10 18:03:30 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{E205E88E-A9B1-48AE-A26E-E21ABA059612}
[2012.05.10 15:03:06 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{49317E5E-DCF0-49CE-AEDD-909CBDEEB263}
[2012.05.10 15:02:45 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{8B3557C5-9ED4-4D54-8346-D5F517975885}
[2012.05.10 13:38:18 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C5892683-DE14-4BA5-8CAA-926D9C672EB4}
[2012.05.10 13:37:55 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{850C4E53-E044-4AC0-837E-7B3C56B1DDAF}
[2012.05.10 11:47:12 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{586C6FEF-68A7-438A-9388-C8EDBA175BC9}
[2012.05.10 11:46:50 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{4D1FD077-FAB9-4EA8-8E1D-D77CA2C3519A}
[2012.05.10 11:28:23 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{76EE74E7-0C94-4423-A8C1-779090EF002E}
[2012.05.10 11:05:10 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{231F5D8F-AC09-474F-861D-C9721973B2B9}
[2012.05.10 11:04:49 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{1C912D5D-C410-4E9E-BF84-A38EFC4FC697}
[2012.05.10 10:25:03 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A79CFEBB-E594-4C7F-A8DF-28104F25D190}
[2012.05.10 10:24:41 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3CDB9613-2ED2-457B-95C3-6F6C2A426A18}
[2012.05.10 10:05:53 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{7C322F5A-D160-41AE-9F19-BCA8A09FEC3B}
[2012.05.10 08:14:52 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{5068AC62-14F7-49C7-ACA0-045BABF36B59}
[2012.05.10 08:14:33 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9FA1E644-8E0B-47BA-97A3-819DA11567EB}
[2012.05.09 17:38:20 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9399DC5D-ACC8-4570-85A5-E63F7F592978}
[2012.05.09 17:37:58 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{23D8BE80-7976-4699-B312-965E1852CE3A}
[2012.05.09 16:34:40 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{FE2E0C8E-3E77-4792-80BF-1B64D95F47A7}
[2012.05.09 16:34:29 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{4F68CBEE-7284-4FF2-A23C-371C40D75EF7}
[2012.05.09 12:10:18 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{ED7311A3-6091-4119-9C4A-7B5278BC73DF}
[2012.05.09 12:09:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{77CC069A-9268-453C-853D-A1BD64D782F5}
[2012.05.09 11:02:09 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{EAC449A8-3F96-45DB-BD51-8F9316993E94}
[2012.05.09 11:01:47 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{BCCB81D1-FE74-4273-8F84-8A128C62C7D3}
[2012.05.09 09:16:03 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{852EF71B-D4CB-490E-A398-9AC750D73EE2}
[2012.05.09 09:15:41 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{8EE4F4D1-B87B-42C9-A923-0F3D0D263DCA}
[2012.05.08 22:29:52 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2F52BC99-3040-410A-AB17-092F3788299D}
[2012.05.08 22:16:15 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{88E6049F-2E09-4D15-B734-823C953488B8}
[2012.05.08 22:15:53 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{BBBF19CC-45BA-43A8-A64E-1675DEB054D7}
[2012.05.08 21:26:22 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A9A2CF99-92EB-4D8A-9988-158064198CB0}
[2012.05.08 21:25:59 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D0DA44AC-6F8C-48F0-9F24-EC77B3764313}
[2012.05.08 17:22:42 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2DCF3A5E-8EDF-498D-9F73-45CA9A419502}
[2012.05.08 17:22:19 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{15BC3C1A-06B1-42C8-A204-CD4CE2E5FD3D}
[2012.05.08 15:41:34 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3016AFF8-9B61-4A5B-8956-85F36167D4DB}
[2012.05.08 15:41:12 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A1A5ED68-B4FA-436A-848A-DD9ACF136F5F}
[2012.05.08 13:45:22 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{8340721D-2DB6-4026-B65C-A72D80CE9C7D}
[2012.05.08 13:45:01 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{4CE3BD25-9283-4E79-A362-DECC99447F3F}
[2012.05.08 13:11:53 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{32D0909F-58D2-4D70-8A7D-A87C7535F615}
[2012.05.08 13:11:30 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{595FFE8E-DD21-43AD-8833-EBE63AF1B9D2}
[2012.05.08 10:22:37 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3ED05CB1-BED6-42B2-9E4D-0C5EC6ED92F4}
[2012.05.08 10:22:15 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F4AD339B-C8C8-4A10-8EEE-492571B363DC}
[2012.05.07 21:27:47 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F88EDD84-38EB-4873-A625-ADBFBB213346}
[2012.05.07 21:00:39 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C5EB7A82-9118-4B7E-9342-7C9339AF5733}
[2012.05.07 21:00:29 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A1DC0383-46F8-4FB1-892E-FD74ACB44B71}
[2012.05.07 19:59:48 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{7BD1E531-3646-4BB7-991A-72A5C823594F}
[2012.05.07 19:59:24 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{42E9B44B-094D-4E47-AA1F-1C776A19CE74}
[2012.05.07 15:03:58 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2F192615-9F2F-4D2D-9BFF-FCBAE74642E7}
[2012.05.07 15:03:36 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0B559915-0469-464B-96E1-56D7CE186D95}
[2012.05.07 14:27:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D930A873-653B-41E0-9744-28DF31077386}
[2012.05.07 14:27:34 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D6FA7D2B-CBFE-444E-A61D-A913B3562AC2}
[2012.05.07 13:56:03 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A21A6857-FB11-47EF-B855-8C4125233F46}
[2012.05.07 13:55:41 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{23BBB9A8-312D-4419-89C4-79B9EBF87C9B}
[2012.05.07 12:17:46 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{EA1DAC33-F560-4A76-9AC4-B13F781BF205}
[2012.05.07 12:17:24 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3B23D8DB-901A-4836-A7A0-02B9E579E652}
[2012.05.07 11:11:57 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{27670651-BEF2-4EA8-A88B-559B1AADA285}
[2012.05.07 10:35:55 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6B1D29BF-5916-4256-BC4D-04BACCDA2A1E}
[2012.05.07 10:35:34 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{DA7CEBB1-F5B7-4C9C-8103-15FC126BC82F}
[2012.05.07 10:16:01 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{1FDEE904-E041-4F9A-B4BA-0CADDFA0F7AD}
[2012.05.07 10:15:39 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6F42815D-7CD3-4FDD-A553-708FD087580F}
[2012.05.07 08:56:02 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{1CD0466E-CD0C-41BF-9820-A6DE70C93B18}
[2012.05.07 08:55:39 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6F117CD2-F4CE-46DA-B3A8-07C2DAA353B2}
[2012.05.06 20:14:42 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6319B5E3-030E-4B2E-B695-206C05427C86}
[2012.05.06 20:14:31 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{1A7C3000-58F5-4DA5-AA7E-CCD11317B5E2}
[2012.05.06 20:13:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{E734CB88-23EC-4E23-8E03-F1C76B9CF110}
[2012.05.06 20:03:28 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{360E4314-0F56-4ADC-A653-F5BE585A2454}
[2012.05.06 20:03:07 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{69A1D156-E1A2-4107-BF15-CB20907D6992}
[2012.05.06 17:58:01 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{7B620A09-7B6D-4676-9ADF-6C018C05C3C4}
[2012.05.06 17:57:40 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B7975320-C31F-4437-853C-C54C836170DD}
[2012.05.06 17:21:45 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{26F3E1CC-FF2B-4BF0-81B9-2D2F7FBBD9D8}
[2012.05.06 16:31:00 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{7FF457EB-C95F-4539-98FA-5641DEB4F47C}
[2012.05.06 16:30:38 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{7A13062B-0D57-4696-BA08-20D6C505BFE1}
[2012.05.06 16:00:17 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{36371AD3-6E44-4ED5-BD78-DC5B611CE962}
[2012.05.06 15:59:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A171FD44-FA88-4ED6-A640-08AE38B9A097}
[2012.05.06 14:47:54 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{4C8FB5F6-04E0-46DF-8BA7-AD468F11A2AD}
[2012.05.06 14:40:43 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{863F9346-1471-4701-A42B-D743B530E7DE}
[2012.05.06 14:23:25 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C0446758-98CB-433A-9D4B-B45DDAC88E0C}
[2012.05.06 14:23:15 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A452E53F-41B8-4640-8656-05039781134F}
[2012.05.06 14:10:28 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{900BA2AF-20BD-4386-8F51-19371C9E0D0B}
[2012.05.06 14:10:06 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3A4BB5E9-490E-4D0F-8849-720B40E4D612}
[2012.05.06 13:07:36 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2BE70C0E-6027-44AA-81B9-C50DEE327311}
[2012.05.06 13:07:14 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9461BD85-D419-48E1-853B-3FD0236A4AD2}
[2012.05.06 11:19:18 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{05362B8B-AC3B-4DA8-A644-95674E6535EF}
[2012.05.06 11:18:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3021883C-0987-4526-A486-D04BA8A47F78}
[2012.05.05 17:49:50 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6848EF48-6459-4A57-8050-F5E71E4DB728}
[2012.05.05 17:49:28 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{196F56B1-1B81-494A-ACF4-AA2B0499F5C0}
[2012.05.05 16:50:42 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6B387F78-E0C7-403D-941F-49F29E8491F0}
[2012.05.05 16:50:20 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9FD225B4-7DB2-4FD5-85A5-0750F4213FF8}
[2012.05.05 14:23:09 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{66FA493D-51C1-42CE-8623-0544026C6E0B}
[2012.05.05 14:22:47 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0F610F05-D1EA-4570-88E2-F0B59D6F3C80}
[2012.05.05 14:12:26 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{02BDB5C5-43FD-4D53-9C89-1F14C421F48A}
[2012.05.05 14:10:10 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2A57202B-780C-44EF-BB72-6EBD62343D35}
[2012.05.05 14:09:48 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{81B3E19F-38A0-4195-BAD0-EA639C73434C}
[2012.05.05 13:46:19 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{86D1FA25-0305-49F6-97D7-EAA6948AF2C3}
[2012.05.05 13:45:57 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{20DBB036-01EB-4982-93F2-ABFFFB111179}
[2012.05.05 13:28:12 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C00B5C87-7DDB-4E00-ADAA-F3601085966D}
[2012.05.05 11:07:19 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9133D96F-05D2-4182-8CF3-3DF628AA7AC0}
[2012.05.05 11:06:54 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{8528E100-F294-4C8C-B0F2-D8611A951095}
[2012.05.05 10:04:49 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{30B53A7B-A84E-40F8-8CD4-2EB8AC03E79B}
[2012.05.05 08:46:10 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{714AF90B-5DEF-49DD-AF9F-3B3B8A031F73}
[2012.05.05 08:45:48 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{45B73F91-AFE7-465E-89E2-47E232E29BCC}
[2012.05.04 21:54:20 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{7CDEB09B-25FD-431E-95A4-FA63A9C1423F}
[2012.05.04 21:53:59 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{06C7DD18-A283-46E1-B5EE-E61044014914}
[2012.05.04 21:02:57 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A899BE83-83F4-48C2-8312-4672FB175377}
[2012.05.04 19:49:29 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A2272B9F-4707-4504-BFA4-C76A70073670}
[2012.05.04 19:49:06 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{31C6322E-8F7E-4989-9AD8-1B32C1F4B6A7}
[2012.05.04 17:10:29 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B222BF4A-3E0D-4B3D-8F76-1654C841DDB1}
[2012.05.04 17:10:06 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D9A9AF27-75EC-40FE-A47D-9C814895B9C6}
[2012.05.04 14:28:15 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0C7D4F9E-60F9-442F-83E3-353052BECA78}
[2012.05.04 14:27:52 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{79E12A7E-3A78-43B6-85FA-15433AAC24E7}
[2012.05.04 09:28:31 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D04C7C83-DBA3-4CBD-86AB-12D2E36650ED}
[2012.05.04 09:28:09 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{4C9EC0A0-F470-4E5A-90F4-626E089C496B}
[2012.05.03 18:33:51 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D0432769-A14F-47F1-BE31-D6B29FC9E9D3}
[2012.05.03 18:33:28 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3CA90F15-0D7B-48B4-8BEC-02A06F43B9BD}
[2012.05.03 16:48:37 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B4E51AFE-D513-403F-B81C-D91A10AA873C}
[2012.05.03 16:32:13 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{EBD3682D-6D70-4BC8-897A-F1C01A9FBDE7}
[2012.05.03 16:31:51 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{8FC02A4B-7F96-4E6F-872F-A91A776051D1}
[2012.05.03 15:53:38 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{160CB6E8-7A4F-4A0A-8516-7EEBFF599AEA}
[2012.05.03 15:37:48 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{5F0C2BD5-2CA2-4F35-8E4C-0819DD8166A8}
[2012.05.03 15:37:26 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{EEA95213-0129-42DF-94D1-E1D28E06F0B6}
[2012.05.03 15:26:23 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{02D72FF2-7635-4740-B4FD-10FA87D02596}
[2012.05.03 15:26:01 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2AF44B0B-EDEB-4FB6-A7C5-54E93C188627}
[2012.05.03 15:09:53 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6819A8FE-19AE-48EB-9E47-F109BF747021}
[2012.05.03 15:09:32 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{75B87AD0-00BF-4D0B-A5D0-CA535F9D0AF6}
[2012.05.03 14:43:45 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0324C1EF-6827-4063-9A1C-4EA47727E573}
[2012.05.03 14:43:24 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3EC694FE-8597-4D2A-9385-A627DADDCE04}
[2012.05.03 13:12:55 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{34D24274-9497-4E29-88F4-40622EF97372}
[2012.05.03 13:12:33 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F2ABA762-E9BF-43F0-8EF8-B7305FBC1EE8}
[2012.05.03 11:44:02 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{E426819E-94F5-4F0F-BAAF-5580E5250CF2}
[2012.05.03 11:43:40 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{76AC2EC3-3689-467E-A6EE-A2B002ED60A5}
[2012.05.03 11:41:44 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{FDD6B722-C907-4062-A98E-BB9E7B741ED0}
[2012.05.03 11:12:28 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{890A9BDB-86DA-403E-8435-902EAC42237D}
[2012.05.03 11:12:07 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{BF95EE4D-3415-4703-9AE7-7F4593268FB4}
[2012.05.03 08:13:22 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{EE65D24D-36B4-403D-B319-3A510B1BC012}
[2012.05.03 08:13:00 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{18349B0C-DFF4-4E3A-8509-A2E93945EF01}
[2012.05.02 23:03:56 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F6B8EB20-E5E4-4090-A147-BB7E704F9DA2}
[2012.05.02 23:03:46 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C99362BB-B7BD-4BC8-8AC4-360995AA4E95}
[2012.05.02 21:12:11 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{E3573892-F488-4953-B72A-92D589A6B666}
[2012.05.02 21:11:49 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{1163D44B-C227-4743-8296-FF1537544BCC}
[2012.05.02 21:10:16 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{98B50064-E606-4691-BE18-A73369B5E9BA}
[2012.05.02 17:37:59 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{DC53EAB6-0F56-4179-ABD8-3DD5D4E19891}
[2012.05.02 17:37:37 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{31F6F1A8-DE0F-490E-B0F3-0903716FC807}
[2012.05.02 16:16:38 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{CD4BDF3A-7BCF-414F-B799-EABDB837B33E}
[2012.05.02 16:16:16 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{056348E0-C663-4317-B040-2193D1491DE8}
[2012.05.02 14:41:34 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B95F9269-46E1-49A9-AC99-6BFEE847D513}
[2012.05.02 14:41:13 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B789889D-DD36-43B5-B539-2F3F1E69A075}
[2012.05.02 13:12:25 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{5D71CB35-FCB3-4E40-A47B-211FBF58A907}
[2012.05.02 12:48:05 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{91C21659-F7E3-4DEB-BED3-EE8F9916E4AD}
[2012.05.02 11:25:40 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D23560FB-11CB-46B7-B17B-ADCC48D8A735}
[2012.05.02 11:25:18 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{2C0C74B6-F526-4B94-996F-F63E9DB23C22}
[2012.05.02 11:03:58 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{047D45B6-8F36-46B7-AB5F-B8C84D0E3E1E}
[2012.05.02 11:03:36 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D34E1FD8-9D4A-4251-8E53-8641E1D1B041}
[2012.05.02 11:01:02 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A0F1956E-A62E-48A2-ABF4-18153B3FD11B}
[2012.05.02 11:00:40 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B2E4B3E3-7226-4D65-A130-FBFDF2C31E84}
[2012.05.02 10:42:49 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A954ABAB-F4B6-4847-A33C-86D9F7F8C806}
[2012.05.02 10:17:24 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B9BD8C68-7C34-4366-BAC4-F4742AAAE001}
[2012.05.02 10:17:14 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6756F3EB-C9FB-4ABA-9395-56E743ACD40A}
[2012.05.02 10:02:15 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A4BB59F5-E793-4B8F-8429-402CE65A5BA6}
[2012.05.02 10:01:53 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{5A913478-0B36-402A-8C4D-172DEA6C2382}
[2012.05.02 09:40:57 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{59E6D643-E0F8-48F8-9C13-3759B0B7F022}
[2012.05.02 09:40:35 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6F4FEEC0-4810-46CC-BC95-E1DCE78DDBE6}
[2012.05.02 09:30:55 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{E19B8728-D7FE-472A-853F-061532917963}
[2012.05.02 09:30:45 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9DB52C75-9EFE-4A47-ACF2-84551EC5478F}
[2012.05.02 08:58:43 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{5AF3EA0D-2EE7-490E-B5FB-D74510FBB383}
[2012.05.02 08:58:21 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{13A63180-3270-4F9E-8A2C-0A18ED2BABA6}
[2012.05.02 08:32:15 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A8D01CB2-A9EA-460C-B2AC-A39A07073B0B}
[2012.05.02 08:31:53 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{03B1E90D-8B1B-4347-915E-4D7D9C3C0EB3}
[2012.05.01 23:51:32 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F5E12E48-41EE-421B-AC9A-0CF08F6648D3}
[2012.05.01 23:51:11 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{00FB2A33-CD65-42DD-9995-1BD1C845B9A1}
[2012.05.01 19:32:15 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{5D9C8D91-8F36-4C55-A4E5-0AAF375C755A}
[2012.05.01 19:31:53 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{381F1162-D6C2-4DE3-8CAC-D6A9A9119BC7}
[2012.05.01 19:16:20 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D589C444-6999-45B2-BE93-656B759C083B}
[2012.05.01 18:08:42 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F6D67715-4A30-427D-B8DF-3A73DC6DFB11}
[2012.05.01 18:08:21 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{E878B1D2-5D58-4789-9E3B-D69551339E40}
[2012.05.01 17:46:54 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{4D04ED97-9A6D-4D0A-8043-C0D74D3C85E7}
[2012.05.01 17:02:50 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{BE06EB67-CEF2-4081-8E34-6CDAADB1DF41}
[2012.05.01 17:02:29 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{7B9E6F20-6107-4CAF-AAC1-B87485E1E5B5}
[2012.05.01 16:44:21 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{F9B2A582-20D5-4A89-9742-8473A96E6443}
[2012.05.01 16:43:59 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{202E4AEF-30EB-4A1D-A441-1C1633E93873}
[2012.05.01 15:59:02 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{531A6141-03D7-49CC-A2AD-CBCBF744E962}
[2012.05.01 15:58:40 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6F8776F2-F0D1-4596-B6A9-B32A8CD95128}
[2012.05.01 15:25:39 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{4A91203A-C212-4BEA-A9E6-77E7B67328AF}
[2012.05.01 14:12:57 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{E530942B-9CAB-4E61-9751-0C46290F2A50}
[2012.05.01 14:12:35 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B3253A26-55FD-4B13-980F-9DDB8581D884}
[2012.05.01 11:47:40 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{90B09AD5-737D-4CC6-A318-87F7C48032A3}
[2012.05.01 11:47:18 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{81B78B87-7CBB-43F2-95AD-1D097D72D6CA}
[2012.05.01 09:40:52 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{957E0448-4E1B-46B7-BE3A-35F3359CD8B2}
[2012.05.01 09:40:31 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6BC278D9-260C-4D1F-BC3B-7DBC67D0D69E}
[2012.04.30 20:50:07 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{19924D40-5778-4537-B8D9-130BF15B194F}
[2012.04.30 20:49:46 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{5AF57097-105F-40D8-841D-E55B734DFBBB}
[2012.04.30 19:19:08 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{1461BD9C-8631-4255-9F56-2D2C44D94BC0}
[2012.04.30 19:18:47 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{62CE3328-FA23-4F19-B4CB-1D8CC6440017}
[2012.04.30 17:40:09 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{12E55AE8-6CA0-4C19-858E-AD136657CB59}
[2012.04.30 17:39:47 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{E0A74F56-70FD-4920-ABE4-D1C9E87978DC}
[2012.04.30 16:55:03 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0109A97A-9A7A-4629-87C8-A7897DC7CF32}
[2012.04.30 16:54:49 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{45B41BFF-4CF3-48AD-8D5B-CE5CD2E6D0AD}
[2012.04.30 16:15:03 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0F43B0B2-4D0B-4204-AF75-D2AB03663410}
[2012.04.30 16:14:41 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0FE56A96-BF07-457A-9FF9-7D18531870ED}
[2012.04.30 15:04:57 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A173567D-DA65-4F6C-9F0E-9D45E2934988}
[2012.04.30 15:04:36 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{52A87637-842F-41F0-BDFB-A1708C96A0AD}
[2012.04.30 11:51:08 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{43E14B9B-0D4D-4BCE-A8C2-BD372DE28705}
[2012.04.30 11:50:47 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{60159523-6861-4B7E-A3AF-2265980D82F7}
[2012.04.30 11:40:01 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C377D8EB-1F6E-4A06-9008-5C8DC1B1DAA7}
[2012.04.30 11:39:51 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{B1546157-4FA2-4721-A0EA-7EE8E8DB7DC6}
[2012.04.30 11:39:16 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{CF3ACB61-9D96-4B68-9A0E-8A830FD9CAB4}
[2012.04.30 11:38:54 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C8FB7B15-3199-45B3-8177-C2234848846D}
[2012.04.30 11:11:08 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{22659F5B-6006-47AC-ABEE-95537D5213D2}
[2012.04.30 11:10:47 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{78218E4A-26B9-4108-803B-4412DC0EBBE0}
[2012.04.30 10:04:23 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3270CBBB-649D-412E-8696-6ECB119B11E6}
[2012.04.30 10:04:01 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{BE2009DF-CB57-43AC-B391-60EBACB2281A}
[2012.04.30 09:13:34 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{776E9D30-5E3D-4C4D-841F-BD73050088D8}
[2012.04.30 08:58:10 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{9009B97C-08EE-4011-B5DB-AC63518C2F83}
[2012.04.30 08:57:48 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{6381CB23-4D20-489B-B626-624158B72D3A}
[2012.04.29 21:12:03 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C17F7961-FCBE-4B77-99F4-4F9F70E4F7A7}
[2012.04.29 21:11:53 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{D1AB2362-B591-47CB-8D83-FEBED561E9AB}
[2012.04.29 21:03:26 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{DEF6E506-1B42-4776-ABFE-87DFBF49ACE2}
[2012.04.29 21:03:05 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{E7E0AB84-F4FE-4345-AAD1-9FBAA45152A2}
[2012.04.29 19:25:06 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{0AE6B320-00B5-44CD-AB7F-F8F22846D943}
[2012.04.29 19:24:45 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{A91B3F5C-36D0-4638-8930-8AE0FA9D56DD}
[2012.04.29 17:52:42 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{3860351B-CC2F-4191-B3FB-241049A3F04B}
[2012.04.29 17:52:19 | 000,000,000 | ---D | C] -- C:\Users\xx\AppData\Local\{C2D44593-BA5C-4DDA-96D8-09F0C2CF46A1}
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.29 17:39:44 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\xx\Desktop\OTL.exe
[2012.05.29 17:38:22 | 000,000,000 | ---- | M] () -- C:\Users\xx\defogger_reenable
[2012.05.29 17:37:01 | 000,050,477 | ---- | M] () -- C:\Users\xx\Desktop\Defogger.exe
[2012.05.29 17:23:37 | 000,011,040 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.05.29 17:23:37 | 000,011,040 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.05.29 17:14:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.05.29 17:14:54 | 2414,481,408 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.28 14:27:26 | 001,812,736 | ---- | M] () -- C:\Users\xx\Desktop\InVeKoS_2012_Einführung.pdf
[2012.05.28 10:04:19 | 000,007,411 | ---- | M] () -- C:\Users\xx\Desktop\328_5026_1854_Bestätigung der Annahme UStVA 2012 - 1. Quartal_ElsterOnline6.pdf
[2012.05.25 15:09:23 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.05.25 15:09:23 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.05.25 15:09:23 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.05.25 15:09:23 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.05.02 09:30:21 | 000,507,372 | ---- | M] () -- C:\Users\xx\Desktop\Scannen0038.pdf
 
