Trojaner-Board - Trojaner: Sirefef.X / Sirefef.E / Conedex.A und Exploit: JS/Blacole.FF

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Trojaner: Sirefef.X / Sirefef.E / Conedex.A und Exploit: JS/Blacole.FF (https://www.trojaner-board.de/116476-trojaner-sirefef-x-sirefef-e-conedex-a-exploit-js-blacole-ff.html)

Trojaner: Sirefef.X / Sirefef.E / Conedex.A und Exploit: JS/Blacole.FF

Liebe Trojaner-Board-Gemeinde,

nach langer Abstinenz hier in diesem Board habe ich nun ein hoffentlich lösbares Problem. Leider hat mein Sohn eine an ihn gerichtete Email geöffnet, "Bestell-Bestätigung der Firma Conrad Elektronik", dort war in der Bestellung aufgelistet, dass er sich wohl einen Artikel mit der Bezeichnung Apple bestellt haben soll. Im Anhang befand sich eine Lieferschein.zip mit (53K) welche dann "natürlich" geöffnet wurde.

Habe, wie bei meinem eigenen Rechner, Mircrosoft Security Essentials installiert und alle anderen fiesen Virenprogramme wie Norton Security Scan und G-Data (Testversion) erst mal vorher gelöscht. Ebenso habe ich Malwarebytes-Anti-Malware installiert.

Folgende Scans wurden von mir durchgeführt:

- Malwarebytes-Anti-Malware (vollständiger Scan) <- ohne Befund
- MS Security Essentials (vollständiger Scan) <- mit Befund

Befund:

- Trojan:Win64/Sirefef.X
- Trojan:Win64/Sirefef.E
- Trojan:Win32/Conedex.A
- Exploit:JS/Blacole.FF

Der Rechner:

Laptop mit Win 7 64Bit Betriebssystem

Wäre schön, wenn mir jemand helfen könnte diese Fieslinge zu bekämpfen!

Vielen Dank!

Thomas

Im Anhang befindet sich ein Screenshot vom Befunde von Microsoft-Security-Essentials.

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 18:38 on 04/06/2012 (bonny)

 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.

 

Checking for services/drivers...

 

 

-=E.O.F=-

Code:

OTL logfile created on: 04.06.2012 18:51:23 - Run 3

OTL by OldTimer - Version 3.2.46.0     Folder = C:\Users\bonny\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,78 Gb Available Physical Memory | 69,53% Memory free

7,99 Gb Paging File | 6,50 Gb Available in Paging File | 81,25% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 453,66 Gb Total Space | 404,56 Gb Free Space | 89,18% Space Free | Partition Type: NTFS

 

Computer Name: BONNY-PC | User Name: bonny | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.06.04 18:36:28 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\bonny\Desktop\OTL.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

PRC - [2009.10.29 13:47:34 | 000,419,112 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

PRC - [2009.10.22 04:53:42 | 000,181,480 | ---- | M] (Acer Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe

PRC - [2009.10.13 21:25:54 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2009.10.13 21:25:30 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2009.09.10 15:42:30 | 000,349,480 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

PRC - [2009.08.28 11:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

PRC - [2009.08.18 11:42:08 | 001,157,128 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe

PRC - [2009.08.04 07:09:34 | 000,199,464 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe

PRC - [2009.07.04 04:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe

PRC - [2008.07.29 20:29:26 | 000,200,704 | ---- | M] () -- C:\Windows\PLFSetI.exe

PRC - [2007.07.12 05:00:36 | 000,132,496 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Java\jre1.6.0_02\bin\jusched.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll

MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

MOD - [2008.07.29 20:29:26 | 000,200,704 | ---- | M] () -- C:\Windows\PLFSetI.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2010.11.20 15:26:50 | 000,084,992 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\Mcx2Svc.dll -- (Mcx2Svc)

SRV:64bit: - [2009.09.08 17:56:12 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2009.07.14 03:41:27 | 000,097,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\mprdim.dll -- (RemoteAccess)

SRV - [2012.06.04 17:11:36 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.03.26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2012.03.26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2010.12.13 14:37:16 | 000,194,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.10.29 21:10:02 | 000,844,320 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)

SRV - [2009.10.13 21:25:30 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

SRV - [2009.09.10 15:42:46 | 000,305,448 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)

SRV - [2009.08.28 11:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)

SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysWOW64\mprdim.dll -- (RemoteAccess)

SRV - [2009.07.04 04:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.06.10 22:39:58 | 000,089,920 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.05.14 16:48:45 | 000,059,768 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PktIcpt.sys -- (GDPkIcpt)

DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.03.20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.12.13 14:37:18 | 000,036,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nx6000.sys -- (MSHUSBVideo)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 11:26:11 | 000,328,192 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\udfs.sys -- (udfs)

DRV:64bit: - [2009.11.13 10:47:38 | 000,067,072 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)

DRV:64bit: - [2009.10.13 21:16:40 | 000,409,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2009.10.05 17:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

DRV:64bit: - [2009.09.08 18:31:52 | 006,204,928 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2009.09.02 03:58:08 | 000,225,280 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV:64bit: - [2009.08.21 11:18:16 | 002,978,296 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,024,144 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\crcdisk.sys -- (crcdisk)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\ws2ifsl.sys -- (ws2ifsl)

DRV:64bit: - [2009.07.14 01:19:47 | 000,092,160 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\cdfs.sys -- (cdfs)

DRV:64bit: - [2009.06.18 14:12:32 | 000,272,432 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.06.02 13:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)

DRV:64bit: - [2009.06.02 13:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)

DRV:64bit: - [2009.06.02 13:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)

DRV:64bit: - [2009.05.05 10:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)

DRV:64bit: - [2009.05.05 10:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)

DRV:64bit: - [2007.11.02 14:22:28 | 000,108,072 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s217bus.sys -- (s217bus) Sony Ericsson Device 217 driver (WDM)

DRV - [2009.09.02 03:58:08 | 000,225,280 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

DRV - [2009.03.26 05:16:08 | 000,025,608 | ---- | M] (Dritek System Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\DKbFltr.sys -- (DKbFltr) Dritek Keyboard Filter Driver (64-bit)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE - HKLM\..\URLSearchHook:  - No CLSID value found

IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{2059CF48-25F3-40d7-9D37-24A3142FD20B}: "URL" = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=3379&q={searchTerms}&rp=&s_it=tb50-ie-aolde-chromesbox-de-de

IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?AF=109794&babsrc=HP_ss&mntrId=6cc36c73000000000000761a04ba0b95

IE - HKCU\..\URLSearchHook:  - No CLSID value found

IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=109794&babsrc=SP_ss&mntrId=6cc36c73000000000000761a04ba0b95

IE - HKCU\..\SearchScopes\{2059CF48-25F3-40d7-9D37-24A3142FD20B}: "URL" = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=3379&q={searchTerms}&rp=&s_it=tb50-ie-aolde-chromesbox-de-de

IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE364

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ACAW_deDE364

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.search.suggest.enabled: false

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.1.6&q="

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.06.04 12:52:00 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.04 12:35:30 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.30 16:05:10 | 000,000,000 | ---D | M]

 

[2010.02.11 14:00:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\bonny\AppData\Roaming\mozilla\Extensions

[2012.06.04 17:18:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\bonny\AppData\Roaming\mozilla\Firefox\Profiles\2tx3ff8e.default\extensions

[2012.06.04 13:52:33 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-1.xml

[2012.02.06 12:43:18 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-2.xml

[2012.02.26 15:13:38 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-3.xml

[2012.06.04 12:35:42 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-4.xml

[2012.03.27 10:46:22 | 000,000,168 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin.gif

[2012.03.27 10:46:22 | 000,000,618 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin.src

[2011.12.01 04:02:03 | 000,001,056 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin.xml

[2012.06.04 15:10:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2012.06.04 12:52:00 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 &lt;video&gt;) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5

[2012.06.04 17:18:14 | 000,089,075 | ---- | M] () (No name found) -- C:\USERS\BONNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2TX3FF8E.DEFAULT\EXTENSIONS\{02450914-CDD9-410F-B1DA-DB004E18C671}.XPI

[2012.06.04 12:35:30 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.01.17 11:37:14 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2011.12.21 07:08:50 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.01.28 14:53:55 | 000,002,310 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml

[2011.12.21 07:02:40 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2011.12.21 07:08:50 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.12.21 07:08:50 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.12.21 07:08:50 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.12.21 07:08:50 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.52\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U23 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.52\pdf.dll

CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\bonny\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.40.135.1_0\McChPlg.dll

CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: downloadUpdater (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll

CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll

CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: YouTube = C:\Users\bonny\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: Google-Suche = C:\Users\bonny\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\

CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\bonny\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\

CHR - Extension: Google Mail = C:\Users\bonny\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)

O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)

O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)

O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)

O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [PlayMovie] C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Java\jre1.6.0_02\bin\jusched.exe (Sun Microsystems, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe File not found

O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe File not found

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)

O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{173DC93C-7476-469B-91B4-B8737CCA3430}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3AAD3EEA-759D-4612-A488-E87F1F4F8FBA}: DhcpNameServer = 192.168.178.1

O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{228eb1dd-6396-11e0-b52a-705ab6075b97}\Shell - "" = AutoRun

O33 - MountPoints2\{228eb1dd-6396-11e0-b52a-705ab6075b97}\Shell\AutoRun\command - "" = E:\Startme.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.06.04 18:38:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in

[2012.06.04 18:36:26 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\bonny\Desktop\OTL.exe

[2012.06.04 17:46:36 | 000,000,000 | ---D | C] -- C:\Users\bonny\Desktop\Virus + Trojaner

[2012.06.04 17:46:14 | 000,000,000 | ---D | C] -- C:\Users\bonny\Desktop\Sonstiges

[2012.06.04 17:44:23 | 000,000,000 | ---D | C] -- C:\Users\bonny\Desktop\Screens

[2012.06.04 15:50:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PC Tools

[2012.06.04 15:07:14 | 000,000,000 | ---D | C] -- C:\Users\bonny\AppData\Roaming\Malwarebytes

[2012.06.04 15:06:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.06.04 15:06:24 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.06.04 15:06:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.06.04 14:08:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client

[2012.06.04 14:08:16 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client

[2012.05.14 17:05:04 | 000,106,648 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys

[2012.05.14 17:04:43 | 000,000,000 | ---D | C] -- C:\Users\bonny\AppData\Local\G DATA

[2012.05.14 16:48:45 | 000,059,768 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys

[2012.05.14 16:48:12 | 000,122,744 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys

[2012.05.14 16:48:12 | 000,065,912 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys

[2012.05.14 16:48:12 | 000,054,136 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys

[2012.05.14 16:47:19 | 000,000,000 | ---D | C] -- C:\ProgramData\G DATA

[2012.05.14 16:47:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\G Data

[2012.05.14 16:47:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\G Data

[2012.05.14 16:41:03 | 000,000,000 | ---D | C] -- C:\Users\bonny\AppData\Local\Downloaded Installations

[12 C:\Users\bonny\Documents\*.tmp files -> C:\Users\bonny\Documents\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.06.04 18:47:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.06.04 18:40:51 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.06.04 18:40:51 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.06.04 18:38:45 | 000,000,000 | ---- | M] () -- C:\Users\bonny\defogger_reenable

[2012.06.04 18:36:28 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\bonny\Desktop\OTL.exe

[2012.06.04 18:33:48 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.06.04 18:33:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.06.04 18:33:25 | 3219,632,128 | -HS- | M] () -- C:\hiberfil.sys

[2012.06.04 18:00:01 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.06.04 15:52:59 | 000,000,056 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\mbam.context.scan

[2012.06.04 14:09:11 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012.06.04 14:08:34 | 001,541,588 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.06.04 14:08:34 | 000,661,366 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.06.04 14:08:34 | 000,622,512 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.06.04 14:08:34 | 000,133,804 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.06.04 14:08:34 | 000,109,594 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.06.04 12:44:32 | 000,666,689 | ---- | M] () -- C:\Windows\SysWow64\sig.bin

[2012.06.04 12:44:32 | 000,040,417 | ---- | M] () -- C:\Windows\SysWow64\nmp.map

[2012.06.04 12:38:53 | 000,002,348 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2012.05.15 15:23:28 | 001,512,418 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.05.15 11:38:32 | 000,429,656 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.05.14 17:05:04 | 000,106,648 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys

[2012.05.14 16:48:45 | 000,059,768 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys

[2012.05.14 16:48:12 | 000,122,744 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys

[2012.05.14 16:48:12 | 000,065,912 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys

[2012.05.14 16:48:12 | 000,054,136 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys

[2012.05.10 10:26:20 | 000,001,024 | ---- | M] () -- C:\Users\Public\Documents\locked-NTILiveUpdate.dll.onfy

[2012.05.10 10:26:20 | 000,001,024 | ---- | M] () -- C:\Users\Public\Documents\locked-NTIBUN5.dll.sljq

[12 C:\Users\bonny\Documents\*.tmp files -> C:\Users\bonny\Documents\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.06.04 18:38:45 | 000,000,000 | ---- | C] () -- C:\Users\bonny\defogger_reenable

[2012.06.04 17:11:36 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.06.04 15:52:59 | 000,000,056 | ---- | C] () -- C:\Users\bonny\AppData\Roaming\mbam.context.scan

[2012.06.04 14:09:11 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif

[2012.06.04 14:08:49 | 000,001,919 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk

[2012.06.04 14:08:34 | 001,541,588 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.05.14 17:02:01 | 000,666,689 | ---- | C] () -- C:\Windows\SysWow64\sig.bin

[2012.05.14 17:02:01 | 000,040,417 | ---- | C] () -- C:\Windows\SysWow64\nmp.map

 
 ========== LOP Check ==========

 

[2010.07.01 11:08:46 | 000,000,000 | -HSD | M] -- C:\Users\bonny\AppData\Roaming\.#

[2010.03.14 17:18:51 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\GameConsole

[2010.07.03 21:29:00 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\ICQ

[2010.02.12 15:13:24 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\Lexware

[2010.04.23 13:34:13 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\TreeCardGames

[2010.02.27 19:47:45 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\ViquaSoft

[2012.05.08 12:36:37 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:4D066AD2

@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:5D7E5A8F

@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:93DE1838

@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E3C56885

@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:AB689DEA

@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:ABE89FFE

@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:444C53BA

@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:0B9176C0

@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:4CF61E54

@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:D1B5B4F1

 

< End of report >

Zitat:

- Malwarebytes-Anti-Malware (vollständiger Scan) <- ohne Befund

Trotzdem bitte alle Logs davon posten

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.06.04.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

bonny :: BONNY-PC [Administrator]
 

Schutz: Aktiviert
 

04.06.2012 15:45:39

mbam-log-2012-06-04 (15-45-39).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 248904

Laufzeit: 5 Minute(n), 52 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 2

C:\Users\bonny\Downloads\ADLSoft_UnCompressor_triple_2nd_offer_0412_s.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\bonny\Downloads\SoftonicDownloader_fuer_norton-removal-tool.exe (PUP.ToolbarDownloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

2012/06/04 15:40:56 +0200        BONNY-PC        bonny        MESSAGE        Starting protection

2012/06/04 15:40:59 +0200        BONNY-PC        bonny        MESSAGE        Protection started successfully

2012/06/04 15:41:02 +0200        BONNY-PC        bonny        MESSAGE        Starting IP protection

2012/06/04 15:41:05 +0200        BONNY-PC        bonny        MESSAGE        IP Protection started successfully

2012/06/04 15:56:51 +0200        BONNY-PC        bonny        MESSAGE        Starting protection

2012/06/04 15:56:55 +0200        BONNY-PC        bonny        MESSAGE        Protection started successfully

2012/06/04 15:56:58 +0200        BONNY-PC        bonny        MESSAGE        Starting IP protection

2012/06/04 15:57:01 +0200        BONNY-PC        bonny        MESSAGE        IP Protection started successfully

2012/06/04 18:35:46 +0200        BONNY-PC        bonny        MESSAGE        Starting protection

2012/06/04 18:35:49 +0200        BONNY-PC        bonny        MESSAGE        Protection started successfully

2012/06/04 18:35:52 +0200        BONNY-PC        bonny        MESSAGE        Starting IP protection

2012/06/04 18:35:55 +0200        BONNY-PC        bonny        MESSAGE        IP Protection started successfully

Bitte erstmal routinemäßig einen neuen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Vielen Dank schonmal, hier der aktuelle Log vom vollständigen Malwarebyte Scan:

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.06.06.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

bonny :: BONNY-PC [Administrator]
 

Schutz: Deaktiviert
 

06.06.2012 14:22:24

mbam-log-2012-06-06 (14-22-24).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 373149

Laufzeit: 1 Stunde(n), 31 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Und der ESET Log:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=ce7a553625b422439dfb70cde02b6855

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-12-11 12:55:16

# local_time=2011-12-11 01:55:16 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=5893 16776573 100 94 6795 75235184 0 0

# compatibility_mode=8192 67108863 100 0 3714 3714 0 0

# scanned=71851

# found=0

# cleaned=0

# scan_time=2782

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=23eefed40a29c2428dacd9f5c5105088

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-06-06 03:38:12

# local_time=2012-06-06 05:38:12 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=4096 16777215 100 0 176948 176948 0 0

# compatibility_mode=5893 16776574 100 94 180300 90622221 0 0

# compatibility_mode=8192 67108863 100 0 15384858 15384858 0 0

# scanned=133166

# found=0

# cleaned=0

# scan_time=4721

Wolle nochmal freundlich fragen, wie es weitergeht. Das Thema steht nun seit 6 Tagen hier, die letzte Antwort ist bereits 4 Tage her...