========== Files Created - No Company Name ==========
 
[2012.05.29 17:38:22 | 000,000,000 | ---- | C] () -- C:\Users\xx\defogger_reenable
[2012.05.29 17:37:01 | 000,050,477 | ---- | C] () -- C:\Users\xx\Desktop\Defogger.exe
[2012.05.28 14:27:25 | 001,812,736 | ---- | C] () -- C:\Users\xx\Desktop\InVeKoS_2012_Einführung.pdf
[2012.05.28 10:04:19 | 000,007,411 | ---- | C] () -- C:\Users\xx\Desktop\328_5026_1854_Bestätigung der Annahme UStVA 2012 - 1. Quartal_ElsterOnline6.pdf
[2012.05.02 09:30:21 | 000,507,372 | ---- | C] () -- C:\Users\xx\Desktop\Scannen0038.pdf
[2012.04.05 13:29:53 | 000,299,073 | ---- | C] () -- C:\Windows\System32\PythonCOM21.dll
[2012.04.05 13:29:53 | 000,065,536 | ---- | C] () -- C:\Windows\System32\PyWinTypes21.dll
[2011.12.29 20:45:35 | 000,000,138 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011.12.29 17:57:12 | 000,021,532 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2011.12.29 17:24:00 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2011.05.13 10:04:16 | 000,208,896 | ---- | C] () -- C:\Windows\System32\LXPrnUtil10.dll
[2011.05.13 10:03:16 | 000,303,104 | ---- | C] () -- C:\Windows\System32\dnt27VC8.dll
[2011.05.13 10:01:22 | 000,143,360 | ---- | C] () -- C:\Windows\System32\dntvmc27VC8.dll
[2011.05.13 10:01:00 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dntvm27VC8.dll
[2011.05.01 19:35:30 | 000,167,018 | ---- | C] () -- C:\Windows\hpwins05.dat
[2011.05.01 01:32:09 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2011.05.01 01:32:09 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2011.04.30 16:15:52 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.04.12 03:30:05 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2011.04.12 03:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2011.04.12 03:30:05 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2011.04.12 03:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2010.11.20 23:29:26 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010.06.11 10:57:08 | 000,024,456 | ---- | C] () -- C:\Windows\System32\TALDM32A.dll
[2010.06.11 10:57:06 | 000,052,616 | ---- | C] () -- C:\Windows\System32\TAL12832.DLL
[2010.06.11 10:57:06 | 000,022,920 | ---- | C] () -- C:\Windows\System32\TALDM32.DLL
[2010.06.11 10:57:00 | 000,042,376 | ---- | C] () -- C:\Windows\System32\SBSPAINT.DLL
[2010.06.11 10:56:58 | 000,255,368 | ---- | C] () -- C:\Windows\System32\SBSPAIN3.DLL
[2010.06.11 10:56:56 | 000,050,568 | ---- | C] () -- C:\Windows\System32\SBSPAIN2.DLL
[2010.06.11 10:56:54 | 000,075,656 | ---- | C] () -- C:\Windows\System32\ENCODE32.DLL
 
========== LOP Check ==========
 
[2011.12.29 17:39:22 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\Easy Thumbnails
[2012.03.12 15:53:23 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\elsterformular
[2012.04.05 13:33:30 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\ESRI
[2012.05.26 22:27:56 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\Hepou
[2012.01.28 15:07:23 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\ICQ
[2012.01.07 18:46:26 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\Lexware
[2011.12.29 17:39:23 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\MAXON
[2011.12.29 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\Nemetschek
[2011.12.29 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\PlagiarismFinder
[2011.12.29 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\Samsung
[2011.12.30 11:17:00 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\Windows Live Writer
[2012.05.29 17:36:14 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\Xosaax
[2012.05.26 22:27:56 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\Xoyz
[2012.05.28 16:33:17 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
< End of report >
--- --- ---

cosinus 31.05.2012 11:22
Zitat:
Scan mit AntiVir bringt keine Lösung.
Log dazu trotzdem posten
Alle Logs sofern da Funde oder sonstige Warnungen o.ä. bei sind

dennis8 15.06.2012 18:15
Habe jetzt noch mal an dem PC einen Virenscan durchgeführt:


Code:

Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Freitag, 15. Juni 2012  16:31

Es wird nach 3837368 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - Free Antivirus
Seriennummer  : 0000149956-ADJIE-0000001
Plattform      : Windows 7
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : SYSTEM
Computername  : xxx-PC

Versionsinformationen:
BUILD.DAT      : 10.2.0.707    36070 Bytes  25.01.2012 12:53:00
AVSCAN.EXE    : 10.3.0.7      484008 Bytes  07.07.2011 06:16:04
AVSCAN.DLL    : 10.0.5.0      57192 Bytes  07.07.2011 06:16:04
LUKE.DLL      : 10.3.0.5      45416 Bytes  07.07.2011 06:16:04
LUKERES.DLL    : 10.0.0.0      13672 Bytes  14.01.2010 10:59:47
AVSCPLR.DLL    : 10.3.0.7      119656 Bytes  07.07.2011 06:16:04
AVREG.DLL      : 10.3.0.9      88833 Bytes  16.07.2011 06:35:50
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 08:05:36
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 14:15:11
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 17:26:40
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 08:18:51
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 17:15:00
VBASE005.VDF  : 7.11.29.136  2166272 Bytes  10.05.2012 14:32:47
VBASE006.VDF  : 7.11.29.137    2048 Bytes  10.05.2012 14:32:47
VBASE007.VDF  : 7.11.29.138    2048 Bytes  10.05.2012 14:32:48
VBASE008.VDF  : 7.11.29.139    2048 Bytes  10.05.2012 14:32:48
VBASE009.VDF  : 7.11.29.140    2048 Bytes  10.05.2012 14:32:48
VBASE010.VDF  : 7.11.29.141    2048 Bytes  10.05.2012 14:32:48
VBASE011.VDF  : 7.11.29.142    2048 Bytes  10.05.2012 14:32:48
VBASE012.VDF  : 7.11.29.143    2048 Bytes  10.05.2012 14:32:48
VBASE013.VDF  : 7.11.29.144    2048 Bytes  10.05.2012 14:32:48
VBASE014.VDF  : 7.11.30.3    198144 Bytes  14.05.2012 14:32:53
VBASE015.VDF  : 7.11.30.69    186368 Bytes  17.05.2012 14:32:58
VBASE016.VDF  : 7.11.30.143  223744 Bytes  21.05.2012 14:33:02
VBASE017.VDF  : 7.11.30.207  287744 Bytes  23.05.2012 14:33:09
VBASE018.VDF  : 7.11.31.57    188416 Bytes  28.05.2012 07:24:34
VBASE019.VDF  : 7.11.31.111  214528 Bytes  30.05.2012 07:24:34
VBASE020.VDF  : 7.11.31.151  116736 Bytes  31.05.2012 07:24:35
VBASE021.VDF  : 7.11.31.205  134144 Bytes  03.06.2012 06:42:53
VBASE022.VDF  : 7.11.32.9    169472 Bytes  05.06.2012 06:42:53
VBASE023.VDF  : 7.11.32.85    155648 Bytes  08.06.2012 13:21:25
VBASE024.VDF  : 7.11.32.133  127488 Bytes  11.06.2012 11:10:29
VBASE025.VDF  : 7.11.32.171  182784 Bytes  12.06.2012 11:10:29
VBASE026.VDF  : 7.11.32.172    2048 Bytes  12.06.2012 11:10:29
VBASE027.VDF  : 7.11.32.173    2048 Bytes  12.06.2012 11:10:29
VBASE028.VDF  : 7.11.32.174    2048 Bytes  12.06.2012 11:10:29
VBASE029.VDF  : 7.11.32.175    2048 Bytes  12.06.2012 11:10:29
VBASE030.VDF  : 7.11.32.176    2048 Bytes  12.06.2012 11:10:29
VBASE031.VDF  : 7.11.32.234  114176 Bytes  14.06.2012 13:16:43
Engineversion  : 8.2.10.92
AEVDF.DLL      : 8.1.2.8      106867 Bytes  03.06.2012 07:24:38
AESCRIPT.DLL  : 8.1.4.26      450939 Bytes  14.06.2012 13:16:46
AESCN.DLL      : 8.1.8.2      131444 Bytes  06.02.2012 08:22:28
AESBX.DLL      : 8.2.5.12      606578 Bytes  14.06.2012 13:16:46
AERDL.DLL      : 8.1.9.15      639348 Bytes  10.09.2011 05:55:38
AEPACK.DLL    : 8.2.16.18    807287 Bytes  14.06.2012 13:16:46
AEOFFICE.DLL  : 8.1.2.36      201082 Bytes  14.06.2012 13:16:46
AEHEUR.DLL    : 8.1.4.46    4923767 Bytes  14.06.2012 13:16:45
AEHELP.DLL    : 8.1.21.0      254326 Bytes  24.05.2012 14:33:19
AEGEN.DLL      : 8.1.5.30      422261 Bytes  14.06.2012 13:16:44
AEEXP.DLL      : 8.1.0.52      82293 Bytes  14.06.2012 13:16:47
AEEMU.DLL      : 8.1.3.0      393589 Bytes  28.03.2011 14:14:45
AECORE.DLL    : 8.1.25.10    201080 Bytes  03.06.2012 07:24:35
AEBB.DLL      : 8.1.1.0        53618 Bytes  28.03.2011 14:14:44
AVWINLL.DLL    : 10.0.0.0      19304 Bytes  28.03.2011 14:14:57
AVPREF.DLL    : 10.0.3.2      44904 Bytes  07.07.2011 06:16:04
AVREP.DLL      : 10.0.0.10    174120 Bytes  23.05.2011 12:42:20
AVARKT.DLL    : 10.0.26.1    255336 Bytes  07.07.2011 06:16:04
AVEVTLOG.DLL  : 10.0.0.9      203112 Bytes  07.07.2011 06:16:04
SQLITE3.DLL    : 3.6.19.0      355688 Bytes  17.06.2010 13:27:02
AVSMTP.DLL    : 10.0.0.17      63848 Bytes  28.03.2011 14:14:57
NETNT.DLL      : 10.0.0.0      11624 Bytes  28.03.2011 14:15:04
RCIMAGE.DLL    : 10.0.0.35    2589544 Bytes  07.07.2011 06:16:04
RCTEXT.DLL    : 10.0.64.0      98664 Bytes  07.07.2011 06:16:04

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Freitag, 15. Juni 2012  16:31

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcroRd32.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcroRd32.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'wlcomm.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'wlmail.exe' - '196' Modul(e) wurden durchsucht
Durchsuche Prozess 'FlashUtil10t_ActiveX.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '133' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '116' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '116' Modul(e) wurden durchsucht
Durchsuche Prozess 'ARCGIS.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqSTE08.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'FNPLicensingService.exe' - '19' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqtra08.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'KiesPDLR.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'lmgrd.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'DymoQuickPrint.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'lmgrd.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'LxUpdateManager.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'KiesTrayAgent.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpwuSchd2.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'fpassist.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'DLSService.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '149' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '141' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD2
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD3
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD4
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'D:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '524' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\mail.aquari ae3\Deleted Items\083470D3-00000065.eml
  [0] Archivtyp: MIME
  --> GEWINNBENACHRICHTIGUNG.pdf
      [FUND]      Enthält Erkennungsmuster der Phish-Datei/Email PHISH/Loterias.B
Beginne mit der Suche in 'D:\'

Beginne mit der Desinfektion:
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\mail.aquari ae3\Deleted Items\083470D3-00000065.eml
  [FUND]      Enthält Erkennungsmuster der Phish-Datei/Email PHISH/Loterias.B
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '54ddccfc.qua' verschoben!


Ende des Suchlaufs: Freitag, 15. Juni 2012  19:10
Benötigte Zeit:  2:05:26 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  28434 Verzeichnisse wurden überprüft
 735845 Dateien wurden geprüft
      1 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      1 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 735844 Dateien ohne Befall
  77843 Archive wurden durchsucht
      0 Warnungen
      1 Hinweise
 502433 Objekte wurden beim Rootkitscan durchsucht
      0 Versteckte Objekte wurden gefunden

cosinus 15.06.2012 21:00
Ich wollte die alten Logs sehen, keine Logs von heute ohne nennenswerte Funde

dennis8 16.06.2012 07:59
Hier der entsprechende Log


Code:

Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Montag, 28. Mai 2012  19:22

Es wird nach 3754497 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - Free Antivirus
Seriennummer  : 0000649676-ADJIE-0000001
Plattform      : Windows 7
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : SYSTEM
Computername  : xxx-PC

Versionsinformationen:
BUILD.DAT      : 10.2.0.707    36070 Bytes  25.01.2012 12:53:00
AVSCAN.EXE    : 10.3.0.7      484008 Bytes  07.07.2011 06:16:04
AVSCAN.DLL    : 10.0.5.0      57192 Bytes  07.07.2011 06:16:04
LUKE.DLL      : 10.3.0.5      45416 Bytes  07.07.2011 06:16:04
LUKERES.DLL    : 10.0.0.0      13672 Bytes  14.01.2010 10:59:47
AVSCPLR.DLL    : 10.3.0.7      119656 Bytes  07.07.2011 06:16:04
AVREG.DLL      : 10.3.0.9      88833 Bytes  16.07.2011 06:35:50
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 08:05:36
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 14:15:11
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 17:26:40
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 08:18:51
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 17:15:00
VBASE005.VDF  : 7.11.29.136  2166272 Bytes  10.05.2012 14:32:47
VBASE006.VDF  : 7.11.29.137    2048 Bytes  10.05.2012 14:32:47
VBASE007.VDF  : 7.11.29.138    2048 Bytes  10.05.2012 14:32:48
VBASE008.VDF  : 7.11.29.139    2048 Bytes  10.05.2012 14:32:48
VBASE009.VDF  : 7.11.29.140    2048 Bytes  10.05.2012 14:32:48
VBASE010.VDF  : 7.11.29.141    2048 Bytes  10.05.2012 14:32:48
VBASE011.VDF  : 7.11.29.142    2048 Bytes  10.05.2012 14:32:48
VBASE012.VDF  : 7.11.29.143    2048 Bytes  10.05.2012 14:32:48
VBASE013.VDF  : 7.11.29.144    2048 Bytes  10.05.2012 14:32:48
VBASE014.VDF  : 7.11.30.3    198144 Bytes  14.05.2012 14:32:53
VBASE015.VDF  : 7.11.30.69    186368 Bytes  17.05.2012 14:32:58
VBASE016.VDF  : 7.11.30.143  223744 Bytes  21.05.2012 14:33:02
VBASE017.VDF  : 7.11.30.207  287744 Bytes  23.05.2012 14:33:09
VBASE018.VDF  : 7.11.30.208    2048 Bytes  23.05.2012 14:33:09
VBASE019.VDF  : 7.11.30.209    2048 Bytes  23.05.2012 14:33:10
VBASE020.VDF  : 7.11.30.210    2048 Bytes  23.05.2012 14:33:10
VBASE021.VDF  : 7.11.30.211    2048 Bytes  23.05.2012 14:33:10
VBASE022.VDF  : 7.11.30.212    2048 Bytes  23.05.2012 14:33:10
VBASE023.VDF  : 7.11.30.213    2048 Bytes  23.05.2012 14:33:11
VBASE024.VDF  : 7.11.30.214    2048 Bytes  23.05.2012 14:33:12
VBASE025.VDF  : 7.11.30.215    2048 Bytes  23.05.2012 14:33:12
VBASE026.VDF  : 7.11.30.216    2048 Bytes  23.05.2012 14:33:12
VBASE027.VDF  : 7.11.30.217    2048 Bytes  23.05.2012 14:33:12
VBASE028.VDF  : 7.11.30.218    2048 Bytes  23.05.2012 14:33:12
VBASE029.VDF  : 7.11.30.219    2048 Bytes  23.05.2012 14:33:13
VBASE030.VDF  : 7.11.30.220    2048 Bytes  23.05.2012 14:33:13
VBASE031.VDF  : 7.11.31.40    168448 Bytes  28.05.2012 07:31:28
Engineversion  : 8.2.10.68
AEVDF.DLL      : 8.1.2.2      106868 Bytes  09.12.2011 16:50:41
AESCRIPT.DLL  : 8.1.4.19      455034 Bytes  24.05.2012 14:35:01
AESCN.DLL      : 8.1.8.2      131444 Bytes  06.02.2012 08:22:28
AESBX.DLL      : 8.2.5.5      606579 Bytes  29.03.2012 17:15:30
AERDL.DLL      : 8.1.9.15      639348 Bytes  10.09.2011 05:55:38
AEPACK.DLL    : 8.2.16.13    807287 Bytes  24.05.2012 14:34:55
AEOFFICE.DLL  : 8.1.2.28      201082 Bytes  05.05.2012 08:05:23
AEHEUR.DLL    : 8.1.4.28    4800886 Bytes  24.05.2012 14:34:46
AEHELP.DLL    : 8.1.21.0      254326 Bytes  24.05.2012 14:33:19
AEGEN.DLL      : 8.1.5.28      422260 Bytes  05.05.2012 08:05:12
AEEXP.DLL      : 8.1.0.40      82292 Bytes  24.05.2012 14:35:02
AEEMU.DLL      : 8.1.3.0      393589 Bytes  28.03.2011 14:14:45
AECORE.DLL    : 8.1.25.6      201078 Bytes  29.03.2012 17:15:17
AEBB.DLL      : 8.1.1.0        53618 Bytes  28.03.2011 14:14:44
AVWINLL.DLL    : 10.0.0.0      19304 Bytes  28.03.2011 14:14:57
AVPREF.DLL    : 10.0.3.2      44904 Bytes  07.07.2011 06:16:04
AVREP.DLL      : 10.0.0.10    174120 Bytes  23.05.2011 12:42:20
AVARKT.DLL    : 10.0.26.1    255336 Bytes  07.07.2011 06:16:04
AVEVTLOG.DLL  : 10.0.0.9      203112 Bytes  07.07.2011 06:16:04
SQLITE3.DLL    : 3.6.19.0      355688 Bytes  17.06.2010 13:27:02
AVSMTP.DLL    : 10.0.0.17      63848 Bytes  28.03.2011 14:14:57
NETNT.DLL      : 10.0.0.0      11624 Bytes  28.03.2011 14:15:04
RCIMAGE.DLL    : 10.0.0.35    2589544 Bytes  07.07.2011 06:16:04
RCTEXT.DLL    : 10.0.64.0      98664 Bytes  07.07.2011 06:16:04