Vielen Dank

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.06.04.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

bonny :: BONNY-PC [Administrator]
 

Schutz: Aktiviert
 

04.06.2012 15:45:39

mbam-log-2012-06-04 (15-45-39).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 248904

Laufzeit: 5 Minute(n), 52 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 2

C:\Users\bonny\Downloads\ADLSoft_UnCompressor_triple_2nd_offer_0412_s.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\bonny\Downloads\SoftonicDownloader_fuer_norton-removal-tool.exe (PUP.ToolbarDownloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.06.04.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

bonny :: BONNY-PC [Administrator]
 

Schutz: Aktiviert
 

04.06.2012 15:57:13

mbam-log-2012-06-04 (15-57-13).txt
 

Art des Suchlaufs: Flash-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: Registrierung | Dateisystem | P2P

Durchsuchte Objekte: 209305

Laufzeit: 21 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.06.04.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

bonny :: BONNY-PC [Administrator]
 

Schutz: Aktiviert
 

04.06.2012 15:58:10

mbam-log-2012-06-04 (15-58-10).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 387623

Laufzeit: 1 Stunde(n), 9 Minute(n), 12 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.06.04.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

bonny :: BONNY-PC [Administrator]
 

Schutz: Aktiviert
 

04.06.2012 15:57:13

mbam-log-2012-06-04 (15-57-13).txt
 

Art des Suchlaufs: Flash-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: Registrierung | Dateisystem | P2P

Durchsuchte Objekte: 209305

Laufzeit: 21 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.06.04.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

bonny :: BONNY-PC [Administrator]
 

Schutz: Aktiviert
 

04.06.2012 15:45:39

mbam-log-2012-06-04 (15-45-39).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 248904

Laufzeit: 5 Minute(n), 52 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 2

C:\Users\bonny\Downloads\ADLSoft_UnCompressor_triple_2nd_offer_0412_s.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\bonny\Downloads\SoftonicDownloader_fuer_norton-removal-tool.exe (PUP.ToolbarDownloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Das sind alle Logs, die dort verfügbar sind!

Zitat:

C:\Users\bonny\Downloads\SoftonicDownloader_fuer_norton-removal-tool.exe

Finger weg von Softonic!! :pfui:

Softonic ist eine Toolbar- und Adwareschleuder! Finger weg! Software lädt man sich mit oberster Priorität direkt vom Hersteller und nicht von solchen Toolbarklitschen wie Softonic! Im Notfall würde natürlich chip.de gehen

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Zitat:

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?

Windows funktioniert ohne Probleme, auch MS Security Essentials meldet nichts mehr!

Zitat:

2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Ich vermisse dort nichts, alle Ordner sind noch da!

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 10.06.2012 21:37:12 - Run 4

OTL by OldTimer - Version 3.2.46.0     Folder = C:\Users\bonny\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,82 Gb Available Physical Memory | 70,63% Memory free

7,99 Gb Paging File | 6,56 Gb Available in Paging File | 82,03% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 453,66 Gb Total Space | 402,12 Gb Free Space | 88,64% Space Free | Partition Type: NTFS

 

Computer Name: BONNY-PC | User Name: bonny | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - File not found -- 

PRC - [2012.06.04 18:36:28 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\bonny\Desktop\OTL.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

PRC - [2009.10.29 13:47:34 | 000,419,112 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

PRC - [2009.10.22 04:53:42 | 000,181,480 | ---- | M] (Acer Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe

PRC - [2009.10.13 21:25:54 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2009.10.13 21:25:30 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2009.08.28 11:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

PRC - [2009.08.18 11:42:08 | 001,157,128 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe

PRC - [2009.07.04 04:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe

PRC - [2008.07.29 20:29:26 | 000,200,704 | ---- | M] () -- C:\Windows\PLFSetI.exe

PRC - [2007.07.12 05:00:36 | 000,132,496 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Java\jre1.6.0_02\bin\jusched.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll

MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

MOD - [2008.07.29 20:29:26 | 000,200,704 | ---- | M] () -- C:\Windows\PLFSetI.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2012.04.06 04:16:02 | 000,236,544 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2010.11.20 15:26:50 | 000,084,992 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\Mcx2Svc.dll -- (Mcx2Svc)

SRV:64bit: - [2009.07.14 03:41:27 | 000,097,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\mprdim.dll -- (RemoteAccess)

SRV - [2012.06.06 02:35:17 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.06.04 17:11:36 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012.03.26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2012.03.26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2010.12.13 14:37:16 | 000,194,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.10.29 21:10:02 | 000,844,320 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)

SRV - [2009.10.13 21:25:30 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

SRV - [2009.09.10 15:42:46 | 000,305,448 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)

SRV - [2009.08.28 11:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)

SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysWOW64\mprdim.dll -- (RemoteAccess)

SRV - [2009.07.04 04:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.06.10 22:39:58 | 000,089,920 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.05.14 16:48:45 | 000,059,768 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PktIcpt.sys -- (GDPkIcpt)

DRV:64bit: - [2012.04.06 07:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2012.04.06 07:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2012.04.06 03:10:44 | 000,343,040 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.03.20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.12.13 14:37:18 | 000,036,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nx6000.sys -- (MSHUSBVideo)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 11:26:11 | 000,328,192 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\udfs.sys -- (udfs)

DRV:64bit: - [2009.11.13 10:47:38 | 000,067,072 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)

DRV:64bit: - [2009.10.13 21:16:40 | 000,409,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2009.10.05 17:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

DRV:64bit: - [2009.09.02 03:58:08 | 000,225,280 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV:64bit: - [2009.08.21 11:18:16 | 002,978,296 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:47:48 | 000,024,144 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\crcdisk.sys -- (crcdisk)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\ws2ifsl.sys -- (ws2ifsl)

DRV:64bit: - [2009.07.14 01:19:47 | 000,092,160 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\cdfs.sys -- (cdfs)

DRV:64bit: - [2009.06.18 14:12:32 | 000,272,432 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.06.02 13:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)

DRV:64bit: - [2009.06.02 13:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)

DRV:64bit: - [2009.06.02 13:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)

DRV:64bit: - [2009.05.05 10:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)

DRV:64bit: - [2009.05.05 10:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)

DRV:64bit: - [2007.11.02 14:22:28 | 000,108,072 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s217bus.sys -- (s217bus) Sony Ericsson Device 217 driver (WDM)

DRV - [2009.09.02 03:58:08 | 000,225,280 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

DRV - [2009.03.26 05:16:08 | 000,025,608 | ---- | M] (Dritek System Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\DKbFltr.sys -- (DKbFltr) Dritek Keyboard Filter Driver (64-bit)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE - HKLM\..\URLSearchHook:  - No CLSID value found

IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{2059CF48-25F3-40d7-9D37-24A3142FD20B}: "URL" = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=3379&q={searchTerms}&rp=&s_it=tb50-ie-aolde-chromesbox-de-de

IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\URLSearchHook:  - No CLSID value found

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=109794&babsrc=SP_ss&mntrId=6cc36c73000000000000761a04ba0b95

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes\{2059CF48-25F3-40d7-9D37-24A3142FD20B}: "URL" = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=3379&q={searchTerms}&rp=&s_it=tb50-ie-aolde-chromesbox-de-de

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE364

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ACAW_deDE364

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.search.suggest.enabled: false

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.1.6&q="

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.06.04 12:52:00 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.06 02:35:19 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.05 18:47:37 | 000,000,000 | ---D | M]

 

[2010.02.11 14:00:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\bonny\AppData\Roaming\mozilla\Extensions

[2012.06.04 17:18:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\bonny\AppData\Roaming\mozilla\Firefox\Profiles\2tx3ff8e.default\extensions

[2012.06.04 13:52:33 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-1.xml

[2012.02.06 12:43:18 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-2.xml

[2012.02.26 15:13:38 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-3.xml

[2012.06.04 12:35:42 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-4.xml

[2012.06.06 02:35:28 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-5.xml

[2011.12.01 04:02:03 | 000,001,056 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin.xml

[2012.06.04 15:10:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2012.06.04 12:52:00 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 &lt;video&gt;) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5

[2012.06.04 17:18:14 | 000,089,075 | ---- | M] () (No name found) -- C:\USERS\BONNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2TX3FF8E.DEFAULT\EXTENSIONS\{02450914-CDD9-410F-B1DA-DB004E18C671}.XPI

[2012.06.06 02:35:19 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.01.17 11:37:14 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2012.06.06 02:35:14 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.01.28 14:53:55 | 000,002,310 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml

[2012.06.06 02:35:14 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012.06.06 02:35:14 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012.06.06 02:35:14 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.06.06 02:35:14 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.06.06 02:35:14 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Users\bonny\AppData\Local\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\bonny\AppData\Local\Google\Chrome\Application\19.0.1084.52\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Users\bonny\AppData\Local\Google\Chrome\Application\19.0.1084.52\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U23 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: downloadUpdater (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll

CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll

CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll

CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll

CHR - Extension: YouTube = C:\Users\bonny\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: Google-Suche = C:\Users\bonny\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\

CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\bonny\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\

CHR - Extension: Google Mail = C:\Users\bonny\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)

O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)

O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)

O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [PlayMovie] C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Java\jre1.6.0_02\bin\jusched.exe (Sun Microsystems, Inc.)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe File not found

O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe File not found

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)

O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{173DC93C-7476-469B-91B4-B8737CCA3430}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3AAD3EEA-759D-4612-A488-E87F1F4F8FBA}: DhcpNameServer = 192.168.178.1

O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{228eb1dd-6396-11e0-b52a-705ab6075b97}\Shell - "" = AutoRun

O33 - MountPoints2\{228eb1dd-6396-11e0-b52a-705ab6075b97}\Shell\AutoRun\command - "" = E:\Startme.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

 

 

SafeBootMin:64bit: AppMgmt - Service

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: mcmscsvc - Service

SafeBootMin:64bit: MCODS - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: WudfRd - Driver

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: mcmscsvc - Service

SafeBootMin: MCODS - Service

SafeBootMin: MsMpSvc - c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WudfRd - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - Service

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: mcmscsvc - Service

SafeBootNet:64bit: MCODS - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: MpfService - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WudfRd - Driver

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: mcmscsvc - Service

SafeBootNet: MCODS - Service

SafeBootNet: Messenger - Service

SafeBootNet: MpfService - Service

SafeBootNet: MsMpSvc - c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfRd - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.06.06 04:33:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client

[2012.06.06 04:33:44 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client

[2012.06.06 04:31:08 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI

[2012.06.06 04:23:54 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD

[2012.06.06 04:23:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT

[2012.06.06 04:23:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP

[2012.06.06 04:23:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies

[2012.06.06 04:23:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center

[2012.06.06 04:22:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies

[2012.06.06 04:20:43 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies

[2012.06.06 04:17:25 | 000,000,000 | ---D | C] -- C:\AMD

[2012.06.06 03:41:47 | 000,000,000 | ---D | C] -- C:\Users\bonny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

[2012.06.06 02:35:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service

[2012.06.06 02:35:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla

[2012.06.05 19:01:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy

[2012.06.05 19:00:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy

[2012.06.05 19:00:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy

[2012.06.05 18:47:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe

[2012.06.04 18:38:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in

[2012.06.04 18:36:26 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\bonny\Desktop\OTL.exe

[2012.06.04 17:46:36 | 000,000,000 | ---D | C] -- C:\Users\bonny\Desktop\Virus + Trojaner

[2012.06.04 17:46:14 | 000,000,000 | ---D | C] -- C:\Users\bonny\Desktop\Sonstiges

[2012.06.04 17:44:23 | 000,000,000 | ---D | C] -- C:\Users\bonny\Desktop\Screens

[2012.06.04 15:50:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PC Tools

[2012.06.04 15:07:14 | 000,000,000 | ---D | C] -- C:\Users\bonny\AppData\Roaming\Malwarebytes

[2012.06.04 15:06:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.06.04 15:06:24 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.06.04 15:06:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.05.14 17:05:04 | 000,106,648 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys

[2012.05.14 17:04:43 | 000,000,000 | ---D | C] -- C:\Users\bonny\AppData\Local\G DATA

[2012.05.14 16:48:45 | 000,059,768 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys

[2012.05.14 16:48:12 | 000,122,744 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys

[2012.05.14 16:48:12 | 000,065,912 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys

[2012.05.14 16:48:12 | 000,054,136 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys

[2012.05.14 16:47:19 | 000,000,000 | ---D | C] -- C:\ProgramData\G DATA

[2012.05.14 16:47:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\G Data

[2012.05.14 16:47:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\G Data

[2012.05.14 16:41:03 | 000,000,000 | ---D | C] -- C:\Users\bonny\AppData\Local\Downloaded Installations

[12 C:\Users\bonny\Documents\*.tmp files -> C:\Users\bonny\Documents\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.06.10 21:00:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.06.10 20:47:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.06.10 20:08:45 | 000,000,448 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for bonny.job

[2012.06.10 20:08:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.06.10 17:43:18 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.06.10 12:10:31 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.06.10 12:10:31 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.06.10 12:03:03 | 3219,632,128 | -HS- | M] () -- C:\hiberfil.sys

[2012.06.06 04:33:56 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012.06.06 04:33:49 | 001,541,588 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.06.06 04:33:49 | 000,661,366 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.06.06 04:33:49 | 000,622,512 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.06.06 04:33:49 | 000,133,804 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.06.06 04:33:49 | 000,109,594 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.06.06 03:41:49 | 000,002,282 | ---- | M] () -- C:\Users\bonny\Desktop\Google Chrome.lnk

[2012.06.06 01:06:18 | 000,006,100 | ---- | M] () -- C:\Users\bonny\Desktop\Der nächste..._1338937573449.png

[2012.06.04 18:58:06 | 000,302,592 | ---- | M] () -- C:\Users\bonny\Desktop\g0gvtrdf.exe

[2012.06.04 18:38:45 | 000,000,000 | ---- | M] () -- C:\Users\bonny\defogger_reenable

[2012.06.04 18:36:28 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\bonny\Desktop\OTL.exe

[2012.06.04 15:52:59 | 000,000,056 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\mbam.context.scan

[2012.06.04 12:44:32 | 000,666,689 | ---- | M] () -- C:\Windows\SysWow64\sig.bin

[2012.06.04 12:44:32 | 000,040,417 | ---- | M] () -- C:\Windows\SysWow64\nmp.map

[2012.05.15 15:23:28 | 001,512,418 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.05.15 11:38:32 | 000,429,656 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.05.14 17:05:04 | 000,106,648 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys

[2012.05.14 16:48:45 | 000,059,768 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys

[2012.05.14 16:48:12 | 000,122,744 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys

[2012.05.14 16:48:12 | 000,065,912 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys

[2012.05.14 16:48:12 | 000,054,136 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys

[12 C:\Users\bonny\Documents\*.tmp files -> C:\Users\bonny\Documents\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.06.06 04:33:52 | 000,001,919 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk

[2012.06.06 03:41:49 | 000,002,282 | ---- | C] () -- C:\Users\bonny\Desktop\Google Chrome.lnk

[2012.06.06 01:06:18 | 000,006,100 | ---- | C] () -- C:\Users\bonny\Desktop\Der nächste..._1338937573449.png

[2012.06.05 18:47:37 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

[2012.06.04 18:58:06 | 000,302,592 | ---- | C] () -- C:\Users\bonny\Desktop\g0gvtrdf.exe

[2012.06.04 18:38:45 | 000,000,000 | ---- | C] () -- C:\Users\bonny\defogger_reenable

[2012.06.04 17:11:36 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.06.04 15:52:59 | 000,000,056 | ---- | C] () -- C:\Users\bonny\AppData\Roaming\mbam.context.scan

[2012.06.04 14:09:11 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif

[2012.06.04 14:08:34 | 001,541,588 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.05.14 17:02:01 | 000,666,689 | ---- | C] () -- C:\Windows\SysWow64\sig.bin

[2012.05.14 17:02:01 | 000,040,417 | ---- | C] () -- C:\Windows\SysWow64\nmp.map

[2012.04.06 03:29:34 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2012.04.06 03:29:34 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2012.03.09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

 
 ========== LOP Check ==========

 

[2010.07.01 11:08:46 | 000,000,000 | -HSD | M] -- C:\Users\bonny\AppData\Roaming\.#

[2010.03.14 17:18:51 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\GameConsole

[2010.07.03 21:29:00 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\ICQ

[2010.02.12 15:13:24 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\Lexware

[2010.04.23 13:34:13 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\TreeCardGames

[2010.02.27 19:47:45 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\ViquaSoft

[2011.12.02 10:09:27 | 000,000,000 | ---D | M] -- C:\Users\Firma\AppData\Roaming\Lexware

[2011.12.26 19:57:58 | 000,000,000 | ---D | M] -- C:\Users\KSK\AppData\Roaming\Avery

[2011.12.19 11:34:41 | 000,000,000 | ---D | M] -- C:\Users\KSK\AppData\Roaming\Lexware

[2012.01.30 12:00:35 | 000,000,000 | ---D | M] -- C:\Users\KSK\AppData\Roaming\Template

[2012.06.04 15:04:08 | 000,000,000 | ---D | M] -- C:\Users\KSK\AppData\Roaming\Yeplhit