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Montag, 28. Mai 2012  19:22

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'DLS.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'wlcomm.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'wlmail.exe' - '202' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '132' Modul(e) wurden durchsucht
Durchsuche Prozess 'FlashUtil10t_ActiveX.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '131' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '122' Modul(e) wurden durchsucht
Durchsuche Prozess 'iexplore.exe' - '100' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqSTE08.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'FNPLicensingService.exe' - '19' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqtra08.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'KiesPDLR.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'DymoQuickPrint.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'LxUpdateManager.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'KiesTrayAgent.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpwuSchd2.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'fpassist.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'DLSService.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '162' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'ARCGIS.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'lmgrd.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'lmgrd.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '146' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD2
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD3
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD4
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD5
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'D:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '523' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\mail.abo-pr d96\Deleted Items\404231C6-0000002D.eml
  [0] Archivtyp: MIME
  --> Abrechnung.zip
      [1] Archivtyp: ZIP
    --> Abrechnung.exe
        [FUND]      Ist das Trojanische Pferd TR/Crypt.Gypikon.C.2
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\mail.aquari 246\Deleted Items\616A14AE-000000C7.eml
  [0] Archivtyp: MIME
  --> Abrechnung.zip
      [1] Archivtyp: ZIP
    --> Abrechnung.exe
        [FUND]      Ist das Trojanische Pferd TR/Crypt.Gypikon.C.2
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\0A9E4CF4-0000255D.eml
  [0] Archivtyp: MIME
  --> BBB abuse.zip
      [1] Archivtyp: ZIP
    --> BBB abuse.exe
        [FUND]      Ist das Trojanische Pferd TR/Jorik.Androm.A
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\13884A62-0000255C.eml
  [0] Archivtyp: MIME
  --> BBB abuse.zip
      [1] Archivtyp: ZIP
    --> BBB abuse.exe
        [FUND]      Ist das Trojanische Pferd TR/Jorik.Androm.A
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\13F21CC2-00002523.eml
  [0] Archivtyp: MIME
  --> BBB Report.zip
      [1] Archivtyp: ZIP
    --> BBB report.exe
        [FUND]      Ist das Trojanische Pferd TR/Jorik.Androm.eo
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\2DC469A7-00002529.eml
  [0] Archivtyp: MIME
  --> BBB Report.zip
      [1] Archivtyp: ZIP
    --> BBB report.exe
        [FUND]      Ist das Trojanische Pferd TR/Jorik.Androm.eo
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\466C161C-00002567.eml
  [0] Archivtyp: MIME
  --> BBB abuse.zip
      [1] Archivtyp: ZIP
    --> BBB abuse.exe
        [FUND]      Ist das Trojanische Pferd TR/Jorik.Androm.B
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\5806448C-00002536.eml
  [0] Archivtyp: MIME
  --> IMG7652.zip
      [1] Archivtyp: ZIP
    --> IMG7652.exe
        [FUND]      Ist das Trojanische Pferd TR/Dldr.Matsnu.B
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\59216776-00002541.eml
  [0] Archivtyp: MIME
  --> EPS00872.zip
      [1] Archivtyp: ZIP
    --> EPS00872.exe
        [FUND]      Enthält Erkennungsmuster des Wurmes WORM/Gamarue.I.9
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\5A042343-00002558.eml
  [0] Archivtyp: MIME
  --> BBB abuse.zip
      [1] Archivtyp: ZIP
    --> BBB abuse.exe
        [FUND]      Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/Andromeda.B
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\694938C2-0000251A.eml
  [0] Archivtyp: MIME
  --> BBB Report.zip
      [1] Archivtyp: ZIP
    --> BBB report.exe
        [FUND]      Enthält Erkennungsmuster des Wurmes WORM/Gamaure.G.3
Beginne mit der Suche in 'D:\'

Beginne mit der Desinfektion:
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\694938C2-0000251A.eml
  [FUND]      Enthält Erkennungsmuster des Wurmes WORM/Gamaure.G.3
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4b3c70b6.qua' verschoben!
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\5A042343-00002558.eml
  [FUND]      Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/Andromeda.B
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '53af5f1a.qua' verschoben!
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\59216776-00002541.eml
  [FUND]      Enthält Erkennungsmuster des Wurmes WORM/Gamarue.I.9
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '01f605fa.qua' verschoben!
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\5806448C-00002536.eml
  [FUND]      Ist das Trojanische Pferd TR/Dldr.Matsnu.B
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '67c74a3b.qua' verschoben!
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\466C161C-00002567.eml
  [FUND]      Ist das Trojanische Pferd TR/Jorik.Androm.B
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '22496703.qua' verschoben!
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\2DC469A7-00002529.eml
  [FUND]      Ist das Trojanische Pferd TR/Jorik.Androm.eo
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '42ad5550.qua' verschoben!
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\13F21CC2-00002523.eml
  [FUND]      Ist das Trojanische Pferd TR/Jorik.Androm.eo
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0e1a792b.qua' verschoben!
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\13884A62-0000255C.eml
  [FUND]      Ist das Trojanische Pferd TR/Jorik.Androm.A
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '6df0397b.qua' verschoben!
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\Storage Folders\Deleted Items\0A9E4CF4-0000255D.eml
  [FUND]      Ist das Trojanische Pferd TR/Jorik.Androm.A
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '40ad1639.qua' verschoben!
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\mail.aquari 246\Deleted Items\616A14AE-000000C7.eml
  [FUND]      Ist das Trojanische Pferd TR/Crypt.Gypikon.C.2
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '59c02db3.qua' verschoben!
C:\Users\xxx\AppData\Local\Microsoft\Windows Live Mail\mail.abo-pr d96\Deleted Items\404231C6-0000002D.eml
  [FUND]      Ist das Trojanische Pferd TR/Crypt.Gypikon.C.2
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '35920183.qua' verschoben!


Ende des Suchlaufs: Montag, 28. Mai 2012  21:25
Benötigte Zeit:  1:58:58 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  28168 Verzeichnisse wurden überprüft
 695205 Dateien wurden geprüft
    11 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
    11 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 695194 Dateien ohne Befall
  76021 Archive wurden durchsucht
      0 Warnungen
    11 Hinweise
 501380 Objekte wurden beim Rootkitscan durchsucht
      0 Versteckte Objekte wurden gefunden

cosinus 17.06.2012 20:13
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

dennis8 18.06.2012 10:23
Malwarebytes hat nichts gefunden. ESET kann ich gar nicht starten, da ich nicht auf die Webseite komme. Gleiches Problem wie im ersten Beitrag beschrieben. Gibts da vielleicht eine Möglichkeit diese Sperre zu umgehen?

Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.18.03

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
xxx :: xxx-PC [Administrator]

Schutz: Aktiviert

18.06.2012 09:27:22
mbam-log-2012-06-18 (09-27-22).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 457912
Laufzeit: 1 Stunde(n), 39 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus 18.06.2012 11:18
Das hier erstmal prüfen:


Falsche Proxy Einstellungen entfernen
  • Klicke im Start-Menü unter "Einstellungen" auf "Systemsteuerung" -> "Internetoptionen".
  • Wähle die Karteikarte "Verbindungen->Lan-Einstellungen“ und überprüfe ob bei Proxyserver ein Häkchen steht,
    wenn ja -> Entfernen, dann -> OK (sofern nicht richtige Eintragung)

dennis8 18.06.2012 11:28
habe mal nachgeschaut: Bei Proxyserver war und ist kein Häkchen gesetzt.

cosinus 18.06.2012 14:01
Versuch ESET mal bitte im abgesicherten Modus mit Netzwerktreibern



Abgesicherter Modus zur Bereinigung
  • Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
  • Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

    Windows im abgesicherten Modusstarten

dennis8 19.06.2012 12:14
Jetzt scheint etwas gefunden worden zu sein:

Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110708-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=b3858b548726b247987990005a69a7ab
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-19 10:06:13
# local_time=2012-06-19 12:06:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775166 100 94 391896 76630820 406970 0
# compatibility_mode=5893 16776638 100 85 36687001 91725190 0 0
# compatibility_mode=8192 67108863 100 0 164 164 0 0
# scanned=255031
# found=1
# cleaned=0
# scan_time=6374
C:\Users\xxx\AppData\Roaming\Xoyz\olow.exe        a variant of Win32/Kryptik.AGTX trojan (unable to clean)        00000000000000000000000000000000        I

cosinus 19.06.2012 12:41
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

dennis8 20.06.2012 08:33
alles klar, hier das entsprechende OTL Log:

Code:
OTL logfile created on: 20.06.2012 09:08:31 - Run 2
OTL by OldTimer - Version 3.2.44.0    Folder = C:\Users\xxx\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,88 Gb Available Physical Memory | 62,57% Memory free
5,99 Gb Paging File | 4,74 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,71 Gb Total Space | 326,56 Gb Free Space | 71,66% Space Free | Partition Type: NTFS
Drive D: | 10,00 Gb Total Space | 9,92 Gb Free Space | 99,23% Space Free | Partition Type: NTFS
 