[2012.05.08 12:36:37 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2010.07.01 11:08:46 | 000,000,000 | -HSD | M] -- C:\Users\bonny\AppData\Roaming\.#

[2012.06.05 18:48:19 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\Adobe

[2010.01.30 13:37:54 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\ATI

[2010.03.14 17:18:51 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\GameConsole

[2010.01.30 13:42:51 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\Google

[2010.07.03 21:29:00 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\ICQ

[2010.01.30 13:36:38 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\Identities

[2010.02.12 15:13:24 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\Lexware

[2010.01.30 13:37:11 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\Macromedia

[2012.06.04 15:07:14 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\Malwarebytes

[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\Media Center Programs

[2012.06.05 18:48:19 | 000,000,000 | --SD | M] -- C:\Users\bonny\AppData\Roaming\Microsoft

[2011.12.26 19:38:44 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\Mozilla

[2010.04.23 13:34:13 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\TreeCardGames

[2010.02.27 19:47:45 | 000,000,000 | ---D | M] -- C:\Users\bonny\AppData\Roaming\ViquaSoft

 
 < %APPDATA%\*.exe /s >

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2009.10.13 21:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys

[2009.10.13 21:16:40 | 000,409,624 | ---- | M] (Intel Corporation) MD5=BE7D72FCF442C26975942007E0831241 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys

[2009.10.13 21:16:40 | 000,409,624 | ---- | M] (Intel Corporation) MD5=BE7D72FCF442C26975942007E0831241 -- C:\Windows\SysNative\drivers\iaStor.sys

[2009.10.13 21:16:40 | 000,409,624 | ---- | M] (Intel Corporation) MD5=BE7D72FCF442C26975942007E0831241 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_6fca727099cdabf1\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:4D066AD2

@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:5D7E5A8F

@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:93DE1838

@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E3C56885

@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:AB689DEA

@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:ABE89FFE

@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:444C53BA

@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:0B9176C0

@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:4CF61E54

@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:D1B5B4F1
 

< End of report >

Zitat:

O2 - BHO: (DivX Plus Web Player HTML5 <video>)

Sagmal gehörst du auch zur der Fraktion, die sich Serien und Kinofilme über dubiose Portale anschaut?
Wenn ja: in Zukunft Finger weg, diese illegalen Portale verbreiten Malware und wenn du in Zukunft malwarefrei sein wilst, musst du auf legale Alternativen ausweichen und auf solche riskanten Streamingseiten verzichten!
Gerade solche Streamingseiten sind für die aktuelle Welle der Erpresserschädlinge verantwortlich, die Windows blockieren und 50 oder 100 EUR erpressen wollen!!

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE - HKLM\..\URLSearchHook:  - No CLSID value found

IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{2059CF48-25F3-40d7-9D37-24A3142FD20B}: "URL" = http://slirsredirect.search.aol.com/redirector/sredir?sredir=3379&q={searchTerms}&rp=&s_it=tb50-ie-aolde-chromesbox-de-de

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360110l735l03d4z125t5942c349

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\URLSearchHook:  - No CLSID value found

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&AF=109794&babsrc=SP_ss&mntrId=6cc36c73000000000000761a04ba0b95

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes\{2059CF48-25F3-40d7-9D37-24A3142FD20B}: "URL" = http://slirsredirect.search.aol.com/redirector/sredir?sredir=3379&q={searchTerms}&rp=&s_it=tb50-ie-aolde-chromesbox-de-de

IE - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.search.suggest.enabled: false

FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.1.6&q="

FF - user.js - File not found

[2012.06.04 13:52:33 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-1.xml

[2012.02.06 12:43:18 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-2.xml

[2012.02.26 15:13:38 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-3.xml

[2012.06.04 12:35:42 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-4.xml

[2012.06.06 02:35:28 | 000,000,950 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-5.xml

[2011.12.01 04:02:03 | 000,001,056 | ---- | M] () -- C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin.xml

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe File not found

O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe File not found

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{228eb1dd-6396-11e0-b52a-705ab6075b97}\Shell - "" = AutoRun

O33 - MountPoints2\{228eb1dd-6396-11e0-b52a-705ab6075b97}\Shell\AutoRun\command - "" = E:\Startme.exe

[2010.07.01 11:08:46 | 000,000,000 | -HSD | M] -- C:\Users\bonny\AppData\Roaming\.#

@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:4D066AD2

@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:5D7E5A8F

@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:93DE1838

@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E3C56885

@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:AB689DEA

@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:ABE89FFE

@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:444C53BA

@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:0B9176C0

@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:4CF61E54

@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:D1B5B4F1

:Commands

[purity]

[emptytemp]

[emptyflash]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Zitat:

Hm schwierig zu beantworten, da der Rechner von meinen Eltern ist. Ich werde es jedenfalls direkt so weitergeben.

Anbei nun das Logfile nach dem Fix!

Code:

All processes killed

========== OTL ==========

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2059CF48-25F3-40d7-9D37-24A3142FD20B}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2059CF48-25F3-40d7-9D37-24A3142FD20B}\ not found.

HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!

HKU\S-1-5-21-2079184332-2997649951-1821268657-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

Registry value HKEY_USERS\S-1-5-21-2079184332-2997649951-1821268657-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.

HKEY_USERS\S-1-5-21-2079184332-2997649951-1821268657-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_USERS\S-1-5-21-2079184332-2997649951-1821268657-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_USERS\S-1-5-21-2079184332-2997649951-1821268657-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.

Registry key HKEY_USERS\S-1-5-21-2079184332-2997649951-1821268657-1000\Software\Microsoft\Internet Explorer\SearchScopes\{2059CF48-25F3-40d7-9D37-24A3142FD20B}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2059CF48-25F3-40d7-9D37-24A3142FD20B}\ not found.

Registry key HKEY_USERS\S-1-5-21-2079184332-2997649951-1821268657-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.

Prefs.js: "ICQ Search" removed from browser.search.defaultenginename

Prefs.js: "ICQ Search" removed from browser.search.selectedEngine

Prefs.js: false removed from browser.search.suggest.enabled

Prefs.js: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1 removed from extensions.enabledItems

Prefs.js: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 removed from extensions.enabledItems

Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.1.6&q=" removed from keyword.URL

C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-1.xml moved successfully.

C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-2.xml moved successfully.

C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-3.xml moved successfully.

C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-4.xml moved successfully.

C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin-5.xml moved successfully.

C:\Users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\searchplugins\icqplugin.xml moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{326E768D-4182-46FD-9C16-1449A49795F4}\ deleted successfully.

C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.

64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2079184332-2997649951-1821268657-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}\ not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{228eb1dd-6396-11e0-b52a-705ab6075b97}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{228eb1dd-6396-11e0-b52a-705ab6075b97}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{228eb1dd-6396-11e0-b52a-705ab6075b97}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{228eb1dd-6396-11e0-b52a-705ab6075b97}\ not found.

File E:\Startme.exe not found.

C:\Users\bonny\AppData\Roaming\.# folder moved successfully.

ADS C:\ProgramData\Temp:4D066AD2 deleted successfully.

ADS C:\ProgramData\Temp:5D7E5A8F deleted successfully.

ADS C:\ProgramData\Temp:93DE1838 deleted successfully.

ADS C:\ProgramData\Temp:E3C56885 deleted successfully.

ADS C:\ProgramData\Temp:AB689DEA deleted successfully.

ADS C:\ProgramData\Temp:ABE89FFE deleted successfully.

ADS C:\ProgramData\Temp:444C53BA deleted successfully.

ADS C:\ProgramData\Temp:0B9176C0 deleted successfully.

ADS C:\ProgramData\Temp:4CF61E54 deleted successfully.

ADS C:\ProgramData\Temp:D1B5B4F1 deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: bonny

->Temp folder emptied: 52627972 bytes

->Temporary Internet Files folder emptied: 15617442 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 51804041 bytes

->Flash cache emptied: 0 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Firma

->Temp folder emptied: 32891 bytes

->Temporary Internet Files folder emptied: 945332 bytes

->FireFox cache emptied: 8471016 bytes

->Google Chrome cache emptied: 6395098 bytes

->Flash cache emptied: 531 bytes

 

User: KSK

->Temp folder emptied: 44026821 bytes

->Temporary Internet Files folder emptied: 163220232 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 291883220 bytes

->Flash cache emptied: 1783 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 1181702 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 84241347 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 687,00 mb

 

 

[EMPTYFLASH]

 

User: All Users

 

User: bonny

->Flash cache emptied: 0 bytes

 

User: Default

 

User: Default User

 

User: Firma

->Flash cache emptied: 0 bytes

 

User: KSK

->Flash cache emptied: 0 bytes

 

User: Public

 

Total Flash Files Cleaned = 0,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.46.0 log created on 06112012_150448
 

Files\Folders moved on Reboot...

C:\Users\bonny\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

Registry entries deleted on Reboot...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Code:

16:38:29.0518 1160        TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16

16:38:29.0689 1160        ============================================================

16:38:29.0689 1160        Current date / time: 2012/06/11 16:38:29.0689

16:38:29.0689 1160        SystemInfo:

16:38:29.0689 1160        

16:38:29.0689 1160        OS Version: 6.1.7601 ServicePack: 1.0

16:38:29.0689 1160        Product type: Workstation

16:38:29.0689 1160        ComputerName: BONNY-PC

16:38:29.0689 1160        UserName: bonny

16:38:29.0689 1160        Windows directory: C:\Windows

16:38:29.0689 1160        System windows directory: C:\Windows

16:38:29.0689 1160        Running under WOW64

16:38:29.0689 1160        Processor architecture: Intel x64

16:38:29.0689 1160        Number of processors: 2

16:38:29.0689 1160        Page size: 0x1000

16:38:29.0689 1160        Boot type: Normal boot

16:38:29.0689 1160        ============================================================

16:38:30.0236 1160        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

16:38:30.0241 1160        ============================================================

16:38:30.0241 1160        \Device\Harddisk0\DR0:

16:38:30.0242 1160        MBR partitions:

16:38:30.0242 1160        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1801F5F, BlocksNum 0x32FCD

16:38:30.0242 1160        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1834F2C, BlocksNum 0x38B50904

16:38:30.0242 1160        ============================================================

16:38:30.0275 1160        C: <-> \Device\Harddisk0\DR0\Partition1

16:38:30.0275 1160        ============================================================

16:38:30.0275 1160        Initialize success

16:38:30.0275 1160        ============================================================

16:39:00.0104 0600        ============================================================

16:39:00.0104 0600        Scan started

16:39:00.0104 0600        Mode: Manual; SigCheck; TDLFS; 

16:39:00.0104 0600        ============================================================

16:39:00.0564 0600        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys

16:39:00.0670 0600        1394ohci - ok

16:39:00.0699 0600        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

16:39:00.0727 0600        ACPI - ok

16:39:00.0764 0600        AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

16:39:00.0853 0600        AcpiPmi - ok

16:39:00.0990 0600        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

16:39:01.0010 0600        AdobeARMservice - ok

16:39:01.0122 0600        AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

16:39:01.0155 0600        AdobeFlashPlayerUpdateSvc - ok

16:39:01.0227 0600        adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

16:39:01.0273 0600        adp94xx - ok

16:39:01.0340 0600        adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

16:39:01.0371 0600        adpahci - ok

16:39:01.0418 0600        adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

16:39:01.0449 0600        adpu320 - ok

16:39:01.0480 0600        AeLookupSvc     (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll

16:39:01.0621 0600        AeLookupSvc - ok

16:39:01.0683 0600        AFD             (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys

16:39:01.0777 0600        AFD - ok

16:39:01.0823 0600        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

16:39:01.0855 0600        agp440 - ok

16:39:01.0870 0600        ALG             (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe

16:39:01.0964 0600        ALG - ok

16:39:02.0011 0600        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

16:39:02.0026 0600        aliide - ok

16:39:02.0057 0600        AMD External Events Utility (20c8a3e435a47f0408a1ea674afa6194) C:\Windows\system32\atiesrxx.exe

16:39:02.0182 0600        AMD External Events Utility - ok

16:39:02.0213 0600        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

16:39:02.0245 0600        amdide - ok

16:39:02.0276 0600        AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

16:39:02.0341 0600        AmdK8 - ok

16:39:02.0904 0600        amdkmdag        (0b45c18b0f3ee996d25baa4e74884b83) C:\Windows\system32\DRIVERS\atikmdag.sys

16:39:03.0245 0600        amdkmdag - ok

16:39:03.0387 0600        amdkmdap        (0e57258e5cc4cc7a9a9a877afdf0cec6) C:\Windows\system32\DRIVERS\atikmpag.sys

16:39:03.0434 0600        amdkmdap - ok

16:39:03.0496 0600        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

16:39:03.0528 0600        AmdPPM - ok

16:39:03.0574 0600        amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

16:39:03.0590 0600        amdsata - ok

16:39:03.0652 0600        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

16:39:03.0699 0600        amdsbs - ok

16:39:03.0715 0600        amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

16:39:03.0715 0600        amdxata - ok

16:39:03.0762 0600        AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

16:39:03.0964 0600        AppID - ok

16:39:03.0980 0600        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll

16:39:04.0027 0600        AppIDSvc - ok

16:39:04.0089 0600        Appinfo         (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll

16:39:04.0152 0600        Appinfo - ok

16:39:04.0198 0600        arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

16:39:04.0214 0600        arc - ok

16:39:04.0230 0600        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

16:39:04.0245 0600        arcsas - ok

16:39:04.0261 0600        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

16:39:04.0351 0600        AsyncMac - ok

16:39:04.0386 0600        atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

16:39:04.0400 0600        atapi - ok

16:39:04.0489 0600        athr            (0acc06fcf46f64ed4f11e57ee461c1f4) C:\Windows\system32\DRIVERS\athrx.sys

16:39:04.0598 0600        athr - ok

16:39:05.0259 0600        atikmdag        (0b45c18b0f3ee996d25baa4e74884b83) C:\Windows\system32\DRIVERS\atikmdag.sys

16:39:05.0392 0600        atikmdag - ok

16:39:05.0548 0600        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

16:39:05.0642 0600        AudioEndpointBuilder - ok

16:39:05.0657 0600        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

16:39:05.0704 0600        AudioSrv - ok

16:39:05.0767 0600        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll

16:39:05.0876 0600        AxInstSV - ok

16:39:05.0954 0600        b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

16:39:06.0032 0600        b06bdrv - ok

16:39:06.0063 0600        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

16:39:06.0125 0600        b57nd60a - ok

16:39:06.0297 0600        BCM43XX         (b44879610f2dc4a046b14befa3ae72de) C:\Windows\system32\DRIVERS\bcmwl664.sys

16:39:06.0433 0600        BCM43XX - ok

16:39:06.0524 0600        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll

16:39:06.0576 0600        BDESVC - ok

16:39:06.0621 0600        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

16:39:06.0700 0600        Beep - ok

16:39:06.0794 0600        BFE             (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll

16:39:06.0900 0600        BFE - ok

16:39:06.0978 0600        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll

16:39:07.0085 0600        BITS - ok

16:39:07.0151 0600        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

16:39:07.0190 0600        blbdrive - ok

16:39:07.0242 0600        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

16:39:07.0277 0600        bowser - ok

16:39:07.0300 0600        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

16:39:07.0378 0600        BrFiltLo - ok

16:39:07.0409 0600        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

16:39:07.0441 0600        BrFiltUp - ok

16:39:07.0472 0600        Browser         (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll

16:39:07.0534 0600        Browser - ok

16:39:07.0565 0600        Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

16:39:07.0643 0600        Brserid - ok

16:39:07.0659 0600        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

16:39:07.0690 0600        BrSerWdm - ok

16:39:07.0721 0600        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

16:39:07.0768 0600        BrUsbMdm - ok

16:39:07.0784 0600        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

16:39:07.0831 0600        BrUsbSer - ok

16:39:07.0846 0600        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

16:39:07.0877 0600        BTHMODEM - ok

16:39:07.0924 0600        bthserv         (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll

16:39:07.0987 0600        bthserv - ok

16:39:08.0033 0600        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

16:39:08.0080 0600        cdfs - ok

16:39:08.0143 0600        cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys

16:39:08.0174 0600        cdrom - ok

16:39:08.0236 0600        CertPropSvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

16:39:08.0314 0600        CertPropSvc - ok

16:39:08.0345 0600        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

16:39:08.0387 0600        circlass - ok

16:39:08.0430 0600        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

16:39:08.0459 0600        CLFS - ok

16:39:08.0513 0600        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

16:39:08.0533 0600        clr_optimization_v2.0.50727_32 - ok

16:39:08.0572 0600        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

16:39:08.0589 0600        clr_optimization_v2.0.50727_64 - ok

16:39:08.0670 0600        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

16:39:08.0688 0600        clr_optimization_v4.0.30319_32 - ok

16:39:08.0742 0600        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

16:39:08.0762 0600        clr_optimization_v4.0.30319_64 - ok

16:39:08.0793 0600        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

16:39:08.0822 0600        CmBatt - ok

16:39:08.0848 0600        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

16:39:08.0861 0600        cmdide - ok

16:39:08.0916 0600        CNG             (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys

16:39:08.0974 0600        CNG - ok

16:39:09.0008 0600        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

16:39:09.0022 0600        Compbatt - ok

16:39:09.0059 0600        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys

16:39:09.0092 0600        CompositeBus - ok

16:39:09.0106 0600        COMSysApp - ok

16:39:09.0128 0600        crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