Computer Name: xxx-PC | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.05.29 17:39:44 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe
PRC - [2012.05.28 15:06:18 | 000,867,080 | ---- | M] (Acresso Software Inc.) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.09.29 16:19:26 | 000,020,880 | ---- | M] () -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
PRC - [2011.09.29 16:19:16 | 003,508,112 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Kies\KiesTrayAgent.exe
PRC - [2011.07.07 08:16:04 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.03.28 21:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 21:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2011.03.28 16:15:17 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.28 16:14:56 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 23:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 23:29:19 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.09.15 11:11:22 | 000,339,312 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Programme\Common Files\Lexware\Update Manager\LxUpdateManager.exe
PRC - [2010.06.17 21:56:44 | 000,370,176 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe
PRC - [2010.05.11 06:06:40 | 001,885,512 | ---- | M] (Sanford, L.P.) -- C:\Programme\DYMO\DYMO Label Software\DymoQuickPrint.exe
PRC - [2010.05.11 05:53:16 | 000,055,808 | ---- | M] (Sanford, L.P.) -- C:\Programme\DYMO\DYMO Label Software\DLSService.exe
PRC - [2010.04.23 16:20:36 | 001,670,144 | ---- | M] (ESRI) -- C:\Programme\ArcGIS\License10.0\bin\ARCGIS.exe
PRC - [2009.08.18 03:36:36 | 000,348,160 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009.08.18 03:36:08 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2008.11.06 00:59:50 | 001,500,424 | ---- | M] (Acresso Software Inc.) -- C:\Programme\ArcGIS\License10.0\bin\lmgrd.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.12 10:55:10 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\0c2b0d52156447592f33edf4116b7e7d\System.Management.ni.dll
MOD - [2012.05.12 10:53:45 | 000,762,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\65f0d70169a0e73b45307dddbd86f92b\System.Runtime.Remoting.ni.dll
MOD - [2012.05.12 10:53:38 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d234eceae699d070b5a5712ce776c01f\System.Xaml.ni.dll
MOD - [2012.05.11 20:35:34 | 018,000,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\041b1bcf6ae9ab58925791d8198c37e2\PresentationFramework.ni.dll
MOD - [2012.05.11 20:35:19 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\a1de74c8d0dfd15e3246e5dd394013bf\PresentationCore.ni.dll
MOD - [2012.05.11 20:35:10 | 003,858,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4b7adff986a085bb562222d0c5fdf5aa\WindowsBase.ni.dll
MOD - [2012.05.11 20:35:08 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a5fa2a1cfc6e9fdc39d9a8f2baa57bc9\PresentationFramework.Aero.ni.dll
MOD - [2012.05.11 20:32:54 | 013,197,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\9ee9841d9e33fe5dceba4cd7d90f2ae0\System.Windows.Forms.ni.dll
MOD - [2012.05.11 20:32:51 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll
MOD - [2012.05.11 20:32:48 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll
MOD - [2012.05.11 20:32:45 | 001,665,536 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\03b5233f1511f5fdb39eb681b04e5506\System.Drawing.ni.dll
MOD - [2012.05.11 20:32:43 | 009,091,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll
MOD - [2012.05.11 20:32:37 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll
MOD - [2012.02.15 17:04:18 | 000,593,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\a717cdb44ec0d3238c621efa420a9956\System.Messaging.ni.dll
MOD - [2012.02.15 14:25:10 | 002,297,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\f01c5c76d0a19516a37b7bd191a02cda\System.Core.ni.dll
MOD - [2012.02.15 14:24:56 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\42ae8760f0a74ab774e82a64368aa1f6\System.Web.ni.dll
MOD - [2012.02.15 14:24:38 | 014,339,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\02f7846cbc5c02a5dbf50fd34325eb61\PresentationFramework.ni.dll
MOD - [2012.02.15 14:24:22 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll
MOD - [2012.02.15 14:24:14 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll
MOD - [2012.02.15 14:24:11 | 012,234,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\f4b2424c1b32fbd11130482bb899b7ae\PresentationCore.ni.dll
MOD - [2012.02.15 14:24:00 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\47b9e7f070271ff50f988f75ea68fa3e\WindowsBase.ni.dll
MOD - [2012.02.15 14:23:55 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll
MOD - [2012.02.15 14:23:51 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll
MOD - [2012.02.15 14:23:50 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll
MOD - [2011.12.30 20:15:03 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2011.12.29 18:20:24 | 000,115,137 | ---- | M] () -- C:\Users\xxx\AppData\Local\Temp\ae201572-4813-4010-9ed2-ee29ddec066a\CliSecureRT.dll
MOD - [2011.09.29 16:19:26 | 000,020,880 | ---- | M] () -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.11.13 01:19:04 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.05.11 05:52:30 | 000,094,208 | ---- | M] () -- C:\Programme\DYMO\DYMO Label Software\DYMO.Common.dll
MOD - [2006.12.10 21:51:08 | 000,077,824 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmltok.dll
MOD - [2006.12.10 21:51:08 | 000,065,536 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmlparse.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2012.06.18 11:13:20 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.28 15:06:18 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Running] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.07.07 08:16:04 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.03.28 21:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.11.20 23:29:48 | 000,128,848 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2010.11.20 23:29:32 | 000,068,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\Mcx2Svc.dll -- (Mcx2Svc)
SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009.08.18 03:36:08 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\mprdim.dll -- (RemoteAccess)
SRV - [2009.07.14 03:15:33 | 000,300,544 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\ipnathlp.dll -- (SharedAccess)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.06 00:59:50 | 001,500,424 | ---- | M] (Acresso Software Inc.) [Auto | Running] -- C:\Programme\ArcGIS\License10.0\bin\lmgrd.exe -- (ArcGIS License Manager)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.07.07 08:16:04 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.07 08:16:04 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.11.20 23:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 23:29:12 | 000,246,784 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\udfs.sys -- (udfs)
DRV - [2010.11.20 23:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 23:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dmvsc.sys -- (dmvsc)
DRV - [2010.11.20 23:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 23:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 23:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2010.11.20 23:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 23:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.08.18 04:48:06 | 004,994,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.07.14 03:20:28 | 000,022,096 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\crcdisk.sys -- (crcdisk)
DRV - [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ws2ifsl.sys -- (ws2ifsl)
DRV - [2009.07.14 01:11:15 | 000,070,656 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\cdfs.sys -- (cdfs)
DRV - [2009.07.14 00:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000\..\SearchScopes,DefaultScope = {2279C29F-823D-4444-815A-CF161E9B6251}
IE - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000\..\SearchScopes\{2279C29F-823D-4444-815A-CF161E9B6251}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.18 11:13:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.05.01 10:08:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Extensions
[2012.05.02 12:56:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions
[2012.03.29 20:13:09 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.06.15 16:38:49 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ft2iwcdl.default\searchplugins\icqplugin-1.xml
[2011.11.06 12:45:18 | 000,001,056 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ft2iwcdl.default\searchplugins\icqplugin.xml
[2012.01.09 11:55:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.18 11:13:21 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.06.18 11:13:19 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.18 11:13:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.18 11:13:19 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.18 11:13:19 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.18 11:13:19 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.18 11:13:19 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (ICQ Sparberater) - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - C:\Programme\icq\Internet Explorer\icq.dll (solute gmbh)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DLSService] C:\Program Files\DYMO\DYMO Label Software\DLSService.exe (Sanford, L.P.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000..\Run: [Cixyi] C:\Users\xxx\AppData\Roaming\Xoyz\olow.exe ()
O4 - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000..\Run: [DymoQuickPrint] C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe (Sanford, L.P.)
O4 - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5759352-0A3C-4DF4-B67E-99428EFF0E84}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{9aba0abc-3230-11e1-b5d3-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{9aba0abc-3230-11e1-b5d3-806e6f6e6963}\Shell\AutoRun\command - "" = F:\ESRI.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.20 09:03:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{26E4F382-CB56-4279-89AE-4CE46E6B5446}
[2012.06.20 09:02:38 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{D93A105D-3A4C-4C91-9DB9-206B0BFC705D}
[2012.06.19 13:10:43 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{6411389A-7957-44C3-9507-326168C6AAEE}
[2012.06.19 13:10:33 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{0288AD2F-BD63-4F7C-BB1E-88A9FFB8196B}
[2012.06.19 13:06:45 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{0980F83C-70E5-41CA-A5DE-5F3E6AFB7332}
[2012.06.19 13:06:27 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{E5602BB3-69F5-4A69-9F9C-41310802AFBC}
[2012.06.19 13:06:02 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{F924D841-6367-4AAB-A70E-D7C75BD443ED}
[2012.06.19 13:05:16 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{93761219-AA5F-4A08-86FA-3BDF80B193C6}
[2012.06.19 13:04:55 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{7C55003F-DBE2-496F-9CCB-B883243B39B7}
[2012.06.19 10:17:15 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.06.19 09:07:36 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{4950116A-F6F2-4EA7-BC89-83AEA94F7B44}
[2012.06.19 09:07:09 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{B01EED93-C734-4ED4-826D-96F565B8670C}
[2012.06.18 11:13:24 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012.06.18 11:13:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.06.18 09:24:55 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Malwarebytes
[2012.06.18 09:24:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.18 09:24:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.18 09:24:47 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.06.18 09:24:47 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.18 09:16:18 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{C7262CF4-1679-4BFE-8955-4F9655D455A7}
[2012.06.17 10:27:48 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{589C032A-7F0E-447B-9B6B-0DDB7DE25745}
[2012.06.16 08:49:50 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{22765BD8-042C-42FE-B6C5-8589540C977E}
[2012.06.15 15:03:52 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{F38108E2-0130-4648-9F83-84A106677404}
[2012.06.14 21:30:38 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{A8972D7C-71BC-4DFD-9796-6A4461BF423C}
[2012.06.14 21:30:28 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{3D362C0E-B751-40D0-8C74-22585A24DF0A}
[2012.06.14 17:31:43 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{10787AD5-FE16-4D16-9585-C72455EF2E88}
[2012.06.14 17:31:33 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{D23DCAEE-86EB-465F-A946-15BF81D7DF53}
[2012.06.14 17:27:17 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{07D3CFBE-882D-443A-9AFD-A44A90C21C41}
[2012.06.14 17:26:55 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{9D41B0DB-B22B-4256-ABAE-1A0B9F0345F2}
[2012.06.14 17:12:01 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{C0D3E03C-57BD-489B-B24D-51B734427984}
[2012.06.14 17:11:40 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2B685C69-9FE2-4FFF-9203-AA2C48A6B82F}
[2012.06.14 16:51:42 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{35E967F6-5E58-40A7-B897-BB16FEBB3EC6}
[2012.06.14 16:51:20 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{5550F1A5-8985-426C-8BE7-12314B41E7BA}
[2012.06.14 16:07:54 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{02C69EFC-3146-412F-8188-D54FDC07A21F}
[2012.06.14 16:07:32 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{B87866B8-B8C1-43B0-9AB6-BB2035E3D1FE}
[2012.06.14 15:16:05 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{45897D1B-0C4B-404E-8835-D433011CBADE}
[2012.06.14 15:15:43 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2B24F4E1-B165-4F59-AAF8-A96B6A789060}
[2012.06.13 18:08:12 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{99AAB18C-BF1A-4F77-833C-C823251FE64D}
[2012.06.13 17:47:13 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{F18409C4-30DF-4FDE-873C-3721D5711848}
[2012.06.13 17:46:52 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{8587915A-79F5-40BA-8519-253B5F388E0C}
[2012.06.13 17:32:02 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{70C8A38A-7C29-4565-8AA0-F83E0CA44C1E}
[2012.06.13 17:31:41 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{7C2D91DC-DAF9-44C4-8CC5-6A0A17ACE4A4}
[2012.06.13 13:10:29 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{51362A5F-8488-449B-A9F2-8D5D05410081}
[2012.06.13 13:10:06 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{76BAA57D-E7C9-48AE-96AC-D75606F1E41A}
[2012.06.12 18:16:25 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{42D19CC2-E26B-422F-BA55-401D470BA461}
[2012.06.12 18:16:04 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{49CCC110-17AD-4663-A330-B5E2F306A6C4}
[2012.06.12 16:57:20 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{870D8B87-008A-4638-85B7-8794ADFF3302}
[2012.06.12 16:56:59 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{910CFAB5-2120-4B8C-B4DE-A443FEA104AB}
[2012.06.12 16:03:57 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2305186E-8949-476D-9864-65CDFED86A46}
[2012.06.12 16:03:36 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{4322C968-9DBE-44F9-A464-12FAD3CDF30F}
[2012.06.12 14:30:37 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{ED217BFD-0CA1-4232-A267-B2A2C0996A13}
[2012.06.12 14:30:16 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{A854A5D2-1979-4FEC-8696-217A067B3443}
[2012.06.12 12:33:55 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{255EBDAA-8C32-4434-A9EC-90F99185F40F}
[2012.06.12 12:33:34 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2BA6C983-DC21-418D-A1E8-6EF96EEBDCCE}
[2012.06.12 08:10:47 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{CD3EDDB5-8097-4330-8284-6B8D8496FBC5}
[2012.06.12 08:10:26 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{8732127F-3DA1-4F62-8A61-BEB60AEF43EB}
[2012.06.11 21:28:16 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{D98372A5-1893-47C3-A3C5-D2584B35F760}
[2012.06.11 19:16:11 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{E4FA5CB4-8EDE-489F-9657-96BADBFF9485}
[2012.06.11 19:15:50 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{31E2FB5F-E0D5-4404-B8F1-2C30CA550849}
[2012.06.11 17:22:47 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{B3C6AF3E-9D60-46A8-B423-05BAE1BB8BB7}
[2012.06.11 17:22:26 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{C1827E8E-87F5-4C77-90D7-BFBCE0668BCE}
[2012.06.11 17:14:03 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{B3661AEC-C09D-4CDE-8DC1-EB3B136C037C}
[2012.06.11 16:57:42 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{5DCA3DD1-A59F-42D0-97F4-7D0F378F5E0A}
[2012.06.11 16:43:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{6218B81C-7DF8-4FA4-A4A4-3BA74BC7D63C}
[2012.06.11 16:22:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{5B6EEBB2-229C-479A-BAB5-586D94946AFE}
[2012.06.11 16:21:39 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{6F298620-8DAC-408E-8E7F-66C6AAFA1AA7}
[2012.06.11 15:21:33 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{7F730BD8-0A67-49D7-9B4C-34EC22DE5242}
[2012.06.11 15:21:12 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{CD592FEE-8EC1-4FDF-8B84-89599D9EC7AA}
[2012.06.10 17:16:02 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{A181D88E-0214-4C2B-96BC-F7291C808B9A}
[2012.06.10 17:15:41 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{D3704A20-EC3E-4738-8390-D8FC80FFDC8E}
[2012.06.10 16:28:23 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{95A5624D-6825-4C1E-8F5A-DB4C1829CE79}
[2012.06.10 16:28:02 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{D93EFBEC-48E8-44C1-95B3-1AC61936996F}
[2012.06.10 12:02:12 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{812DA2FB-1335-4583-8259-49C4AB809F50}
[2012.06.10 12:01:50 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{8C1C5823-FB2E-4C9F-9124-8A1D0017D80E}
[2012.06.10 11:54:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2B319957-546A-45ED-8AC6-24EA0FD2EF8E}
[2012.06.10 11:46:01 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{3E964F07-AD3B-4DD6-8804-5091D17156CD}
[2012.06.10 11:17:49 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{77092EB1-5456-4335-903A-B5ED0C65BA85}
[2012.06.10 11:17:27 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{1507F644-B3FE-4257-939E-83DD4DB83C55}
[2012.06.09 19:18:17 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{35F428CE-EFAF-4B47-A1F5-93FBB24139FE}
[2012.06.09 19:17:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{761C153B-0793-401C-8A4F-37FA1AF77A72}
[2012.06.09 09:24:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{A8E97706-F503-4A61-B301-0084F62C1547}
[2012.06.09 09:24:34 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{FC0BA484-490B-4B4B-A9FE-6DB46269032E}
[2012.06.09 08:33:33 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{9BEE748E-027A-487D-901F-C4B2220FE807}
[2012.06.09 08:33:12 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{85DDB330-DD2E-48AA-95E3-4CC2DC533F60}
[2012.06.08 21:31:04 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{56E48E9B-9D67-4213-91CD-AC496F4C9117}
[2012.06.08 21:30:42 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{63694AEC-96C8-4BC3-BEF4-00F180A8D022}
[2012.06.08 11:09:15 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{157D2FD1-F1A6-41DD-AA7C-BE070718E11A}
[2012.06.08 11:08:54 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{95633FEE-C4A0-453A-B79B-EF2E82E0AF7F}
[2012.06.08 09:59:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{A3D4B876-E1E2-4669-8C89-CA45A0F9472F}
[2012.06.08 09:59:46 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{3A437730-6F19-453B-B884-7ACD8D581602}
[2012.06.08 09:34:03 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\luigi
[2012.06.08 08:32:47 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{78CB5832-D540-43D3-A38E-CE44E41052FF}
[2012.06.08 08:32:25 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{B5CB642C-22DC-44BF-96EC-531A2AD66F3F}
[2012.06.07 20:01:38 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{F4E45F9C-E9A7-4367-B94C-6E53E45AD6B1}
[2012.06.07 20:01:12 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{1C822518-EB0D-4B9D-B5D4-684CF1B277E6}
[2012.06.07 08:44:22 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{529EBCBE-5247-4FDE-A48A-98563423BAE6}
[2012.06.07 08:44:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{CCC7008C-6C5F-4272-9AFF-3C9FD16A8FE1}
[2012.06.06 10:22:17 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{F780C3D9-DBEC-4BCB-8B44-87335212F7A7}
[2012.06.06 10:21:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{F3732D03-090D-443B-A0E3-2E449CA89C38}
[2012.06.06 08:32:36 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{465E10AB-1449-4D85-A4F5-EB221B031C85}
[2012.06.06 08:32:15 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{DAA7F9E7-AC2B-463E-A3DA-4469D26E9D1A}
[2012.06.05 21:35:52 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{88577245-446E-4DDA-B2EA-5161A8F416F8}
[2012.06.05 21:35:41 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{028FC70B-0509-4BDF-8D4E-FFE623FA8F4E}
[2012.06.05 08:12:35 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{96AC4950-5C80-47D2-83A9-3C2102DF4FE1}
[2012.06.05 08:12:13 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{F0546C9D-6475-4E27-A458-A61005DE382F}
[2012.06.04 12:32:42 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{96F08BAB-3F65-4AA2-8D71-7B54B54A9F9F}
[2012.06.04 12:32:21 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{F1508788-3FB1-4842-AEF3-1BB491333F03}
[2012.06.04 12:26:03 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{9D138589-E367-46DB-9206-A597D7E115CF}
[2012.06.04 12:25:41 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{5AD484B1-45CC-4F97-A8C1-451F67E7E5CE}
[2012.06.03 18:20:07 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{71B383BF-AB42-40D6-8545-3BE67C5FB59A}
[2012.06.03 18:19:46 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{FFA19CC2-230A-4326-A26A-DC6EF3ED708F}
[2012.06.03 16:30:54 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{44D3C68F-9133-40DD-BA5E-F1D80E654CC6}
[2012.06.03 16:30:33 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{695EFA0C-1401-46A2-8325-FF1A24C67F4C}
[2012.06.03 10:42:15 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{4A73707C-F489-426B-8DD1-D77A1F6FDC7F}
[2012.06.03 10:41:54 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{31DD13D9-F550-4F5A-8AF0-9B08FB49B486}
[2012.06.03 09:28:22 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{4C974236-C834-42DF-B66F-1955D00491BF}
[2012.06.03 09:28:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{660A40F9-A8CD-4612-9974-5D42D2F33DED}
[2012.06.02 20:13:03 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{406DC126-8817-45CD-A1F6-376527886EA8}
[2012.06.02 20:12:42 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{3FFC60CC-3688-4180-BAFF-964135FCA623}
[2012.06.02 18:21:24 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{61FF4240-8772-4621-84DB-7BC2C97E8723}
[2012.06.02 18:21:03 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2D5221AE-E901-429E-834E-73AF68868BE7}
[2012.06.02 18:13:57 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{17D82328-FBE7-4548-938A-0D35E2E7C1C8}
[2012.06.02 18:13:35 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2C545DA0-B434-49BE-9E06-DB36CC080238}
[2012.06.02 16:06:20 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{3F0D5D90-D43E-4BA2-B513-225DB858B261}
[2012.06.02 16:05:59 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{7558BA9F-CCB9-43D1-925B-6F81B70A7C99}
[2012.06.02 14:30:22 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{AC043A89-B562-4548-AD34-854306697ED3}
[2012.06.02 14:30:01 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{94E2E69C-200B-4A87-8BAC-CEA3AB9A3858}
[2012.06.02 09:12:30 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{A84F802E-DAEA-4B81-8921-C3B1F11A4707}
[2012.06.02 09:12:07 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{EA0FF724-E4E4-4655-A13E-73DADC500658}
[2012.06.01 20:51:46 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{916F53F7-8621-4E2C-B628-7C3BA41EF4DB}
[2012.06.01 17:49:55 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{711EBB45-EC04-4FAE-9B8C-38AD71568E40}
[2012.06.01 17:49:34 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{18D62813-085D-4E6C-828B-232ABBEEEF16}
[2012.06.01 17:09:46 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{33A49C86-9AFD-414D-BFB4-744FE4DBAB44}
[2012.06.01 17:09:24 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{023E72CA-6376-425A-A62D-C8F6851A136E}
[2012.06.01 15:44:58 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{8C527B64-58AE-41DC-BF85-D885B066D274}
[2012.06.01 15:44:37 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2208EBF7-08E4-4672-B99B-16B666435E4E}
[2012.05.31 20:05:43 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{702AA196-6FF1-4468-80F8-3A0C55349034}
[2012.05.31 20:05:22 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{E8DD09BC-3D60-4914-AF14-F2BF3707AD74}
[2012.05.31 17:33:16 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{AD40EF41-533A-4F70-B68D-342F58D3D4D9}
[2012.05.31 17:32:53 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2F95CBC4-0E00-448C-BA5F-A6041BFFBE9F}
[2012.05.30 18:27:35 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{DCB234A8-4F14-4F8A-A9C4-6175AC3B2BA7}
[2012.05.30 18:27:14 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{3B443606-432B-47A6-8F97-8B9D75407073}
[2012.05.30 18:12:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{3F3213AF-34FE-4A3C-800B-ECA5C2A42B45}
[2012.05.30 16:52:50 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{33E30836-8975-4565-BE1D-5DDC02A07232}
[2012.05.30 16:52:29 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{7B7F0E18-922F-4EC4-8AAE-08B04CA33CAF}
[2012.05.29 21:04:24 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{578254E7-B8F7-425B-A3B6-53C24D47F699}
[2012.05.29 21:04:03 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{22DC8CC0-0B5E-43A3-AD3C-465AD797B0CA}
[2012.05.29 20:19:26 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2EFC369B-ED39-4925-A949-AAAC2F62750E}
[2012.05.29 20:19:03 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{6ABFEA33-2878-43D8-A43D-1319C056D467}
[2012.05.29 17:56:43 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{88A547A5-9907-45FA-92D5-C1EE13FB5018}
[2012.05.29 17:56:22 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{4370737D-6134-41E2-BD4C-B70AE9D9E321}
[2012.05.29 17:39:44 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe
[2012.05.29 17:19:43 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{D658E1F5-8797-4EC4-BB0C-99C2D7DD1602}
[2012.05.29 17:19:21 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{AA231AA0-461A-42F5-AC79-F8AA71522E47}
[2012.05.28 21:27:54 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{07F2B0D4-2A42-445E-89C6-A6C6D506DE84}
[2012.05.28 21:27:33 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{C5629840-B195-415E-93F7-5B6EDF0F7472}
[2012.05.28 19:23:50 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{00343808-B43E-4FDF-8ABB-EA139981E271}
[2012.05.28 19:23:28 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{9B64C16F-7202-473A-B752-F4F2FAB9604F}
[2012.05.28 18:06:58 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{60A3A18D-70D4-45A1-942D-1B4AEFE4AD90}
[2012.05.28 18:06:37 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{4C0D9836-7A22-43D5-98A7-D48EDD5C220A}
[2012.05.28 16:39:16 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{A466910F-A396-4E96-A407-5D79E6F6A32D}
[2012.05.28 16:38:54 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{9CC06A2B-6EE2-4F7C-9769-35013BC140D9}
[2012.05.28 15:06:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Macrovision
[2012.05.28 15:06:29 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2012.05.28 15:06:18 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Macrovision Shared
[2012.05.28 15:06:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS
[2012.05.28 15:06:04 | 000,000,000 | ---D | C] -- C:\Program Files\ArcGIS
[2012.05.28 14:56:53 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{C2893615-A733-4A5D-ACA6-E232C27EC629}
[2012.05.28 14:27:10 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{0A92EDC7-577C-4C6C-BC9F-AC8BB71C824C}
[2012.05.28 14:26:46 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{BCB4E447-9936-4C1E-ADE9-B4037BAFF057}
[2012.05.28 11:46:13 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{60A4B995-9CBD-4557-B94C-EF12AD74C514}
[2012.05.28 11:45:51 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{742DB147-F5C4-4343-BE2E-CC8BE54003A2}
[2012.05.28 09:33:22 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{E27A8F2E-58A4-4CAA-AF5A-0C5F187A6A38}
[2012.05.28 09:33:01 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{93D8BFA6-314C-4E34-ACB2-1AABCDF0045B}
[2012.05.27 13:32:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{F2BB5EC1-2DF6-479E-90DC-9BD0A82EC8C4}
[2012.05.27 13:31:39 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{A7323F44-DC1F-4B70-BEA8-13383F129BF0}
[2012.05.27 12:25:18 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{40D01E2C-8FD5-4A74-A578-0E334774B93C}
[2012.05.27 12:24:57 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{3E76BDB9-3830-4457-BA64-F2EEB8CD4F90}
[2012.05.27 09:31:26 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{08713810-3D9F-4A88-9F35-1BDD1051B8F1}
[2012.05.27 09:31:05 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{8645FB2B-0576-4819-90D9-697F3C40E25B}
[2012.05.27 08:06:44 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{298615DD-D5BC-493D-8CB2-CB82C97C072F}
[2012.05.27 08:06:22 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{497FA8D0-6319-429C-A945-3B2688E82840}
[2012.05.26 23:21:30 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{C72D7920-63D0-4D44-A550-C1EFBA4AF678}
[2012.05.26 23:21:09 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{A360A2E4-CC63-4692-A71C-3FF661A3A59F}
[2012.05.26 23:18:17 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{8F4A5933-DAAF-40B0-9E1E-AB605CF887C2}
[2012.05.26 22:27:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Xoyz
[2012.05.26 22:27:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Xosaax
[2012.05.26 22:27:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Hepou
[2012.05.26 17:53:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{FFCD3756-4629-47D6-BFF5-5A170CFFB1CA}
[2012.05.26 17:53:33 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{27336804-5A83-43AC-81C3-32C5CEE32017}
[2012.05.26 08:17:35 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2EE7A628-23D2-414C-8DD1-AFCAC7D6FA5D}
[2012.05.26 08:17:24 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{6A5BCAA0-C426-45A3-9B15-A8C44404A808}
[2012.05.25 20:53:05 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{0212FF09-A0C0-4ECD-A468-9110CFE6725E}
[2012.05.25 20:52:43 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{BF670025-0425-4642-A295-D86D54D2C513}
[2012.05.25 20:22:45 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{D10CE2B9-B337-45E1-9CB3-8DB6F4A69899}
[2012.05.25 20:22:35 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{0902F138-D908-4BA6-B33E-03AD914688AF}
[2012.05.25 20:01:18 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{B9C93B3D-D966-4E3E-B29D-5A548DD1BB0D}
[2012.05.25 20:00:57 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{991697C6-980C-4C93-AA83-1B389BE88F91}
[2012.05.25 18:54:32 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{FBFCCF18-255C-4230-9E4C-0C9A848F2E74}
[2012.05.25 18:54:11 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{9D186EBA-944A-49D6-A9BC-68680FC00CE9}
[2012.05.25 18:28:25 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{36FD2A69-1B65-466E-B9CA-4371A77DBAB7}
[2012.05.25 18:28:03 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{30D82AA4-E94E-4AF7-899E-FBA93112FA87}
[2012.05.25 18:20:24 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{661C5169-CE36-4504-91C0-A1454A4E435D}
[2012.05.25 18:20:03 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{D19FF07F-33B7-47CC-906A-8A4A6144BBDE}
[2012.05.25 18:14:07 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{005694A0-279A-49FE-976D-62B20C1896E7}
[2012.05.25 18:13:44 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{8E13B2F4-58B0-4F84-9119-A1511D79B306}
[2012.05.25 17:36:37 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{D27F983F-334E-497C-BC95-059A896624CC}
[2012.05.25 17:36:15 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{02EE096A-3A16-4FDB-9BE0-A93DE98B3543}
[2012.05.25 17:15:48 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{6B41EA12-2D5C-45D2-8C56-2D98784C43DD}
[2012.05.25 17:15:26 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2F88112A-BDBC-47B5-9943-168FEE9FC28A}
[2012.05.25 15:04:28 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{BA2C61DA-E263-4BDF-AEBC-FA6AE7125492}
[2012.05.25 15:04:07 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{C90C043B-207B-4701-85C3-C3B99367A4C0}
[2012.05.25 14:53:01 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{80AE2BD3-C9F1-42D1-8E90-BCBBAF399F03}
[2012.05.25 14:52:39 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{0CDC75E3-09A3-4338-B5CA-D067661946A8}
[2012.05.25 14:40:08 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{4336CBBF-1F93-45F4-AAB8-424572EDB844}
[2012.05.25 14:21:26 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{C0D44067-34E0-4C16-8313-84869C33B2BA}
[2012.05.25 14:21:05 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{1A712885-A1A4-4A08-9FC4-7069359768CB}
[2012.05.25 13:41:27 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{66D49911-84EE-4FCC-80F7-C931F5E07D37}
[2012.05.25 13:41:06 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{6F3A567F-CCDE-48A0-A3C1-C13AFFE3FDB8}
[2012.05.25 13:28:20 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{4BB2EF86-55F7-4472-B062-D9175200C633}
[2012.05.25 13:27:57 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{44227E19-32EF-4E95-A6E6-86CE232C10D7}
[2012.05.25 11:25:21 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{6072DCFA-9723-4A65-973F-1B9FCDA63124}
[2012.05.25 11:25:00 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{FD950060-AD4E-445F-8719-795B73DDD1DB}
[2012.05.25 10:50:35 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{B57D63CA-4B55-42D5-BD23-EAA1793CDBAE}
[2012.05.25 10:50:14 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{79E392EE-9CB1-4145-88DA-488ED6C3B9E5}
[2012.05.25 10:41:41 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{D61537C7-748E-4253-9BAB-D558B9CACDF7}
[2012.05.25 10:13:47 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2DA1F4CF-60B8-4A21-9ECA-43AE78B58F34}
[2012.05.25 10:13:26 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{9633F56D-8A9F-4AB5-A1C7-900C06F8E223}
[2012.05.25 09:04:52 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{2CD74460-0169-4C4F-93BA-8054E880654C}
[2012.05.25 09:04:30 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{5F422A0A-7077-4FE1-8075-F8BC710BEE20}
[2012.05.24 21:15:16 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{3D51B460-9A23-4E73-AD69-589D4626996A}
[2012.05.24 21:15:05 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{12E8F401-A437-4A61-8BDA-D5739D0282ED}
[2012.05.24 17:51:27 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{1A6CF54A-1DA7-431B-9AAE-1AB1D51D7BA6}
[2012.05.24 17:51:17 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{C3E01E22-024B-42AA-AA52-75C7B8372DF0}
[2012.05.24 16:33:15 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{F45A194D-EB75-4760-9DB6-B63145077EBB}
[2012.05.24 16:32:55 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\{92C60E8E-3A1B-4DB2-84D8-69F47DD3B1A0}
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.20 09:06:45 | 000,011,040 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.20 09:06:45 | 000,011,040 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.20 08:59:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.20 08:58:50 | 2414,481,408 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.18 09:24:49 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.17 19:40:30 | 000,977,882 | ---- | M] () -- C:\Users\xxx\Desktop\bewerbung_xxx.pdf
[2012.05.29 17:39:44 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe
[2012.05.29 17:38:22 | 000,000,000 | ---- | M] () -- C:\Users\xxx\defogger_reenable
[2012.05.29 17:37:01 | 000,050,477 | ---- | M] () -- C:\Users\xxx\Desktop\Defogger.exe
[2012.05.28 14:27:26 | 001,812,736 | ---- | M] () -- C:\Users\xxx\Desktop\InVeKoS_2012_Einführung.pdf
[2012.05.28 10:04:19 | 000,007,411 | ---- | M] () -- C:\Users\xxx\Desktop\328_5026_1854_Bestätigung der Annahme UStVA 2012 - 1. Quartal_ElsterOnline6.pdf
[2012.05.25 15:09:23 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.05.25 15:09:23 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.05.25 15:09:23 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.05.25 15:09:23 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
 
========== Files Created - No Company Name ==========
 
[2012.06.18 09:24:49 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.17 19:40:29 | 000,977,882 | ---- | C] () -- C:\Users\xxx\Desktop\bewerbung_xxx.pdf
[2012.05.29 17:38:22 | 000,000,000 | ---- | C] () -- C:\Users\xxx\defogger_reenable
[2012.05.29 17:37:01 | 000,050,477 | ---- | C] () -- C:\Users\xxx\Desktop\Defogger.exe
[2012.05.28 14:27:25 | 001,812,736 | ---- | C] () -- C:\Users\xxx\Desktop\InVeKoS_2012_Einführung.pdf
[2012.05.28 10:04:19 | 000,007,411 | ---- | C] () -- C:\Users\xxx\Desktop\328_5026_1854_Bestätigung der Annahme UStVA 2012 - 1. Quartal_ElsterOnline6.pdf
[2012.04.05 13:29:53 | 000,299,073 | ---- | C] () -- C:\Windows\System32\PythonCOM21.dll
[2012.04.05 13:29:53 | 000,065,536 | ---- | C] () -- C:\Windows\System32\PyWinTypes21.dll
[2011.12.29 20:45:35 | 000,000,138 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011.12.29 17:57:12 | 000,021,532 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2011.12.29 17:24:00 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2011.05.13 10:04:16 | 000,208,896 | ---- | C] () -- C:\Windows\System32\LXPrnUtil10.dll
[2011.05.13 10:03:16 | 000,303,104 | ---- | C] () -- C:\Windows\System32\dnt27VC8.dll
[2011.05.13 10:01:22 | 000,143,360 | ---- | C] () -- C:\Windows\System32\dntvmc27VC8.dll
[2011.05.13 10:01:00 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dntvm27VC8.dll
[2011.05.01 19:35:30 | 000,167,018 | ---- | C] () -- C:\Windows\hpwins05.dat
[2011.05.01 01:32:09 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2011.05.01 01:32:09 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2011.04.30 16:15:52 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.04.12 03:30:05 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2011.04.12 03:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2011.04.12 03:30:05 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2011.04.12 03:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2010.11.20 23:29:26 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
 
========== LOP Check ==========
 
[2011.12.29 17:39:22 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Easy Thumbnails
[2012.03.12 15:53:23 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\elsterformular
[2012.04.05 13:33:30 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\ESRI
[2012.05.26 22:27:56 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Hepou
[2012.01.28 15:07:23 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\ICQ
[2012.01.07 18:46:26 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Lexware
[2011.12.29 17:39:23 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\MAXON
[2011.12.29 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Nemetschek
[2011.12.29 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\PlagiarismFinder
[2011.12.29 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Samsung
[2011.12.30 11:17:00 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Windows Live Writer
[2012.06.20 09:02:48 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Xosaax
[2012.05.26 22:27:56 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Xoyz
[2012.05.28 16:33:17 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.12.29 17:39:21 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Adobe
[2012.01.07 14:13:00 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Apple Computer
[2011.12.29 17:39:22 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\ATI
[2011.12.29 17:39:22 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Avira
[2011.12.29 17:39:22 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Easy Thumbnails
[2012.03.12 15:53:23 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\elsterformular
[2012.04.05 13:33:30 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\ESRI
[2012.05.26 22:27:56 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Hepou
[2011.12.29 17:39:22 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\HP
[2011.12.29 17:39:22 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\HpUpdate
[2012.01.28 15:07:23 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\ICQ
[2011.12.29 21:18:18 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Identities
[2012.01.07 18:46:26 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Lexware
[2011.12.29 17:39:22 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Macromedia
[2012.06.18 09:24:55 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Malwarebytes
[2011.12.29 17:39:23 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\MAXON
[2011.04.12 03:39:07 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Media Center Programs
[2012.05.25 17:27:10 | 000,000,000 | --SD | M] -- C:\Users\xxx\AppData\Roaming\Microsoft
[2011.12.29 17:39:29 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Mozilla
[2011.12.29 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Nemetschek
[2011.12.29 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\PlagiarismFinder
[2011.12.29 17:39:31 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Samsung
[2011.12.30 11:17:00 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Windows Live Writer
[2012.06.20 09:02:48 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Xosaax
[2012.05.26 22:27:56 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Xoyz
 
< %APPDATA%\*.exe /s >
[2012.04.26 17:50:37 | 004,277,440 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_8479_8623.exe
[2012.04.26 17:50:59 | 004,275,120 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_8479_8623.exe
[2012.04.26 17:51:20 | 004,264,240 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_12_8479_8623.exe
[2012.04.26 17:51:42 | 004,573,816 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_09_8479_8623.exe
[2012.04.26 17:52:12 | 005,762,152 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_10_8479_8623.exe
[2012.04.26 17:52:42 | 005,937,224 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_est_11_8479_8623.exe
[2012.04.26 17:53:05 | 004,316,616 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_8479_8623.exe
[2012.04.26 17:53:26 | 004,309,624 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_10_8479_8623.exe
[2012.04.26 17:53:49 | 004,591,856 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_11_8479_8623.exe
[2012.04.26 17:55:16 | 004,271,616 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_09_8479_8623.exe
[2012.04.26 17:55:37 | 004,272,896 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_10_8479_8623.exe
[2012.04.26 17:55:59 | 004,506,672 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_11_8479_8623.exe
[2012.04.26 17:54:11 | 004,278,864 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_09_8479_8623.exe
[2012.04.26 17:54:33 | 004,278,384 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_10_8479_8623.exe
[2012.04.26 17:54:55 | 004,504,904 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_11_8479_8623.exe
[2012.04.26 17:56:21 | 004,269,256 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_8479_8623.exe
[2012.04.26 17:56:42 | 004,286,816 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_8479_8623.exe
[2012.04.26 17:57:03 | 004,267,496 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_12_8479_8623.exe
[2012.04.26 17:57:24 | 004,300,704 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_10_8479_8623.exe
[2012.04.26 17:57:46 | 004,301,752 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_11_8479_8623.exe
[2012.04.26 17:58:07 | 004,318,152 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_12_8479_8623.exe
[2012.04.26 17:58:28 | 004,278,352 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_09_8479_8623.exe
[2012.04.26 17:58:50 | 004,290,960 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_10_8479_8623.exe
[2012.04.26 17:59:12 | 004,282,328 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_11_8479_8623.exe
[2012.04.26 17:50:00 | 005,576,392 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_8479_8623.exe
[2012.04.26 18:00:33 | 004,272,528 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_8479_8623.exe
[2012.04.26 18:00:51 | 004,272,848 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_8479_8623.exe
[2012.04.26 18:01:09 | 004,288,088 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_12_8479_8623.exe
[2012.04.26 17:59:34 | 004,287,560 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_09_8479_8623.exe
[2012.04.26 17:59:55 | 004,284,592 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_10_8479_8623.exe
[2012.04.26 18:00:16 | 004,290,016 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\xxx\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_11_8479_8623.exe
[2012.02.17 02:02:12 | 000,360,960 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\Xoyz\olow.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 23:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\drivers\iaStorV.sys
[2010.11.20 23:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 23:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 23:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 23:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2007.01.06 07:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_29af12c5857181b0\nvstor.sys
[2007.01.06 07:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvstor.inf_x86_neutral_2d190bda0635df72\nvstor.sys
[2010.11.20 23:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\drivers\nvstor.sys
[2010.11.20 23:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 23:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.11.20 23:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 23:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 23:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 23:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 23:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 23:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 23:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 23:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >

cosinus 20.06.2012 10:06
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
IE - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q="
[2012.03.29 20:13:09 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.06.15 16:38:49 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ft2iwcdl.default\searchplugins\icqplugin-1.xml
[2011.11.06 12:45:18 | 000,001,056 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ft2iwcdl.default\searchplugins\icqplugin.xml
O2 - BHO: (ICQ Sparberater) - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - C:\Programme\icq\Internet Explorer\icq.dll (solute gmbh)
O4 - HKU\S-1-5-21-3501483959-2219181981-1860870347-1000..\Run: [Cixyi] C:\Users\xxx\AppData\Roaming\Xoyz\olow.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{9aba0abc-3230-11e1-b5d3-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{9aba0abc-3230-11e1-b5d3-806e6f6e6963}\Shell\AutoRun\command - "" = F:\ESRI.exe
[2012.05.26 22:27:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Xoyz
[2012.05.26 22:27:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Xosaax
[2012.05.26 22:27:56 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Hepou
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

dennis8 20.06.2012 10:52
top! :applaus: Die besagten Webseiten können schon mal wieder geöffnet werden.
Kannst Du kurz sagen wer oder was das Problem verursacht hat? Konnte es komplett beseitigt werden?



Code:
All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-3501483959-2219181981-1860870347-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q=" removed from browser.search.defaulturl
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q=" removed from keyword.URL
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\components folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\tr folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\sk folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\ru folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\it folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\he folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\fr folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\es folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\en-US folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\de folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\cs folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\bg folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome folder moved successfully.
C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\ft2iwcdl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} folder moved successfully.
C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ft2iwcdl.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ft2iwcdl.default\searchplugins\icqplugin.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE163F11-1919-4257-A280-FF5AF8DAEECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE163F11-1919-4257-A280-FF5AF8DAEECB}\ deleted successfully.
C:\Programme\icq\Internet Explorer\icq.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-3501483959-2219181981-1860870347-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Cixyi deleted successfully.
C:\Users\xxx\AppData\Roaming\Xoyz\olow.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9aba0abc-3230-11e1-b5d3-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9aba0abc-3230-11e1-b5d3-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9aba0abc-3230-11e1-b5d3-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9aba0abc-3230-11e1-b5d3-806e6f6e6963}\ not found.
File F:\ESRI.exe not found.
C:\Users\xxx\AppData\Roaming\Xoyz folder moved successfully.
C:\Users\xxx\AppData\Roaming\Xosaax folder moved successfully.
C:\Users\xxx\AppData\Roaming\Hepou folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: xxx
->Temp folder emptied: 73904621 bytes
->Temporary Internet Files folder emptied: 55359387 bytes
->Java cache emptied: 2391273 bytes
->FireFox cache emptied: 1063417967 bytes
->Flash cache emptied: 587 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 56725607 bytes
RecycleBin emptied: 3278520683 bytes
 
Total Files Cleaned = 4.321,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: xxx
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.44.0 log created on 06202012_112712

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus 20.06.2012 11:23
Da waren noch Malwareeinträge, die den Zugriff blockierten

Ich brauch den Quarantäneordner von OTL. Bitte folgendes machen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinflussen!
2.) Ordner MovedFiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

dennis8 20.06.2012 12:15
habe es gerade hochgeladen.

cosinus 20.06.2012 12:22
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

dennis8 21.06.2012 09:52
und noch ein log:

Code:
10:47:14.0288 4272        TDSS rootkit removing tool 2.7.41.0 Jun 20 2012 20:53:32
10:47:14.0507 4272        ============================================================
10:47:14.0507 4272        Current date / time: 2012/06/21 10:47:14.0507
10:47:14.0507 4272        SystemInfo:
10:47:14.0507 4272       
10:47:14.0507 4272        OS Version: 6.1.7601 ServicePack: 1.0
10:47:14.0507 4272        Product type: Workstation
10:47:14.0507 4272        ComputerName: xxx-PC
10:47:14.0507 4272        UserName: xxx
10:47:14.0507 4272        Windows directory: C:\Windows
10:47:14.0507 4272        System windows directory: C:\Windows
10:47:14.0507 4272        Processor architecture: Intel x86
10:47:14.0507 4272        Number of processors: 4
10:47:14.0507 4272        Page size: 0x1000
10:47:14.0507 4272        Boot type: Normal boot
10:47:14.0507 4272        ============================================================
10:47:15.0474 4272        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
10:47:15.0505 4272        ============================================================
10:47:15.0505 4272        \Device\Harddisk0\DR0:
10:47:15.0505 4272        MBR partitions:
10:47:15.0505 4272        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1B800, BlocksNum 0x1400000
10:47:15.0505 4272        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x141B800, BlocksNum 0x38F6A000
10:47:15.0505 4272        ============================================================
10:47:15.0521 4272        C: <-> \Device\Harddisk0\DR0\Partition1
10:47:15.0552 4272        D: <-> \Device\Harddisk0\DR0\Partition0
10:47:15.0552 4272        ============================================================
10:47:15.0552 4272        Initialize success
10:47:15.0552 4272        ============================================================
10:47:26.0721 3436        ============================================================
10:47:26.0721 3436        Scan started
10:47:26.0721 3436        Mode: Manual; SigCheck; TDLFS;
10:47:26.0721 3436        ============================================================
10:47:28.0110 3436        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
10:47:28.0235 3436        1394ohci - ok
10:47:28.0250 3436        ACPI            (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
10:47:28.0266 3436        ACPI - ok
10:47:28.0281 3436        AcpiPmi        (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
10:47:28.0328 3436        AcpiPmi - ok
10:47:28.0359 3436        adp94xx        (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\drivers\adp94xx.sys
10:47:28.0391 3436        adp94xx - ok
10:47:28.0406 3436        adpahci        (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\drivers\adpahci.sys
10:47:28.0422 3436        adpahci - ok
10:47:28.0453 3436        adpu320        (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\drivers\adpu320.sys
10:47:28.0469 3436        adpu320 - ok
10:47:28.0500 3436        AeLookupSvc    (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll
10:47:28.0578 3436        AeLookupSvc - ok
10:47:28.0625 3436        AFD            (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys
10:47:28.0703 3436        AFD - ok
10:47:28.0718 3436        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
10:47:28.0734 3436        agp440 - ok
10:47:28.0749 3436        aic78xx        (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\drivers\djsvs.sys
10:47:28.0765 3436        aic78xx - ok
10:47:28.0781 3436        ALG            (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe
10:47:28.0827 3436        ALG - ok
10:47:28.0843 3436        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
10:47:28.0859 3436        aliide - ok
10:47:28.0890 3436        AMD External Events Utility (b19505648f033393e907e2e419fde8b3) C:\Windows\system32\atiesrxx.exe
10:47:28.0937 3436        AMD External Events Utility - ok
10:47:28.0937 3436        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
10:47:28.0952 3436        amdagp - ok
10:47:28.0952 3436        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys
10:47:28.0968 3436        amdide - ok
10:47:28.0983 3436        AmdK8          (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\drivers\amdk8.sys
10:47:29.0015 3436        AmdK8 - ok
10:47:29.0015 3436        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\drivers\amdppm.sys
10:47:29.0046 3436        AmdPPM - ok
10:47:29.0061 3436        amdsata        (e7f4d42d8076ec60e21715cd11743a0d) C:\Windows\system32\drivers\amdsata.sys
10:47:29.0061 3436        amdsata - ok
10:47:29.0093 3436        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\drivers\amdsbs.sys
10:47:29.0108 3436        amdsbs - ok
10:47:29.0124 3436        amdxata        (146459d2b08bfdcbfa856d9947043c81) C:\Windows\system32\drivers\amdxata.sys
10:47:29.0124 3436        amdxata - ok
10:47:29.0217 3436        AntiVirSchedulerService (c27d46b06d340293670450fce9dfb166) C:\Program Files\Avira\AntiVir Desktop\sched.exe
10:47:29.0233 3436        AntiVirSchedulerService - ok
10:47:29.0264 3436        AntiVirService  (72d90e56563165984224493069c69ed4) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
10:47:29.0280 3436        AntiVirService - ok
10:47:29.0295 3436        AppID          (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
10:47:29.0342 3436        AppID - ok
10:47:29.0389 3436        AppIDSvc        (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll
10:47:29.0436 3436        AppIDSvc - ok
10:47:29.0451 3436        Appinfo        (fb1959012294d6ad43e5304df65e3c26) C:\Windows\System32\appinfo.dll
10:47:29.0498 3436        Appinfo - ok
10:47:29.0561 3436        Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
10:47:29.0561 3436        Apple Mobile Device - ok
10:47:29.0607 3436        AppMgmt        (a45d184df6a8803da13a0b329517a64a) C:\Windows\System32\appmgmts.dll
10:47:29.0639 3436        AppMgmt - ok
10:47:29.0685 3436        arc            (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\drivers\arc.sys
10:47:29.0701 3436        arc - ok
10:47:29.0810 3436        ArcGIS License Manager (a1ba9e0f78ad9356af750063197f4bdf) C:\Program Files\ArcGIS\License10.0\bin\lmgrd.exe
10:47:29.0841 3436        ArcGIS License Manager - ok
10:47:29.0935 3436        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\drivers\arcsas.sys
10:47:29.0951 3436        arcsas - ok
10:47:29.0966 3436        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
10:47:30.0044 3436        AsyncMac - ok
10:47:30.0060 3436        atapi          (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
10:47:30.0060 3436        atapi - ok
10:47:30.0325 3436        atikmdag        (04f09923a393e4e0e8453a8f78361e73) C:\Windows\system32\DRIVERS\atikmdag.sys
10:47:30.0465 3436        atikmdag - ok
10:47:30.0575 3436        AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
10:47:30.0653 3436        AudioEndpointBuilder - ok
10:47:30.0653 3436        Audiosrv        (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
10:47:30.0684 3436        Audiosrv - ok
10:47:30.0746 3436        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
10:47:30.0762 3436        avgntflt - ok
10:47:30.0777 3436        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
10:47:30.0793 3436        avipbb - ok
10:47:30.0809 3436        AxInstSV        (6e30d02aac9cac84f421622e3a2f6178) C:\Windows\System32\AxInstSV.dll
10:47:30.0855 3436        AxInstSV - ok
10:47:30.0918 3436        b06bdrv        (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\drivers\bxvbdx.sys
10:47:30.0949 3436        b06bdrv - ok
10:47:30.0980 3436        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
10:47:31.0011 3436        b57nd60x - ok
10:47:31.0074 3436        BDESVC          (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll
10:47:31.0105 3436        BDESVC - ok
10:47:31.0121 3436        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
10:47:31.0167 3436        Beep - ok
10:47:31.0199 3436        BFE            (1e2bac209d184bb851e1a187d8a29136) C:\Windows\System32\bfe.dll
10:47:31.0245 3436        BFE - ok
10:47:31.0292 3436        BITS            (e585445d5021971fae10393f0f1c3961) C:\Windows\System32\qmgr.dll
10:47:31.0323 3436        BITS - ok
10:47:31.0339 3436        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
10:47:31.0355 3436        blbdrive - ok
10:47:31.0448 3436        Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe
10:47:31.0464 3436        Bonjour Service - ok
10:47:31.0479 3436        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
10:47:31.0511 3436        bowser - ok
10:47:31.0542 3436        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\BrFiltLo.sys
10:47:31.0573 3436        BrFiltLo - ok
10:47:31.0573 3436        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\BrFiltUp.sys
10:47:31.0620 3436        BrFiltUp - ok
10:47:31.0667 3436        Browser        (6e11f33d14d020f58d5e02e4d67dfa19) C:\Windows\System32\browser.dll
10:47:31.0745 3436        Browser - ok
10:47:31.0760 3436        Brserid        (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
10:47:31.0776 3436        Brserid - ok
10:47:31.0791 3436        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
10:47:31.0807 3436        BrSerWdm - ok
10:47:31.0823 3436        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
10:47:31.0838 3436        BrUsbMdm - ok
10:47:31.0838 3436        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
10:47:31.0869 3436        BrUsbSer - ok
10:47:31.0869 3436        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\drivers\bthmodem.sys
10:47:31.0901 3436        BTHMODEM - ok
10:47:31.0916 3436        bthserv        (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll
10:47:31.0947 3436        bthserv - ok
10:47:31.0979 3436        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
10:47:32.0010 3436        cdfs - ok
10:47:32.0057 3436        cdrom          (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\DRIVERS\cdrom.sys
10:47:32.0088 3436        cdrom - ok
10:47:32.0119 3436        CertPropSvc    (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
10:47:32.0150 3436        CertPropSvc - ok
10:47:32.0166 3436        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\drivers\circlass.sys
10:47:32.0181 3436        circlass - ok
10:47:32.0197 3436        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
10:47:32.0213 3436        CLFS - ok
10:47:32.0291 3436        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
10:47:32.0306 3436        clr_optimization_v2.0.50727_32 - ok
10:47:32.0353 3436        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
10:47:32.0369 3436        clr_optimization_v4.0.30319_32 - ok
10:47:32.0369 3436        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\drivers\CmBatt.sys
10:47:32.0384 3436        CmBatt - ok
10:47:32.0400 3436        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
10:47:32.0415 3436        cmdide - ok
10:47:32.0447 3436        CNG            (6427525d76f61d0c519b008d3680e8e7) C:\Windows\system32\Drivers\cng.sys
10:47:32.0462 3436        CNG - ok
10:47:32.0478 3436        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\drivers\compbatt.sys
10:47:32.0478 3436        Compbatt - ok
10:47:32.0509 3436        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\DRIVERS\CompositeBus.sys
10:47:32.0525 3436        CompositeBus - ok
10:47:32.0540 3436        COMSysApp - ok
10:47:32.0556 3436        crcdisk        (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\drivers\crcdisk.sys
10:47:32.0571 3436        crcdisk - ok
10:47:32.0603 3436        CryptSvc        (a585bebf7d054bd9618eda0922d5484a) C:\Windows\system32\cryptsvc.dll
10:47:32.0618 3436        CryptSvc - ok
10:47:32.0665 3436        CSC            (3c2177a897b4ca2788c6fb0c3fd81d4b) C:\Windows\system32\drivers\csc.sys
10:47:32.0712 3436        CSC - ok
10:47:32.0743 3436        CscService      (15f93b37f6801943360d9eb42485d5d3) C:\Windows\System32\cscsvc.dll
10:47:32.0774 3436        CscService - ok
10:47:32.0821 3436        DcomLaunch      (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll
10:47:32.0852 3436        DcomLaunch - ok
10:47:32.0899 3436        defragsvc      (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll
10:47:32.0930 3436        defragsvc - ok
10:47:32.0993 3436        DfsC            (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
10:47:33.0008 3436        DfsC - ok
10:47:33.0055 3436        Dhcp            (e9e01eb683c132f7fa27cd607b8a2b63) C:\Windows\system32\dhcpcore.dll
10:47:33.0086 3436        Dhcp - ok
10:47:33.0102 3436        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
10:47:33.0117 3436        discache - ok
10:47:33.0149 3436        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\drivers\disk.sys
10:47:33.0149 3436        Disk - ok
10:47:33.0180 3436        dmvsc          (2a958ef85db1b61ffca65044fa4bce9e) C:\Windows\system32\drivers\dmvsc.sys
10:47:33.0211 3436        dmvsc - ok
10:47:33.0242 3436        Dnscache        (33ef4861f19a0736b11314aad9ae28d0) C:\Windows\System32\dnsrslvr.dll
10:47:33.0273 3436        Dnscache - ok
10:47:33.0305 3436        dot3svc        (366ba8fb4b7bb7435e3b9eacb3843f67) C:\Windows\System32\dot3svc.dll
10:47:33.0336 3436        dot3svc - ok
10:47:33.0398 3436        Dot4            (b5e479eb83707dd698f66953e922042c) C:\Windows\system32\DRIVERS\Dot4.sys
10:47:33.0414 3436        Dot4 - ok
10:47:33.0445 3436        Dot4Print      (caefd09b6a6249c53a67d55a9a9fcabf) C:\Windows\system32\DRIVERS\Dot4Prt.sys
10:47:33.0461 3436        Dot4Print - ok
10:47:33.0476 3436        dot4usb        (cf491ff38d62143203c065260567e2f7) C:\Windows\system32\DRIVERS\dot4usb.sys
10:47:33.0523 3436        dot4usb - ok
10:47:33.0554 3436        DPS            (8ec04ca86f1d68da9e11952eb85973d6) C:\Windows\system32\dps.dll
10:47:33.0585 3436        DPS - ok
10:47:33.0617 3436        drmkaud        (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
10:47:33.0632 3436        drmkaud - ok
10:47:33.0695 3436        DXGKrnl        (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
10:47:33.0726 3436        DXGKrnl - ok
10:47:33.0757 3436        e1express      (cf0a6015f437161698c5b2a0a12cf052) C:\Windows\system32\DRIVERS\e1e6032.sys
10:47:33.0773 3436        e1express - ok
10:47:33.0804 3436        EapHost        (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll
10:47:33.0835 3436        EapHost - ok
10:47:33.0960 3436        ebdrv          (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\drivers\evbdx.sys
10:47:34.0022 3436        ebdrv - ok
10:47:34.0131 3436        EFS            (81951f51e318aecc2d68559e47485cc4) C:\Windows\System32\lsass.exe
10:47:34.0194 3436        EFS - ok
10:47:34.0256 3436        ehRecvr        (a8c362018efc87beb013ee28f29c0863) C:\Windows\ehome\ehRecvr.exe
10:47:34.0303 3436        ehRecvr - ok
10:47:34.0319 3436        ehSched        (d389bff34f80caede417bf9d1507996a) C:\Windows\ehome\ehsched.exe
10:47:34.0350 3436        ehSched - ok
10:47:34.0412 3436        elxstor        (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\drivers\elxstor.sys
10:47:34.0428 3436        elxstor - ok
10:47:34.0443 3436        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
10:47:34.0459 3436        ErrDev - ok
10:47:34.0506 3436        EventSystem    (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll
10:47:34.0553 3436        EventSystem - ok
10:47:34.0568 3436        exfat          (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
10:47:34.0599 3436        exfat - ok
10:47:34.0615 3436        fastfat        (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
10:47:34.0646 3436        fastfat - ok
10:47:34.0709 3436        Fax            (967ea5b213e9984cbe270205df37755b) C:\Windows\system32\fxssvc.exe
10:47:34.0740 3436        Fax - ok
10:47:34.0740 3436        fdc            (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
10:47:34.0771 3436        fdc - ok
10:47:34.0787 3436        fdPHost        (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll
10:47:34.0818 3436        fdPHost - ok
10:47:34.0818 3436        FDResPub        (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll
10:47:34.0849 3436        FDResPub - ok
10:47:34.0865 3436        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
10:47:34.0865 3436        FileInfo - ok
10:47:34.0880 3436        Filetrace      (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
10:47:34.0911 3436        Filetrace - ok
10:47:35.0021 3436        FLEXnet Licensing Service (abedfd48ac042c6aaad32452e77217a1) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
10:47:35.0036 3436        FLEXnet Licensing Service - ok
10:47:35.0052 3436        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\drivers\flpydisk.sys
10:47:35.0067 3436        flpydisk - ok
10:47:35.0099 3436        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
10:47:35.0114 3436        FltMgr - ok
10:47:35.0161 3436        FontCache      (fa6c66e4364d7da57aade5dcc03bb999) C:\Windows\system32\FntCache.dll
10:47:35.0208 3436        FontCache - ok
10:47:35.0270 3436        FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
10:47:35.0270 3436        FontCache3.0.0.0 - ok
10:47:35.0286 3436        FsDepends      (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
10:47:35.0301 3436        FsDepends - ok
10:47:35.0317 3436        Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
10:47:35.0317 3436        Fs_Rec - ok
10:47:35.0348 3436        fvevol          (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
10:47:35.0364 3436        fvevol - ok
10:47:35.0395 3436        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\drivers\gagp30kx.sys
10:47:35.0411 3436        gagp30kx - ok
10:47:35.0426 3436        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
10:47:35.0442 3436        GEARAspiWDM - ok
10:47:35.0489 3436        gpsvc          (e897eaf5ed6ba41e081060c9b447a673) C:\Windows\System32\gpsvc.dll
10:47:35.0535 3436        gpsvc - ok
10:47:35.0551 3436        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
10:47:35.0582 3436        hcw85cir - ok
10:47:35.0629 3436        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys
10:47:35.0660 3436        HdAudAddService - ok
10:47:35.0676 3436        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\DRIVERS\HDAudBus.sys
10:47:35.0691 3436        HDAudBus - ok
10:47:35.0691 3436        HidBatt        (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\drivers\HidBatt.sys
10:47:35.0723 3436        HidBatt - ok
10:47:35.0738 3436        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\drivers\hidbth.sys
10:47:35.0754 3436        HidBth - ok
10:47:35.0769 3436        HidIr          (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\drivers\hidir.sys
10:47:35.0785 3436        HidIr - ok
10:47:35.0801 3436        hidserv        (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\system32\hidserv.dll
10:47:35.0847 3436        hidserv - ok
10:47:35.0894 3436        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\DRIVERS\hidusb.sys
10:47:35.0925 3436        HidUsb - ok
10:47:35.0941 3436        hkmsvc          (196b4e3f4cccc24af836ce58facbb699) C:\Windows\system32\kmsvc.dll
10:47:35.0972 3436        hkmsvc - ok
10:47:35.0988 3436        HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\Windows\system32\ListSvc.dll
10:47:36.0019 3436        HomeGroupListener - ok
10:47:36.0050 3436        HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\Windows\system32\provsvc.dll
10:47:36.0097 3436        HomeGroupProvider - ok
10:47:36.0191 3436        hpqcxs08        (af81f7ba6a09119006fe041a2f2f3ece) C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
10:47:36.0191 3436        hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
10:47:36.0191 3436        hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
10:47:36.0222 3436        hpqddsvc        (7244f63db8ea883b3dc8e730c645d073) C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
10:47:36.0237 3436        hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
10:47:36.0237 3436        hpqddsvc - detected UnsignedFile.Multi.Generic (1)
10:47:36.0253 3436        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
10:47:36.0269 3436        HpSAMD - ok
10:47:36.0331 3436        HTTP            (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
10:47:36.0362 3436        HTTP - ok
10:47:36.0378 3436        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
10:47:36.0378 3436        hwpolicy - ok
10:47:36.0409 3436        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys
10:47:36.0425 3436        i8042prt - ok
10:47:36.0440 3436        iaStorV        (a3cae5d281db4cff7cff8233507ee5ad) C:\Windows\system32\drivers\iaStorV.sys
10:47:36.0456 3436        iaStorV - ok
10:47:36.0565 3436        idsvc          (c521d7eb6497bb1af6afa89e322fb43c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
10:47:36.0596 3436        idsvc - ok
10:47:36.0627 3436        iirsp          (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\drivers\iirsp.sys
10:47:36.0627 3436        iirsp - ok
10:47:36.0690 3436        IKEEXT          (f95622f161474511b8d80d6b093aa610) C:\Windows\System32\ikeext.dll
10:47:36.0737 3436        IKEEXT - ok
10:47:36.0752 3436        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
10:47:36.0752 3436        intelide - ok
10:47:36.0783 3436        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
10:47:36.0799 3436        intelppm - ok
10:47:36.0815 3436        IPBusEnum      (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll
10:47:36.0830 3436        IPBusEnum - ok
10:47:36.0861 3436        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
10:47:36.0908 3436        IpFilterDriver - ok
10:47:36.0939 3436        iphlpsvc        (4d65a07b795d6674312f879d09aa7663) C:\Windows\System32\iphlpsvc.dll
10:47:36.0971 3436        iphlpsvc - ok
10:47:36.0986 3436        IPMIDRV        (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
10:47:37.0002 3436        IPMIDRV - ok
10:47:37.0002 3436        IPNAT          (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
10:47:37.0033 3436        IPNAT - ok
10:47:37.0127 3436        iPod Service    (57edb35ea2feca88f8b17c0c095c9a56) C:\Program Files\iPod\bin\iPodService.exe
10:47:37.0142 3436        iPod Service - ok
10:47:37.0173 3436        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
10:47:37.0205 3436        IRENUM - ok
10:47:37.0220 3436        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
10:47:37.0220 3436        isapnp - ok
10:47:37.0251 3436        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
10:47:37.0267 3436        iScsiPrt - ok
10:47:37.0283 3436        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys
10:47:37.0298 3436        kbdclass - ok
10:47:37.0314 3436        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\DRIVERS\kbdhid.sys
10:47:37.0345 3436        kbdhid - ok
10:47:37.0361 3436        KeyIso          (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
10:47:37.0376 3436        KeyIso - ok
10:47:37.0407 3436        KSecDD          (f4647bb23db9038a7536cf6b68f4207f) C:\Windows\system32\Drivers\ksecdd.sys
10:47:37.0407 3436        KSecDD - ok
10:47:37.0439 3436        KSecPkg        (e73cae53bbb72ba26918492c6b4c229d) C:\Windows\system32\Drivers\ksecpkg.sys
10:47:37.0439 3436        KSecPkg - ok
10:47:37.0485 3436        KtmRm          (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll
10:47:37.0517 3436        KtmRm - ok
10:47:37.0548 3436        LanmanServer    (d64af876d53eca3668bb97b51b4e70ab) C:\Windows\system32\srvsvc.dll
10:47:37.0595 3436        LanmanServer - ok
10:47:37.0626 3436        LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\Windows\System32\wkssvc.dll
10:47:37.0657 3436        LanmanWorkstation - ok
10:47:37.0673 3436        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
10:47:37.0719 3436        lltdio - ok
10:47:37.0751 3436        lltdsvc        (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll
10:47:37.0782 3436        lltdsvc - ok
10:47:37.0797 3436        lmhosts        (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll
10:47:37.0844 3436        lmhosts - ok
10:47:37.0875 3436        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\drivers\lsi_fc.sys
10:47:37.0891 3436        LSI_FC - ok
10:47:37.0907 3436        LSI_SAS        (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\drivers\lsi_sas.sys
10:47:37.0922 3436        LSI_SAS - ok
10:47:37.0938 3436        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\drivers\lsi_sas2.sys
10:47:37.0938 3436        LSI_SAS2 - ok
10:47:37.0953 3436        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\drivers\lsi_scsi.sys
10:47:37.0969 3436        LSI_SCSI - ok
10:47:37.0985 3436        luafv          (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
10:47:38.0000 3436        luafv - ok
10:47:38.0047 3436        MBAMProtector  (fb097bbc1a18f044bd17bd2fccf97865) C:\Windows\system32\drivers\mbam.sys
10:47:38.0063 3436        MBAMProtector - ok
10:47:38.0156 3436        MBAMService    (ba400ed640bca1eae5c727ae17c10207) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
10:47:38.0172 3436        MBAMService - ok
10:47:38.0203 3436        Mcx2Svc        (bfb9ee8ee977efe85d1a3105abef6dd1) C:\Windows\system32\Mcx2Svc.dll
10:47:38.0219 3436        Mcx2Svc - ok
10:47:38.0234 3436        megasas        (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\drivers\megasas.sys
10:47:38.0250 3436        megasas - ok
10:47:38.0265 3436        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\drivers\MegaSR.sys
10:47:38.0281 3436        MegaSR - ok
10:47:38.0312 3436        MMCSS          (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
10:47:38.0343 3436        MMCSS - ok
10:47:38.0359 3436        Modem          (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
10:47:38.0390 3436        Modem - ok
10:47:38.0406 3436        monitor        (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
10:47:38.0421 3436        monitor - ok
10:47:38.0453 3436        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
10:47:38.0453 3436        mouclass - ok
10:47:38.0468 3436        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
10:47:38.0499 3436        mouhid - ok
10:47:38.0515 3436        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
10:47:38.0531 3436        mountmgr - ok
10:47:38.0562 3436        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
10:47:38.0577 3436        MozillaMaintenance - ok
10:47:38.0593 3436        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
10:47:38.0593 3436        mpio - ok
10:47:38.0609 3436        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
10:47:38.0640 3436        mpsdrv - ok
10:47:38.0671 3436        MpsSvc          (9835584e999d25004e1ee8e5f3e3b881) C:\Windows\system32\mpssvc.dll
10:47:38.0749 3436        MpsSvc - ok
10:47:38.0765 3436        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
10:47:38.0780 3436        MRxDAV - ok
10:47:38.0827 3436        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
10:47:38.0843 3436        mrxsmb - ok
10:47:38.0858 3436        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
10:47:38.0889 3436        mrxsmb10 - ok
10:47:38.0905 3436        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
10:47:38.0936 3436        mrxsmb20 - ok
10:47:38.0967 3436        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
10:47:38.0983 3436        msahci - ok
10:47:38.0999 3436        msdsm          (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
10:47:39.0014 3436        msdsm - ok
10:47:39.0045 3436        MSDTC          (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe
10:47:39.0077 3436        MSDTC - ok
10:47:39.0092 3436        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
10:47:39.0123 3436        Msfs - ok
10:47:39.0123 3436        mshidkmdf      (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
10:47:39.0155 3436        mshidkmdf - ok
10:47:39.0155 3436        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
10:47:39.0170 3436        msisadrv - ok
10:47:39.0217 3436        MSiSCSI        (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll
10:47:39.0248 3436        MSiSCSI - ok
10:47:39.0248 3436        msiserver - ok
10:47:39.0279 3436        MSKSSRV        (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
10:47:39.0295 3436        MSKSSRV - ok
10:47:39.0311 3436        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
10:47:39.0342 3436        MSPCLOCK - ok
10:47:39.0357 3436        MSPQM          (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
10:47:39.0389 3436        MSPQM - ok
10:47:39.0420 3436        MsRPC          (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
10:47:39.0420 3436        MsRPC - ok
10:47:39.0435 3436        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys
10:47:39.0451 3436        mssmbios - ok
10:47:39.0451 3436        MSTEE          (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
10:47:39.0482 3436        MSTEE - ok
10:47:39.0482 3436        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\drivers\MTConfig.sys
10:47:39.0529 3436        MTConfig - ok
10:47:39.0545 3436        Mup            (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
10:47:39.0560 3436        Mup - ok
10:47:39.0591 3436        napagent        (61d57a5d7c6d9afe10e77dae6e1b445e) C:\Windows\system32\qagentRT.dll
10:47:39.0638 3436        napagent - ok
10:47:39.0654 3436        NativeWifiP    (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
10:47:39.0701 3436        NativeWifiP - ok
10:47:39.0763 3436        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys
10:47:39.0794 3436        NDIS - ok
10:47:39.0810 3436        NdisCap        (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
10:47:39.0841 3436        NdisCap - ok
10:47:39.0857 3436        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
10:47:39.0888 3436        NdisTapi - ok
10:47:39.0888 3436        Ndisuio        (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
10:47:39.0903 3436        Ndisuio - ok
10:47:39.0935 3436        NdisWan        (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
10:47:39.0966 3436        NdisWan - ok
10:47:39.0981 3436        NDProxy        (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
10:47:40.0013 3436        NDProxy - ok
10:47:40.0013 3436        NetBIOS        (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
10:47:40.0044 3436        NetBIOS - ok
10:47:40.0059 3436        NetBT          (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
10:47:40.0106 3436        NetBT - ok
10:47:40.0122 3436        Netlogon        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
10:47:40.0137 3436        Netlogon - ok
10:47:40.0184 3436        Netman          (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll
10:47:40.0215 3436        Netman - ok
10:47:40.0247 3436        netprofm        (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll
10:47:40.0293 3436        netprofm - ok
10:47:40.0371 3436        NetTcpPortSharing (f476ec40033cdb91efbe73eb99b8362d) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
10:47:40.0371 3436        NetTcpPortSharing - ok
10:47:40.0434 3436        nfrd960        (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\drivers\nfrd960.sys
10:47:40.0434 3436        nfrd960 - ok
10:47:40.0465 3436        NlaSvc          (912084381d30d8b89ec4e293053f4710) C:\Windows\System32\nlasvc.dll
10:47:40.0496 3436        NlaSvc - ok
10:47:40.0512 3436        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
10:47:40.0527 3436        Npfs - ok
10:47:40.0543 3436        nsi            (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll
10:47:40.0574 3436        nsi - ok
10:47:40.0574 3436        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
10:47:40.0605 3436        nsiproxy - ok
10:47:40.0668 3436        Ntfs            (33c3093d09017cfe2e219f2472bff6eb) C:\Windows\system32\drivers\Ntfs.sys
10:47:40.0699 3436        Ntfs - ok
10:47:40.0715 3436        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
10:47:40.0730 3436        Null - ok
10:47:40.0746 3436        nvraid          (af2eec9580c1d32fb7eaf105d9784061) C:\Windows\system32\drivers\nvraid.sys
10:47:40.0761 3436        nvraid - ok
10:47:40.0777 3436        nvstor          (9283c58ebaa2618f93482eb5dabcec82) C:\Windows\system32\drivers\nvstor.sys
10:47:40.0793 3436        nvstor - ok
10:47:40.0808 3436        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
10:47:40.0824 3436        nv_agp - ok
10:47:40.0824 3436        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
10:47:40.0839 3436        ohci1394 - ok
10:47:40.0917 3436        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
10:47:40.0933 3436        ose - ok
10:47:41.0136 3436        osppsvc        (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
10:47:41.0214 3436        osppsvc - ok
10:47:41.0370 3436        p2pimsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
10:47:41.0401 3436        p2pimsvc - ok
10:47:41.0417 3436        p2psvc          (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll
10:47:41.0448 3436        p2psvc - ok
10:47:41.0479 3436        Parport        (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\drivers\parport.sys
10:47:41.0495 3436        Parport - ok
10:47:41.0510 3436        partmgr        (bf8f6af06da75b336f07e23aef97d93b) C:\Windows\system32\drivers\partmgr.sys
10:47:41.0526 3436        partmgr - ok
10:47:41.0541 3436        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\drivers\parvdm.sys
10:47:41.0541 3436        Parvdm - ok
10:47:41.0557 3436        PcaSvc          (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll
10:47:41.0588 3436        PcaSvc - ok
10:47:41.0588 3436        pci            (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
10:47:41.0604 3436        pci - ok
10:47:41.0619 3436        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
10:47:41.0619 3436        pciide - ok
10:47:41.0635 3436        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\drivers\pcmcia.sys
10:47:41.0651 3436        pcmcia - ok
10:47:41.0666 3436        pcw            (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
10:47:41.0682 3436        pcw - ok
10:47:41.0729 3436        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
10:47:41.0775 3436        PEAUTH - ok
10:47:41.0838 3436        PeerDistSvc    (af4d64d2a57b9772cf3801950b8058a6) C:\Windows\system32\peerdistsvc.dll
10:47:41.0885 3436        PeerDistSvc - ok
10:47:41.0978 3436        pla            (414bba67a3ded1d28437eb66aeb8a720) C:\Windows\system32\pla.dll
10:47:42.0025 3436        pla - ok
10:47:42.0150 3436        PlugPlay        (ec7bc28d207da09e79b3e9faf8b232ca) C:\Windows\system32\umpnpmgr.dll
10:47:42.0197 3436        PlugPlay - ok
10:47:42.0197 3436        PNRPAutoReg    (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll
10:47:42.0228 3436        PNRPAutoReg - ok
10:47:42.0259 3436        PNRPsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
10:47:42.0275 3436        PNRPsvc - ok
10:47:42.0306 3436        PolicyAgent    (53946b69ba0836bd95b03759530c81ec) C:\Windows\System32\ipsecsvc.dll
10:47:42.0353 3436        PolicyAgent - ok
10:47:42.0384 3436        Power          (f87d30e72e03d579a5199ccb3831d6ea) C:\Windows\system32\umpo.dll
10:47:42.0431 3436        Power - ok
10:47:42.0493 3436        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
10:47:42.0524 3436        PptpMiniport - ok
10:47:42.0540 3436        Processor      (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\drivers\processr.sys
10:47:42.0555 3436        Processor - ok
10:47:42.0587 3436        ProfSvc        (43ca4ccc22d52fb58e8988f0198851d0) C:\Windows\system32\profsvc.dll
10:47:42.0618 3436        ProfSvc - ok
10:47:42.0633 3436        ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
10:47:42.0649 3436        ProtectedStorage - ok
10:47:42.0680 3436        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
10:47:42.0711 3436        Psched - ok
10:47:42.0789 3436        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\drivers\ql2300.sys
10:47:42.0821 3436        ql2300 - ok
10:47:42.0914 3436        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\drivers\ql40xx.sys
10:47:42.0930 3436        ql40xx - ok
10:47:42.0961 3436        QWAVE          (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll
10:47:42.0992 3436        QWAVE - ok
10:47:42.0992 3436        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
10:47:43.0008 3436        QWAVEdrv - ok
10:47:43.0023 3436        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
10:47:43.0070 3436        RasAcd - ok
10:47:43.0179 3436        RasAgileVpn    (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
10:47:43.0211 3436        RasAgileVpn - ok
10:47:43.0273 3436        RasAuto        (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll
10:47:43.0304 3436        RasAuto - ok
10:47:43.0320 3436        Rasl2tp        (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
10:47:43.0367 3436        Rasl2tp - ok
10:47:43.0382 3436        RasMan          (cb9e04dc05eacf5b9a36ca276d475006) C:\Windows\System32\rasmans.dll
10:47:43.0413 3436        RasMan - ok
10:47:43.0429 3436        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
10:47:43.0460 3436        RasPppoe - ok
10:47:43.0476 3436        RasSstp        (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
10:47:43.0507 3436        RasSstp - ok
10:47:43.0523 3436        rdbss          (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
10:47:43.0554 3436        rdbss - ok
10:47:43.0569 3436        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
10:47:43.0585 3436        rdpbus - ok
10:47:43.0601 3436        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
10:47:43.0647 3436        RDPCDD - ok
10:47:43.0679 3436        RDPDR          (b973fcfc50dc1434e1970a146f7e3885) C:\Windows\system32\drivers\rdpdr.sys
10:47:43.0725 3436        RDPDR - ok
10:47:43.0741 3436        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
10:47:43.0772 3436        RDPENCDD - ok
10:47:43.0788 3436        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
10:47:43.0819 3436        RDPREFMP - ok
10:47:43.0866 3436        RDPWD          (244c83332f44589ae98fc347f11b2693) C:\Windows\system32\drivers\RDPWD.sys
10:47:43.0897 3436        RDPWD - ok
10:47:43.0928 3436        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
10:47:43.0928 3436        rdyboost - ok
10:47:43.0959 3436        RemoteAccess    (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll
10:47:43.0991 3436        RemoteAccess - ok
10:47:44.0022 3436        RemoteRegistry  (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll
10:47:44.0053 3436        RemoteRegistry - ok
10:47:44.0084 3436        RpcEptMapper    (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll
10:47:44.0131 3436        RpcEptMapper - ok
10:47:44.0162 3436        RpcLocator      (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe
10:47:44.0178 3436        RpcLocator - ok
10:47:44.0209 3436        RpcSs          (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll
10:47:44.0240 3436        RpcSs - ok
10:47:44.0271 3436        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
10:47:44.0303 3436        rspndr - ok
10:47:44.0334 3436        s3cap          (7fa7f2e249a5dcbb7970630e15e1f482) C:\Windows\system32\drivers\vms3cap.sys
10:47:44.0365 3436        s3cap - ok
10:47:44.0381 3436        SamSs          (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
10:47:44.0396 3436        SamSs - ok
10:47:44.0412 3436        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
10:47:44.0427 3436        sbp2port - ok
10:47:44.0443 3436        SCardSvr        (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll
10:47:44.0490 3436        SCardSvr - ok
10:47:44.0505 3436        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
10:47:44.0552 3436        scfilter - ok
10:47:44.0599 3436        Schedule        (a04bb13f8a72f8b6e8b4071723e4e336) C:\Windows\system32\schedsvc.dll
10:47:44.0646 3436        Schedule - ok
10:47:44.0677 3436        SCPolicySvc    (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
10:47:44.0693 3436        SCPolicySvc - ok
10:47:44.0739 3436        SDRSVC          (08236c4bce5edd0a0318a438af28e0f7) C:\Windows\System32\SDRSVC.dll
10:47:44.0771 3436        SDRSVC - ok
10:47:44.0786 3436        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
10:47:44.0817 3436        secdrv - ok
10:47:44.0833 3436        seclogon        (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll
10:47:44.0864 3436        seclogon - ok
10:47:44.0880 3436        SENS            (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\System32\sens.dll
10:47:44.0895 3436        SENS - ok
10:47:44.0927 3436        SensrSvc        (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll
10:47:44.0958 3436        SensrSvc - ok
10:47:44.0973 3436        Serenum        (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\drivers\serenum.sys
10:47:44.0989 3436        Serenum - ok
10:47:44.0989 3436        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\drivers\serial.sys
10:47:45.0036 3436        Serial - ok
10:47:45.0036 3436        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\drivers\sermouse.sys
10:47:45.0051 3436        sermouse - ok
10:47:45.0083 3436        SessionEnv      (4ae380f39a0032eab7dd953030b26d28) C:\Windows\system32\sessenv.dll
10:47:45.0129 3436        SessionEnv - ok
10:47:45.0129 3436        sffdisk        (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
10:47:45.0145 3436        sffdisk - ok
10:47:45.0145 3436        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
10:47:45.0161 3436        sffp_mmc - ok
10:47:45.0176 3436        sffp_sd        (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
10:47:45.0192 3436        sffp_sd - ok
10:47:45.0192 3436        sfloppy        (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\drivers\sfloppy.sys
10:47:45.0207 3436        sfloppy - ok
10:47:45.0254 3436        SharedAccess    (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll
10:47:45.0301 3436        SharedAccess - ok
10:47:45.0317 3436        ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\Windows\System32\shsvcs.dll
10:47:45.0363 3436        ShellHWDetection - ok
10:47:45.0363 3436        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
10:47:45.0379 3436        sisagp - ok
10:47:45.0395 3436        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\drivers\SiSRaid2.sys
10:47:45.0410 3436        SiSRaid2 - ok
10:47:45.0426 3436        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\drivers\sisraid4.sys
10:47:45.0441 3436        SiSRaid4 - ok
10:47:45.0457 3436        Smb            (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
10:47:45.0488 3436        Smb - ok
10:47:45.0519 3436        SNMPTRAP        (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe
10:47:45.0535 3436        SNMPTRAP - ok
10:47:45.0535 3436        spldr          (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
10:47:45.0551 3436        spldr - ok
10:47:45.0582 3436        Spooler        (866a43013535dc8587c258e43579c764) C:\Windows\System32\spoolsv.exe
10:47:45.0613 3436        Spooler - ok
10:47:45.0738 3436        sppsvc          (cf87a1de791347e75b98885214ced2b8) C:\Windows\system32\sppsvc.exe
10:47:45.0816 3436        sppsvc - ok
10:47:45.0909 3436        sppuinotify    (b0180b20b065d89232a78a40fe56eaa6) C:\Windows\system32\sppuinotify.dll
10:47:45.0925 3436        sppuinotify - ok
10:47:45.0972 3436        srv            (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
10:47:46.0003 3436        srv - ok
10:47:46.0019 3436        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
10:47:46.0050 3436        srv2 - ok
10:47:46.0065 3436        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
10:47:46.0097 3436        srvnet - ok
10:47:46.0112 3436        SSDPSRV        (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll
10:47:46.0143 3436        SSDPSRV - ok
10:47:46.0159 3436        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
10:47:46.0159 3436        ssmdrv - ok
10:47:46.0190 3436        SstpSvc        (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll
10:47:46.0221 3436        SstpSvc - ok
10:47:46.0237 3436        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\drivers\stexstor.sys
10:47:46.0253 3436        stexstor - ok
10:47:46.0315 3436        StiSvc          (e1fb3706030fb4578a0d72c2fc3689e4) C:\Windows\System32\wiaservc.dll
10:47:46.0346 3436        StiSvc - ok
10:47:46.0362 3436        storflt        (472af0311073dceceaa8fa18ba2bdf89) C:\Windows\system32\drivers\vmstorfl.sys
10:47:46.0377 3436        storflt - ok
10:47:46.0409 3436        StorSvc        (0bf669f0a910beda4a32258d363af2a5) C:\Windows\system32\storsvc.dll
10:47:46.0424 3436        StorSvc - ok
10:47:46.0440 3436        storvsc        (dcaffd62259e0bdb433dd67b5bb37619) C:\Windows\system32\drivers\storvsc.sys
10:47:46.0455 3436        storvsc - ok
10:47:46.0471 3436        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys
10:47:46.0471 3436        swenum - ok
10:47:46.0502 3436        swprv          (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll
10:47:46.0549 3436        swprv - ok
10:47:46.0596 3436        SysMain        (36650d618ca34c9d357dfd3d89b2c56f) C:\Windows\system32\sysmain.dll
10:47:46.0627 3436        SysMain - ok
10:47:46.0658 3436        TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\Windows\System32\TabSvc.dll
10:47:46.0689 3436        TabletInputService - ok
10:47:46.0705 3436        TapiSrv        (613bf4820361543956909043a265c6ac) C:\Windows\System32\tapisrv.dll
10:47:46.0736 3436        TapiSrv - ok
10:47:46.0767 3436        TBS            (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll
10:47:46.0799 3436        TBS - ok
10:47:46.0892 3436        Tcpip          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\drivers\tcpip.sys
10:47:46.0923 3436        Tcpip - ok
10:47:46.0955 3436        TCPIP6          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\DRIVERS\tcpip.sys
10:47:46.0970 3436        TCPIP6 - ok
10:47:47.0001 3436        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
10:47:47.0033 3436        tcpipreg - ok
10:47:47.0048 3436        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
10:47:47.0064 3436        TDPIPE - ok
10:47:47.0095 3436        TDTCP          (2c2c5afe7ee4f620d69c23c0617651a8) C:\Windows\system32\drivers\tdtcp.sys
10:47:47.0111 3436        TDTCP - ok
10:47:47.0126 3436        tdx            (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
10:47:47.0157 3436        tdx - ok
10:47:47.0157 3436        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\DRIVERS\termdd.sys
10:47:47.0173 3436        TermDD - ok
10:47:47.0204 3436        TermService    (382c804c92811be57829d8e550a900e2) C:\Windows\System32\termsrv.dll
10:47:47.0235 3436        TermService - ok
10:47:47.0251 3436        Themes          (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll
10:47:47.0282 3436        Themes - ok
10:47:47.0313 3436        THREADORDER    (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
10:47:47.0329 3436        THREADORDER - ok
10:47:47.0345 3436        TrkWks          (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll
10:47:47.0391 3436        TrkWks - ok
10:47:47.0469 3436        TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\Windows\servicing\TrustedInstaller.exe
10:47:47.0501 3436        TrustedInstaller - ok
10:47:47.0532 3436        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
10:47:47.0563 3436        tssecsrv - ok
10:47:47.0563 3436        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
10:47:47.0610 3436        TsUsbFlt - ok
10:47:47.0625 3436        TsUsbGD        (01246f0baad7b68ec0f472aa41e33282) C:\Windows\system32\drivers\TsUsbGD.sys
10:47:47.0641 3436        TsUsbGD - ok
10:47:47.0672 3436        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
10:47:47.0688 3436        tunnel - ok
10:47:47.0703 3436        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\drivers\uagp35.sys
10:47:47.0703 3436        uagp35 - ok
10:47:47.0719 3436        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
10:47:47.0750 3436        udfs - ok
10:47:47.0781 3436        UI0Detect      (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe
10:47:47.0797 3436        UI0Detect - ok
10:47:47.0813 3436        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
10:47:47.0828 3436        uliagpkx - ok
10:47:47.0844 3436        umbus          (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\DRIVERS\umbus.sys
10:47:47.0859 3436        umbus - ok
10:47:47.0875 3436        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\drivers\umpass.sys
10:47:47.0891 3436        UmPass - ok
10:47:47.0922 3436        UmRdpService    (409994a8eaceee4e328749c0353527a0) C:\Windows\System32\umrdp.dll
10:47:47.0953 3436        UmRdpService - ok
10:47:47.0984 3436        upnphost        (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll
10:47:48.0031 3436        upnphost - ok
10:47:48.0078 3436        USBAAPL        (eafe1e00739afe6c51487a050e772e17) C:\Windows\system32\Drivers\usbaapl.sys
10:47:48.0109 3436        USBAAPL - ok
10:47:48.0125 3436        usbccgp        (7e72e7d7e0757d59481d530fd2b0bfae) C:\Windows\system32\DRIVERS\usbccgp.sys
10:47:48.0140 3436        usbccgp - ok
10:47:48.0156 3436        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
10:47:48.0171 3436        usbcir - ok
10:47:48.0187 3436        usbehci        (cfbce999c057d78979a181c9c60f208e) C:\Windows\system32\DRIVERS\usbehci.sys
10:47:48.0203 3436        usbehci - ok
10:47:48.0234 3436        usbhub          (9d22aad9ac6a07c691a1113e5f860868) C:\Windows\system32\DRIVERS\usbhub.sys
10:47:48.0249 3436        usbhub - ok
10:47:48.0296 3436        usbohci        (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\drivers\usbohci.sys
10:47:48.0312 3436        usbohci - ok
10:47:48.0343 3436        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
10:47:48.0359 3436        usbprint - ok
10:47:48.0405 3436        usbscan        (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys
10:47:48.0421 3436        usbscan - ok
10:47:48.0421 3436        USBSTOR        (bf63ebfc6979fefb2bc03df7989a0c1a) C:\Windows\system32\DRIVERS\USBSTOR.SYS
10:47:48.0437 3436        USBSTOR - ok
10:47:48.0452 3436        usbuhci        (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys
10:47:48.0468 3436        usbuhci - ok
10:47:48.0499 3436        UxSms          (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll
10:47:48.0530 3436        UxSms - ok
10:47:48.0561 3436        VaultSvc        (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
10:47:48.0577 3436        VaultSvc - ok
10:47:48.0593 3436        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
10:47:48.0608 3436        vdrvroot - ok
10:47:48.0639 3436        vds            (c3cd30495687c2a2f66a65ca6fd89be9) C:\Windows\System32\vds.exe
10:47:48.0671 3436        vds - ok
10:47:48.0686 3436        vga            (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
10:47:48.0717 3436        vga - ok
10:47:48.0733 3436        VgaSave        (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
10:47:48.0749 3436        VgaSave - ok
10:47:48.0764 3436        vhdmp          (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
10:47:48.0780 3436        vhdmp - ok
10:47:48.0795 3436        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
10:47:48.0811 3436        viaagp - ok
10:47:48.0811 3436        ViaC7          (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\drivers\viac7.sys
10:47:48.0842 3436        ViaC7 - ok
10:47:48.0842 3436        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
10:47:48.0858 3436        viaide - ok
10:47:48.0889 3436        vmbus          (c2f2911156fdc7817c52829c86da494e) C:\Windows\system32\drivers\vmbus.sys
10:47:48.0905 3436        vmbus - ok
10:47:48.0936 3436        VMBusHID        (d4d77455211e204f370d08f4963063ce) C:\Windows\system32\drivers\VMBusHID.sys
10:47:48.0951 3436        VMBusHID - ok
10:47:48.0983 3436        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
10:47:48.0983 3436        volmgr - ok
10:47:49.0014 3436        volmgrx        (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
10:47:49.0029 3436        volmgrx - ok
10:47:49.0045 3436        volsnap        (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
10:47:49.0061 3436        volsnap - ok
10:47:49.0092 3436        vsmraid        (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\drivers\vsmraid.sys
10:47:49.0107 3436        vsmraid - ok
10:47:49.0170 3436        VSS            (209a3b1901b83aeb8527ed211cce9e4c) C:\Windows\system32\vssvc.exe
10:47:49.0217 3436        VSS - ok
10:47:49.0232 3436        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
10:47:49.0248 3436        vwifibus - ok
10:47:49.0279 3436        W32Time        (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll
10:47:49.0310 3436        W32Time - ok
10:47:49.0326 3436        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\drivers\wacompen.sys
10:47:49.0341 3436        WacomPen - ok
10:47:49.0373 3436        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
10:47:49.0404 3436        WANARP - ok
10:47:49.0404 3436        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
10:47:49.0435 3436        Wanarpv6 - ok
10:47:49.0497 3436        wbengine        (691e3285e53dca558e1a84667f13e15a) C:\Windows\system32\wbengine.exe
10:47:49.0544 3436        wbengine - ok
10:47:49.0560 3436        WbioSrvc        (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll
10:47:49.0591 3436        WbioSrvc - ok
10:47:49.0607 3436        wcncsvc        (34eee0dfaadb4f691d6d5308a51315dc) C:\Windows\System32\wcncsvc.dll
10:47:49.0622 3436        wcncsvc - ok
10:47:49.0638 3436        WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll
10:47:49.0685 3436        WcsPlugInService - ok
10:47:49.0747 3436        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\drivers\wd.sys
10:47:49.0747 3436        Wd - ok
10:47:49.0778 3436        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
10:47:49.0809 3436        Wdf01000 - ok
10:47:49.0825 3436        WdiServiceHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
10:47:49.0872 3436        WdiServiceHost - ok
10:47:49.0872 3436        WdiSystemHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
10:47:49.0887 3436        WdiSystemHost - ok
10:47:49.0919 3436        WebClient      (a9d880f97530d5b8fee278923349929d) C:\Windows\System32\webclnt.dll
10:47:49.0950 3436        WebClient - ok
10:47:49.0965 3436        Wecsvc          (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll
10:47:49.0997 3436        Wecsvc - ok
10:47:49.0997 3436        wercplsupport  (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll
10:47:50.0028 3436        wercplsupport - ok
10:47:50.0059 3436        WerSvc          (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll
10:47:50.0090 3436        WerSvc - ok
10:47:50.0106 3436        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
10:47:50.0121 3436        WfpLwf - ok
10:47:50.0137 3436        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
10:47:50.0153 3436        WIMMount - ok
10:47:50.0231 3436        WinDefend      (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll
10:47:50.0277 3436        WinDefend - ok
10:47:50.0277 3436        WinHttpAutoProxySvc - ok
10:47:50.0355 3436        Winmgmt        (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll
10:47:50.0387 3436        Winmgmt - ok
10:47:50.0465 3436        WinRM          (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\Windows\system32\WsmSvc.dll
10:47:50.0511 3436        WinRM - ok
10:47:50.0589 3436        Wlansvc        (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll
10:47:50.0652 3436        Wlansvc - ok
10:47:50.0808 3436        wlidsvc        (fb01d4ae207b9efdbabfc55dc95c7e31) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
10:47:50.0839 3436        wlidsvc - ok
10:47:50.0948 3436        WmiAcpi        (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
10:47:50.0964 3436        WmiAcpi - ok
10:47:51.0011 3436        wmiApSrv        (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe
10:47:51.0042 3436        wmiApSrv - ok
10:47:51.0135 3436        WMPNetworkSvc  (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe
10:47:51.0198 3436        WMPNetworkSvc - ok
10:47:51.0229 3436        WPCSvc          (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll
10:47:51.0276 3436        WPCSvc - ok
10:47:51.0276 3436        WPDBusEnum      (aa53356d60af47eacc85bc617a4f3f66) C:\Windows\system32\wpdbusenum.dll
10:47:51.0307 3436        WPDBusEnum - ok
10:47:51.0369 3436        WPFFontCache_v0400 - ok
10:47:51.0447 3436        ws2ifsl        (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
10:47:51.0479 3436        ws2ifsl - ok
10:47:51.0494 3436        wscsvc          (6f5d49efe0e7164e03ae773a3fe25340) C:\Windows\System32\wscsvc.dll
10:47:51.0510 3436        wscsvc - ok
10:47:51.0510 3436        WSearch - ok
10:47:51.0619 3436        wuauserv        (3026418a50c5b4761befa632cedb7406) C:\Windows\system32\wuaueng.dll
10:47:51.0681 3436        wuauserv - ok
10:47:51.0759 3436        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
10:47:51.0791 3436        WudfPf - ok
10:47:51.0806 3436        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys
10:47:51.0837 3436        WUDFRd - ok
10:47:51.0884 3436        wudfsvc        (8d1e1e529a2c9e9b6a85b55a345f7629) C:\Windows\System32\WUDFSvc.dll
10:47:51.0900 3436        wudfsvc - ok
10:47:52.0305 3436        WwanSvc        (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll
10:47:52.0352 3436        WwanSvc - ok
10:47:52.0352 3436        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
10:47:52.0649 3436        \Device\Harddisk0\DR0 - ok
10:47:52.0680 3436        Boot (0x1200)  (3289c7787c146d6200fe0c72624385b8) \Device\Harddisk0\DR0\Partition0
10:47:52.0680 3436        \Device\Harddisk0\DR0\Partition0 - ok
10:47:52.0695 3436        Boot (0x1200)  (ea9c4b7872fee3b9d05f7604b521caf7) \Device\Harddisk0\DR0\Partition1
10:47:52.0695 3436        \Device\Harddisk0\DR0\Partition1 - ok
10:47:52.0695 3436        ============================================================
10:47:52.0695 3436        Scan finished
10:47:52.0695 3436        ============================================================
10:47:52.0711 5332        Detected object count: 2
10:47:52.0711 5332        Actual detected object count: 2
10:48:20.0994 5332        hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
10:48:20.0994 5332        hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip
10:48:20.0994 5332        hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
10:48:20.0994 5332        hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 21.06.2012 14:11
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

dennis8 22.06.2012 08:52
hab ich gemacht und dieses log kam dabei raus:

Code:
ComboFix 12-06-21.03 - xxx 22.06.2012  9:18.1.4 - x86
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.3070.2050 [GMT 2:00]
ausgeführt von:: c:\users\xxx\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
c:\users\xxx\AppData\Local\Temp\ae201572-4813-4010-9ed2-ee29ddec066a\CliSecureRT.dll
c:\windows\IsUn0407.exe
c:\windows\system32\muzapp.exe
c:\windows\system32\regobj.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-22 bis 2012-06-22  ))))))))))))))))))))))))))))))
.
.
2012-06-20 09:27 . 2012-06-20 11:13        --------        d-----w-        C:\_OTL
2012-06-19 08:17 . 2012-06-19 08:17        --------        d-----w-        c:\program files\ESET
2012-06-18 09:13 . 2012-06-18 09:13        --------        d-----w-        c:\program files\Mozilla Maintenance Service
2012-06-18 09:13 . 2012-06-18 09:13        157352        ----a-w-        c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-06-18 09:13 . 2012-06-18 09:13        129976        ----a-w-        c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-06-18 07:24 . 2012-06-18 07:24        --------        d-----w-        c:\users\xxx\AppData\Roaming\Malwarebytes
2012-06-18 07:24 . 2012-06-18 07:24        --------        d-----w-        c:\programdata\Malwarebytes
2012-06-18 07:24 . 2012-06-18 07:24        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-06-18 07:24 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-05-28 13:06 . 2012-05-28 13:06        --------        d-----w-        c:\programdata\Macrovision
2012-05-28 13:06 . 2012-06-18 07:15        --------        d-----w-        c:\programdata\FLEXnet
2012-05-28 13:06 . 2012-05-28 13:06        --------        d-----w-        c:\program files\Common Files\Macrovision Shared
2012-05-28 13:06 . 2012-05-28 13:06        --------        d-----w-        c:\program files\ArcGIS
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-18 09:13 . 2011-05-01 08:07        97208        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DymoQuickPrint"="c:\program files\DYMO\DYMO Label Software\DymoQuickPrint.exe" [2010-05-11 1885512]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-09-29 20880]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]
"DLSService"="c:\program files\DYMO\DYMO Label Software\DLSService.exe" [2010-05-11 55808]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2010-06-17 370176]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2011-09-29 929680]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2011-09-29 3508112]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"LexwareInfoService"="c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2010-09-15 339312]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"StartCCC"=c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-18 129976]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-03-28 136360]
S2 ArcGIS License Manager;ArcGIS License Manager;c:\program files\ArcGIS\License10.0\bin\lmgrd.exe [2008-11-05 1500424]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 22344]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://google.de/
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ft2iwcdl.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-Cixyi - c:\users\xxx\AppData\Roaming\Xoyz\olow.exe
AddRemove-Adobe Photoshop 6.0 - c:\windows\ISUN0407.EXE
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-3690843993.smarthome.blob.core.windows.net - c:\program files\Microsoft Silverlight\4.0.60831.0\Silverlight.Configuration.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3501483959-2219181981-1860870347-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3501483959-2219181981-1860870347-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\windows\system32\conhost.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\ArcGIS\License10.0\bin\ARCGIS.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-22  09:31:40 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-22 07:31
.
Vor Suchlauf: 12 Verzeichnis(se), 354.947.809.280 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 354.916.835.328 Bytes frei
.
- - End Of File - - 452A201F38AD305AE0881F320888A80A

cosinus 22.06.2012 10:14
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
Firefox::
FF - ProfilePath - c:\users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ft2iwcdl.default\
FF - prefs.js: browser.search.defaulturl -
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

dennis8 23.06.2012 09:27
hier das entsprechende log:

Code:
ComboFix 12-06-23.01 - xxx 23.06.2012  10:05:14.2.4 - x86
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.3070.2046 [GMT 2:00]
ausgeführt von:: c:\users\xxx\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\xxx\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\xxx\AppData\Local\Temp\ae201572-4813-4010-9ed2-ee29ddec066a\CliSecureRT.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-23 bis 2012-06-23  ))))))))))))))))))))))))))))))
.
.
2012-06-23 08:13 . 2012-06-23 08:13        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-06-20 09:27 . 2012-06-20 11:13        --------        d-----w-        C:\_OTL
2012-06-19 08:17 . 2012-06-19 08:17        --------        d-----w-        c:\program files\ESET
2012-06-18 09:13 . 2012-06-18 09:13        --------        d-----w-        c:\program files\Mozilla Maintenance Service
2012-06-18 09:13 . 2012-06-18 09:13        157352        ----a-w-        c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-06-18 09:13 . 2012-06-18 09:13        129976        ----a-w-        c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-06-18 07:24 . 2012-06-18 07:24        --------        d-----w-        c:\users\xxx\AppData\Roaming\Malwarebytes
2012-06-18 07:24 . 2012-06-18 07:24        --------        d-----w-        c:\programdata\Malwarebytes
2012-06-18 07:24 . 2012-06-18 07:24        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-06-18 07:24 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-05-28 13:06 . 2012-05-28 13:06        --------        d-----w-        c:\programdata\Macrovision
2012-05-28 13:06 . 2012-06-18 07:15        --------        d-----w-        c:\programdata\FLEXnet
2012-05-28 13:06 . 2012-05-28 13:06        --------        d-----w-        c:\program files\Common Files\Macrovision Shared
2012-05-28 13:06 . 2012-05-28 13:06        --------        d-----w-        c:\program files\ArcGIS
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-18 09:13 . 2011-05-01 08:07        97208        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DymoQuickPrint"="c:\program files\DYMO\DYMO Label Software\DymoQuickPrint.exe" [2010-05-11 1885512]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-09-29 20880]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]
"DLSService"="c:\program files\DYMO\DYMO Label Software\DLSService.exe" [2010-05-11 55808]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2010-06-17 370176]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2011-09-29 929680]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2011-09-29 3508112]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"LexwareInfoService"="c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2010-09-15 339312]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"StartCCC"=c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-18 129976]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-03-28 136360]
S2 ArcGIS License Manager;ArcGIS License Manager;c:\program files\ArcGIS\License10.0\bin\lmgrd.exe [2008-11-05 1500424]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 22344]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://google.de/
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ft2iwcdl.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3501483959-2219181981-1860870347-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3501483959-2219181981-1860870347-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\windows\system32\conhost.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\ArcGIS\License10.0\bin\ARCGIS.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-23  10:19:15 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-23 08:19
ComboFix2.txt  2012-06-22 07:31
.
Vor Suchlauf: 19 Verzeichnis(se), 354.935.922.688 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 354.891.915.264 Bytes frei
.
- - End Of File - - A8928420BC19C8EFF4329FF47183E671

cosinus 24.06.2012 16:11
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

dennis8 25.06.2012 16:46
GMER ist in der Tat relativ schnell abgestürzt.
Der Scan mit OSAM ging ziemlich zügig:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 16:30:33 on 25.06.2012

OS: Windows 7  Service Pack 1 (Build 7601), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\xxx\AppData\Local\Temp\catchme.sys  (File not found)
"fwdirpog" (fwdirpog) - ? - C:\Users\xxx\AppData\Local\Temp\fwdirpog.sys  (Hidden registry entry, rootkit activity | File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{4A681BEC-7727-49BD-B695-79F8354CD2E5} "PMFColumns Class" - "ESRI " - C:\Program Files\Common Files\ESRI\esriShellExt.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{0563DB41-F538-4B37-A92D-4659049B7766} "WLMD Message Handler" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10t.ocx / https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -  (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Security Packages" - "Microsoft Corp." - C:\Windows\system32\livessp.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"DymoQuickPrint" - "Sanford, L.P." - "C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe" /startup
"KiesPDLR" - ? - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"APSDaemon" - "Apple Inc." - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"DLSService" - "Sanford, L.P." - "C:\Program Files\DYMO\DYMO Label Software\DLSService.exe"
"FreePDF Assistant" - "shbox.de" - C:\Program Files\FreePDF_XP\fpassist.exe
"HP Software Update" - "Hewlett-Packard Co." - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"KiesHelper" - "Samsung" - C:\Program Files\Samsung\Kies\KiesHelper.exe /s
"KiesTrayAgent" - "Samsung Electronics Co., Ltd." - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
"LexwareInfoService" - "Haufe-Lexware GmbH & Co. KG" - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe /autostart
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Redirected Port" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ArcGIS License Manager" (ArcGIS License Manager) - "Acresso Software Inc." - C:\Program Files\ArcGIS\License10.0\bin\lmgrd.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - ? - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe  (File not found)

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
"WindowsLive Local NSP" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
"WindowsLive NSP" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
aswMBR:
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-25 16:32:56
-----------------------------
16:32:56.393    OS Version: Windows 6.1.7601 Service Pack 1
16:32:56.393    Number of processors: 4 586 0xF0B
16:32:56.393    ComputerName: xxx-PC  UserName: xxx
16:32:57.361    Initialize success
16:33:49.948    AVAST engine defs: 12062500
16:34:18.449    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
16:34:18.449    Disk 0 Vendor: SAMSUNG_HD501LJ CR100-12 Size: 476940MB BusType: 3
16:34:18.496    Disk 0 MBR read successfully
16:34:18.512    Disk 0 MBR scan
16:34:18.527    Disk 0 Windows 7 default MBR code
16:34:18.527    Disk 0 Partition 1 00    DE Dell Utility Dell 8.0      54 MB offset 63
16:34:18.559    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        10240 MB offset 112640
16:34:18.559    Disk 0 Partition 3 80 (A) 07    HPFS/NTFS NTFS      466644 MB offset 21084160
16:34:18.574    Disk 0 scanning sectors +976771072
16:34:18.637    Disk 0 scanning C:\Windows\system32\drivers
16:34:26.374    Service scanning
16:34:40.991    Modules scanning
16:34:44.080    Disk 0 trace - called modules:
16:34:44.112    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
16:34:44.112    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x865eb528]
16:34:44.112    3 CLASSPNP.SYS[8b60459e] -> nt!IofCallDriver -> [0x860d6918]
16:34:44.127    5 ACPI.sys[8b2a53d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x857de908]
16:34:44.985    AVAST engine scan C:\Windows
16:34:47.887    AVAST engine scan C:\Windows\system32
16:36:58.241    AVAST engine scan C:\Windows\system32\drivers
16:37:05.885    AVAST engine scan C:\Users\xxx
17:19:14.306    AVAST engine scan C:\ProgramData
17:21:04.114    Scan finished successfully
17:40:10.311    Disk 0 MBR has been saved successfully to "C:\Users\xxx\Desktop\MBR.dat"
17:40:10.311    The log file has been saved successfully to "C:\Users\xxx\Desktop\aswMBR.txt"

cosinus 25.06.2012 19:35
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

dennis8 26.06.2012 19:47
Das wäre super, wenn alles wieder ok ist. Kannst Du denn was zur Gefährlichkeit der Infizierung sagen? Ausspionieren von daten etc.

Malwarebytes
Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.26.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
xxx :: xxx-PC [Administrator]

Schutz: Deaktiviert

26.06.2012 19:18:25
mbam-log-2012-06-26 (19-18-25).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 389604
Laufzeit: 51 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

SUPERAntiSpyware
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 06/26/2012 at 06:44 PM

Application Version : 5.1.1002

Core Rules Database Version : 8797
Trace Rules Database Version: 6609

Scan type      : Complete Scan
Total Scan Time : 01:40:20

Operating System Information
Windows 7 Professional 32-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 779
Memory threats detected  : 0
Registry items scanned    : 36080
Registry threats detected : 0
File items scanned        : 281116
File threats detected    : 375

Adware.Tracking Cookie
        C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Cookies\52YCW6QF.txt [ /mediaplex.com ]
        C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Cookies\GNCJH7KO.txt [ /doubleclick.net ]
        C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Cookies\63D7U9GK.txt [ /adfarm1.adition.com ]
        C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Cookies\X9EJWW39.txt [ /fastclick.net ]
        C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Cookies\DA86X7WP.txt [ /apmebf.com ]
        C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Cookies\TY053S5B.txt [ /zanox.com ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\THBOWH8J.txt [ Cookie:xxx@serving-sys.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\968A38V1.txt [ Cookie:xxx@mediaplex.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\553XE78S.txt [ Cookie:xxx@invitemedia.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\7KE1JPT8.txt [ Cookie:xxx@atdmt.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\N9EDHAY6.txt [ Cookie:xxx@adfarm1.adition.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\1IOF046H.txt [ Cookie:xxx@webmasterplan.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\FQTQZM3Z.txt [ Cookie:xxx@partners.webmasterplan.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\SOLMMLXU.txt [ Cookie:xxx@track.adform.net/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\OWHA3RYB.txt [ Cookie:xxx@ww251.smartadserver.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\VHN9S04X.txt [ Cookie:xxx@c1.atdmt.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\A9NHG5D1.txt [ Cookie:xxx@advertising.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\SWRCW5QV.txt [ Cookie:xxx@adviva.net/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\ULQPS05G.txt [ Cookie:xxx@ad1.adfarm1.adition.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\80V0600Y.txt [ Cookie:xxx@www.mediamarkt.de/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\G0JCRAVS.txt [ Cookie:xxx@ad.adnet.de/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\TVCP7GV0.txt [ Cookie:xxx@tradedoubler.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\XWNL0V9B.txt [ Cookie:xxx@deutschepostag.112.2o7.net/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\PDMBDN9Q.txt [ Cookie:xxx@xiti.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\C7MYQ2RG.txt [ Cookie:xxx@specificclick.net/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\5443IIJ3.txt [ Cookie:xxx@apmebf.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\8IHZ6SJJ.txt [ Cookie:xxx@www.etracker.de/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\2B3SKEEJ.txt [ Cookie:xxx@kontera.com/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\YNA29PH3.txt [ Cookie:xxx@stepstone.112.2o7.net/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\EJYEZYOH.txt [ Cookie:xxx@adform.net/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\71XU8CON.txt [ Cookie:xxx@revsci.net/ ]
        C:\USERS\xxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\HUFAJ39N.txt [ Cookie:xxx@ad.yieldmanager.com/ ]
        C:\USERS\xxx\Cookies\52YCW6QF.txt [ Cookie:xxx@mediaplex.com/ ]
        C:\USERS\xxx\Cookies\63D7U9GK.txt [ Cookie:xxx@adfarm1.adition.com/ ]
        C:\USERS\xxx\Cookies\DA86X7WP.txt [ Cookie:xxx@apmebf.com/ ]
        eas.apm.emediate.eu [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .deutschepostag.112.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .rionordgmbh.122.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .guj.122.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .ad6media.fr [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .autoscout24.112.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .stepstone.112.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .googleads.g.doubleclick.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .paypal.112.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .webstats4u.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .clickaider.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        weihnachtsmarkt-finder.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        media1.comnos.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        media1.comnos.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        count.asnetworks.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        dc.tremormedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        zbox.zanox.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        servestats.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        zanox01.webtrekk.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        tracking.gameforge.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .audiag.112.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ads1.vtxnet.ch [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .blogads.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        teufel-media.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        banner.testberichte.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        adserver.dvvmedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        tracking.oe24.at [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .de.at.atwola.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .atwola.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .dmtracker.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .yieldmanager.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .partnersearchmetrics.sbx1.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        advertising.finon.info [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        links2revenue.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        links2revenue.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.links2revenue.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.links2revenue.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adserver.adtechus.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adsenseoptimizationservice.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adsenseoptimizationservice.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.adsenseexperts.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.adsenseexperts.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adsenseexperts.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adsenseexperts.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adsenseexperts.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ads1.jurawelt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        wstat.wibiya.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .hightraffic.hugoboss.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        tracking.mobile.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .euros4click.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        e2.emediate.se [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.sedotracker.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .msnportal.112.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        s3.trafficmaxx.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .stats.paypal.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .microsoftsto.112.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ads.webstatsserver.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .sexy-models-nackt.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        sexy-models-nackt.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        sexy-models-nackt.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .mm.chitika.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        track.webstatistik-bw.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .blogads.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        server.adformdsp.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adformdsp.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www4.smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .ar.atwola.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .olympiaverlag.122.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        media.gan-online.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        traffic.brand-wall.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .quartermedia.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        track.zalando.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        stat.dealtime.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        partners.webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .ad6media.fr [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .dealtime.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        partners.webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ww381.smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.dyntracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.dyntracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        tracking.klicktel.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        secure.img-cdn.mediaplex.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .gemoneysdenac.112.2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.mediamarkt.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        data.mediamarkt.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.mediamarkt.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .mediamarkt.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .briefkasten-finden.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .briefkasten-finden.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .briefkasten-finden.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .paketfinder.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .paketfinder.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .paketfinder.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\xxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FT2IWCDL.DEFAULT\COOKIES.SQLITE ]

Trojan.Agent/Gen-Kryptik
        C:\_OTL\MOVEDFILES\06202012_112712\C_USERS\xxx\APPDATA\ROAMING\XOYZ\OLOW.EXE
        ZIP ARCHIVE( C:\_OTL\MOVEDFILES.ZIP )/MOVEDFILES/06202012_112712/C_USERS/xxx/APPDATA/ROAMING/XOYZ/OLOW.EXE
        C:\_OTL\MOVEDFILES.ZIP

cosinus 27.06.2012 11:39
Zitat:
Trojan.Agent/Gen-Kryptik
C:\_OTL\MOVEDFILES\06202012_112712\C_USERS\xxx\APPDATA\ROAMING\XOYZ\OLOW.EXE
ZIP ARCHIVE( C:\_OTL\MOVEDFILES.ZIP )/MOVEDFILES/06202012_112712/C_USERS/xxx/APPDATA/ROAMING/XOYZ/OLOW.EXE
C:\_OTL\MOVEDFILES.ZIP
Harmlos, das sind nur Schädlinge in der Q von OTL. Kannste ignorieren

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

dennis8 27.06.2012 17:40
Nutze auch unterschiedliche Browser mit verschiedenen Cookie-Einstellungen. Am meisten Sorgen bereiten mir aber die gefährlicheren Zeitgenossen im Netz. Eine Frage hätte ich da noch: Ich bekomme relativ häufig Spam Mails inkl. Anhänge (die ich natürlich nie anrühre) über Windows Live Mail auf den PC. Stellen diese Mails + verseuchte Anhänge ein Sicherheitsrisiko dar, auch wenn man sie nicht öffnet?


Zitat:
Zitat von cosinus (Beitrag 852650)
Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
Bin bis jetzt sehr zufrieden mit dem System. Es zeigen sich keine Auffälligkeiten für mich. Die Logs haben ja anscheinend auch nichts mehr erkenntlich gemacht. Möchte mich noch mal für Deine Hilfe bedanken. Echt super. :daumenhoc

PS. Auf eurer Spendenseite werde ich auch noch vorbei schauen.

cosinus 28.06.2012 11:59
Zitat:
Stellen diese Mails + verseuchte Anhänge ein Sicherheitsrisiko dar, auch wenn man sie nicht öffnet?
Nein. Was nicht geöffnet wird kann keinen Schaden anrichten
Dennoch sollt man allgemeine empfohlene Dinge anwenden => Software aktuell halten, nicht als Administrator arbeiten etc. pp.

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:34 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131