16:39:09.0141 0600        crcdisk - ok

16:39:09.0188 0600        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll

16:39:09.0255 0600        CryptSvc - ok

16:39:09.0292 0600        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

16:39:09.0364 0600        DcomLaunch - ok

16:39:09.0442 0600        defragsvc       (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll

16:39:09.0533 0600        defragsvc - ok

16:39:09.0582 0600        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

16:39:09.0636 0600        DfsC - ok

16:39:09.0676 0600        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll

16:39:09.0743 0600        Dhcp - ok

16:39:09.0765 0600        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

16:39:09.0804 0600        discache - ok

16:39:09.0859 0600        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

16:39:09.0884 0600        Disk - ok

16:39:09.0990 0600        DKbFltr         (d5bcb77be83cf99f508943945d46343d) C:\Windows\SysWOW64\Drivers\DKbFltr.sys

16:39:10.0002 0600        DKbFltr - ok

16:39:10.0040 0600        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll

16:39:10.0085 0600        Dnscache - ok

16:39:10.0122 0600        dot3svc         (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll

16:39:10.0197 0600        dot3svc - ok

16:39:10.0226 0600        DPS             (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll

16:39:10.0278 0600        DPS - ok

16:39:10.0320 0600        drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

16:39:10.0338 0600        drmkaud - ok

16:39:10.0406 0600        DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

16:39:10.0447 0600        DXGKrnl - ok

16:39:10.0461 0600        EapHost         (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll

16:39:10.0523 0600        EapHost - ok

16:39:10.0695 0600        ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

16:39:10.0835 0600        ebdrv - ok

16:39:10.0929 0600        EFS             (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe

16:39:10.0991 0600        EFS - ok

16:39:11.0069 0600        ehRecvr         (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe

16:39:11.0163 0600        ehRecvr - ok

16:39:11.0194 0600        ehSched         (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe

16:39:11.0257 0600        ehSched - ok

16:39:11.0335 0600        elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

16:39:11.0397 0600        elxstor - ok

16:39:11.0491 0600        ePowerSvc       (8e910f796f5f30281cdd24aba47ddea2) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

16:39:11.0569 0600        ePowerSvc - ok

16:39:11.0693 0600        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

16:39:11.0725 0600        ErrDev - ok

16:39:11.0787 0600        EventSystem     (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll

16:39:11.0881 0600        EventSystem - ok

16:39:11.0912 0600        exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

16:39:11.0959 0600        exfat - ok

16:39:11.0990 0600        fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

16:39:12.0037 0600        fastfat - ok

16:39:12.0115 0600        Fax             (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe

16:39:12.0177 0600        Fax - ok

16:39:12.0193 0600        fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

16:39:12.0208 0600        fdc - ok

16:39:12.0239 0600        fdPHost         (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll

16:39:12.0319 0600        fdPHost - ok

16:39:12.0341 0600        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll

16:39:12.0408 0600        FDResPub - ok

16:39:12.0444 0600        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

16:39:12.0459 0600        FileInfo - ok

16:39:12.0469 0600        Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

16:39:12.0523 0600        Filetrace - ok

16:39:12.0558 0600        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

16:39:12.0585 0600        flpydisk - ok

16:39:12.0643 0600        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

16:39:12.0681 0600        FltMgr - ok

16:39:12.0757 0600        FontCache       (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll

16:39:12.0879 0600        FontCache - ok

16:39:12.0938 0600        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

16:39:12.0954 0600        FontCache3.0.0.0 - ok

16:39:13.0009 0600        FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

16:39:13.0032 0600        FsDepends - ok

16:39:13.0055 0600        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys

16:39:13.0077 0600        Fs_Rec - ok

16:39:13.0122 0600        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

16:39:13.0143 0600        fvevol - ok

16:39:13.0173 0600        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

16:39:13.0187 0600        gagp30kx - ok

16:39:13.0246 0600        GDPkIcpt        (290ddb8c97249f99569b77e9df2f76fc) C:\Windows\system32\drivers\PktIcpt.sys

16:39:13.0267 0600        GDPkIcpt - ok

16:39:13.0320 0600        gpsvc           (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll

16:39:13.0445 0600        gpsvc - ok

16:39:13.0554 0600        Greg_Service    (816fd5a6f3c2f3d600900096632fc60e) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

16:39:13.0632 0600        Greg_Service - ok

16:39:13.0710 0600        gupdate         (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

16:39:13.0742 0600        gupdate - ok

16:39:13.0757 0600        gupdatem        (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

16:39:13.0773 0600        gupdatem - ok

16:39:13.0882 0600        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

16:39:13.0913 0600        hcw85cir - ok

16:39:13.0976 0600        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys

16:39:14.0038 0600        HdAudAddService - ok

16:39:14.0100 0600        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys

16:39:14.0147 0600        HDAudBus - ok

16:39:14.0178 0600        HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

16:39:14.0210 0600        HidBatt - ok

16:39:14.0241 0600        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

16:39:14.0272 0600        HidBth - ok

16:39:14.0288 0600        HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

16:39:14.0303 0600        HidIr - ok

16:39:14.0334 0600        hidserv         (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll

16:39:14.0388 0600        hidserv - ok

16:39:14.0450 0600        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys

16:39:14.0475 0600        HidUsb - ok

16:39:14.0506 0600        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll

16:39:14.0546 0600        hkmsvc - ok

16:39:14.0590 0600        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll

16:39:14.0666 0600        HomeGroupListener - ok

16:39:14.0690 0600        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll

16:39:14.0708 0600        HomeGroupProvider - ok

16:39:14.0757 0600        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

16:39:14.0780 0600        HpSAMD - ok

16:39:14.0847 0600        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

16:39:14.0948 0600        HTTP - ok

16:39:14.0980 0600        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

16:39:14.0994 0600        hwpolicy - ok

16:39:15.0049 0600        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys

16:39:15.0074 0600        i8042prt - ok

16:39:15.0185 0600        IAANTMON        (660bf3255a1eb18ed803fd2fba6ae400) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

16:39:15.0232 0600        IAANTMON - ok

16:39:15.0269 0600        iaStor          (be7d72fcf442c26975942007e0831241) C:\Windows\system32\DRIVERS\iaStor.sys

16:39:15.0286 0600        iaStor - ok

16:39:15.0360 0600        iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

16:39:15.0399 0600        iaStorV - ok

16:39:15.0508 0600        idsvc           (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

16:39:15.0570 0600        idsvc - ok

16:39:15.0882 0600        igfx            (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys

16:39:16.0070 0600        igfx - ok

16:39:16.0194 0600        iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

16:39:16.0226 0600        iirsp - ok

16:39:16.0304 0600        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll

16:39:16.0394 0600        IKEEXT - ok

16:39:16.0521 0600        IntcAzAudAddService (0c3cf4b3bae28e121a1689e3538f8712) C:\Windows\system32\drivers\RTKVHD64.sys

16:39:16.0563 0600        IntcAzAudAddService - ok

16:39:16.0689 0600        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

16:39:16.0711 0600        intelide - ok

16:39:16.0743 0600        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

16:39:16.0787 0600        intelppm - ok

16:39:16.0829 0600        IPBusEnum       (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll

16:39:16.0896 0600        IPBusEnum - ok

16:39:16.0936 0600        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

16:39:16.0992 0600        IpFilterDriver - ok

16:39:17.0041 0600        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll

16:39:17.0114 0600        iphlpsvc - ok

16:39:17.0149 0600        IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

16:39:17.0165 0600        IPMIDRV - ok

16:39:17.0199 0600        IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

16:39:17.0255 0600        IPNAT - ok

16:39:17.0276 0600        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

16:39:17.0363 0600        IRENUM - ok

16:39:17.0403 0600        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

16:39:17.0488 0600        isapnp - ok

16:39:17.0517 0600        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

16:39:17.0553 0600        iScsiPrt - ok

16:39:17.0566 0600        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys

16:39:17.0579 0600        kbdclass - ok

16:39:17.0590 0600        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys

16:39:17.0605 0600        kbdhid - ok

16:39:17.0626 0600        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

16:39:17.0639 0600        KeyIso - ok

16:39:17.0657 0600        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys

16:39:17.0672 0600        KSecDD - ok

16:39:17.0694 0600        KSecPkg         (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys

16:39:17.0711 0600        KSecPkg - ok

16:39:17.0733 0600        ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

16:39:17.0778 0600        ksthunk - ok

16:39:17.0846 0600        KtmRm           (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll

16:39:17.0909 0600        KtmRm - ok

16:39:17.0975 0600        L1C             (9c46a5421de9d116c47155317cabb522) C:\Windows\system32\DRIVERS\L1C62x64.sys

16:39:18.0023 0600        L1C - ok

16:39:18.0065 0600        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll

16:39:18.0125 0600        LanmanServer - ok

16:39:18.0153 0600        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll

16:39:18.0201 0600        LanmanWorkstation - ok

16:39:18.0244 0600        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

16:39:18.0294 0600        lltdio - ok

16:39:18.0340 0600        lltdsvc         (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll

16:39:18.0427 0600        lltdsvc - ok

16:39:18.0458 0600        lmhosts         (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll

16:39:18.0490 0600        lmhosts - ok

16:39:18.0521 0600        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

16:39:18.0536 0600        LSI_FC - ok

16:39:18.0568 0600        LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

16:39:18.0583 0600        LSI_SAS - ok

16:39:18.0599 0600        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

16:39:18.0614 0600        LSI_SAS2 - ok

16:39:18.0630 0600        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

16:39:18.0646 0600        LSI_SCSI - ok

16:39:18.0661 0600        luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

16:39:18.0708 0600        luafv - ok

16:39:18.0755 0600        MBAMProtector   (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys

16:39:18.0770 0600        MBAMProtector - ok

16:39:18.0880 0600        MBAMService     (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

16:39:18.0942 0600        MBAMService - ok

16:39:18.0973 0600        Mcx2Svc         (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll

16:39:19.0004 0600        Mcx2Svc - ok

16:39:19.0036 0600        megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

16:39:19.0051 0600        megasas - ok

16:39:19.0067 0600        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

16:39:19.0098 0600        MegaSR - ok

16:39:19.0160 0600        Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe

16:39:19.0176 0600        Microsoft Office Groove Audit Service - ok

16:39:19.0223 0600        MMCSS           (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

16:39:19.0285 0600        MMCSS - ok

16:39:19.0316 0600        Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

16:39:19.0397 0600        Modem - ok

16:39:19.0431 0600        monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

16:39:19.0458 0600        monitor - ok

16:39:19.0503 0600        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys

16:39:19.0525 0600        mouclass - ok

16:39:19.0557 0600        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

16:39:19.0584 0600        mouhid - ok

16:39:19.0618 0600        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

16:39:19.0633 0600        mountmgr - ok

16:39:19.0690 0600        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

16:39:19.0712 0600        MozillaMaintenance - ok

16:39:19.0765 0600        MpFilter        (94c66ededcdb6a126880472f9a704d8e) C:\Windows\system32\DRIVERS\MpFilter.sys

16:39:19.0789 0600        MpFilter - ok

16:39:19.0826 0600        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

16:39:19.0842 0600        mpio - ok

16:39:19.0869 0600        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

16:39:19.0907 0600        mpsdrv - ok

16:39:19.0977 0600        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll

16:39:20.0077 0600        MpsSvc - ok

16:39:20.0111 0600        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

16:39:20.0148 0600        MRxDAV - ok

16:39:20.0183 0600        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

16:39:20.0236 0600        mrxsmb - ok

16:39:20.0284 0600        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

16:39:20.0330 0600        mrxsmb10 - ok

16:39:20.0351 0600        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

16:39:20.0366 0600        mrxsmb20 - ok

16:39:20.0398 0600        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

16:39:20.0413 0600        msahci - ok

16:39:20.0507 0600        MSCamSvc        (41fb1d61df09c36ccab0b04eec66f6d5) C:\Program Files\Microsoft LifeCam\MSCamS64.exe

16:39:20.0538 0600        MSCamSvc - ok

16:39:20.0554 0600        msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

16:39:20.0569 0600        msdsm - ok

16:39:20.0600 0600        MSDTC           (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe

16:39:20.0632 0600        MSDTC - ok

16:39:20.0678 0600        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

16:39:20.0725 0600        Msfs - ok

16:39:20.0725 0600        mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

16:39:20.0788 0600        mshidkmdf - ok

16:39:20.0834 0600        MSHUSBVideo     (bb590070d606ae6f008341fc9a7b2ad7) C:\Windows\system32\Drivers\nx6000.sys

16:39:20.0850 0600        MSHUSBVideo - ok

16:39:20.0881 0600        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

16:39:20.0897 0600        msisadrv - ok

16:39:20.0928 0600        MSiSCSI         (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll

16:39:21.0022 0600        MSiSCSI - ok

16:39:21.0022 0600        msiserver - ok

16:39:21.0053 0600        MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

16:39:21.0115 0600        MSKSSRV - ok

16:39:21.0162 0600        MsMpSvc         (59faaf2c83c8169ea20f9e335e418907) c:\Program Files\Microsoft Security Client\MsMpEng.exe

16:39:21.0193 0600        MsMpSvc - ok

16:39:21.0209 0600        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

16:39:21.0271 0600        MSPCLOCK - ok

16:39:21.0302 0600        MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

16:39:21.0349 0600        MSPQM - ok

16:39:21.0396 0600        MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

16:39:21.0412 0600        MsRPC - ok

16:39:21.0458 0600        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys

16:39:21.0474 0600        mssmbios - ok

16:39:21.0505 0600        MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

16:39:21.0558 0600        MSTEE - ok

16:39:21.0579 0600        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

16:39:21.0615 0600        MTConfig - ok

16:39:21.0640 0600        Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

16:39:21.0655 0600        Mup - ok

16:39:21.0690 0600        mwlPSDFilter    (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys

16:39:21.0706 0600        mwlPSDFilter - ok

16:39:21.0723 0600        mwlPSDNServ     (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys

16:39:21.0732 0600        mwlPSDNServ - ok

16:39:21.0745 0600        mwlPSDVDisk     (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys

16:39:21.0754 0600        mwlPSDVDisk - ok

16:39:21.0869 0600        MWLService      (2f139207f618ec2933830227eeffddb4) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe

16:39:21.0901 0600        MWLService - ok

16:39:21.0948 0600        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll

16:39:22.0022 0600        napagent - ok

16:39:22.0085 0600        NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

16:39:22.0142 0600        NativeWifiP - ok

16:39:22.0217 0600        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

16:39:22.0272 0600        NDIS - ok

16:39:22.0315 0600        NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

16:39:22.0357 0600        NdisCap - ok

16:39:22.0385 0600        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

16:39:22.0435 0600        NdisTapi - ok

16:39:22.0454 0600        Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

16:39:22.0516 0600        Ndisuio - ok

16:39:22.0548 0600        NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

16:39:22.0604 0600        NdisWan - ok

16:39:22.0622 0600        NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

16:39:22.0679 0600        NDProxy - ok

16:39:22.0726 0600        NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

16:39:22.0789 0600        NetBIOS - ok

16:39:22.0838 0600        NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

16:39:22.0890 0600        NetBT - ok

16:39:22.0921 0600        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

16:39:22.0935 0600        Netlogon - ok

16:39:23.0005 0600        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll

16:39:23.0085 0600        Netman - ok

16:39:23.0120 0600        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll

16:39:23.0201 0600        netprofm - ok

16:39:23.0259 0600        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

16:39:23.0271 0600        NetTcpPortSharing - ok

16:39:23.0305 0600        nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

16:39:23.0320 0600        nfrd960 - ok

16:39:23.0358 0600        NisDrv          (91b4e0273d2f6c24ef845f2b41311289) C:\Windows\system32\DRIVERS\NisDrvWFP.sys

16:39:23.0371 0600        NisDrv - ok

16:39:23.0473 0600        NisSrv          (10a43829a9e606af3eef25a1c1665923) c:\Program Files\Microsoft Security Client\NisSrv.exe

16:39:23.0513 0600        NisSrv - ok

16:39:23.0574 0600        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll

16:39:23.0653 0600        NlaSvc - ok

16:39:23.0676 0600        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

16:39:23.0715 0600        Npfs - ok

16:39:23.0743 0600        nsi             (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll

16:39:23.0802 0600        nsi - ok

16:39:23.0857 0600        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

16:39:23.0927 0600        nsiproxy - ok

16:39:24.0024 0600        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

16:39:24.0105 0600        Ntfs - ok

16:39:24.0197 0600        NTIBackupSvc    (fd324cce1d4d5bb5af65f8e55b462c7e) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

16:39:24.0215 0600        NTIBackupSvc - ok

16:39:24.0326 0600        NTIDrvr         (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys

16:39:24.0338 0600        NTIDrvr - ok

16:39:24.0387 0600        NTISchedulerSvc (3f6268a2ec33cd38cf75c880af8ded42) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

16:39:24.0413 0600        NTISchedulerSvc - ok

16:39:24.0442 0600        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

16:39:24.0500 0600        Null - ok

16:39:24.0553 0600        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

16:39:24.0572 0600        nvraid - ok

16:39:24.0611 0600        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

16:39:24.0640 0600        nvstor - ok

16:39:24.0665 0600        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

16:39:24.0682 0600        nv_agp - ok

16:39:24.0760 0600        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

16:39:24.0799 0600        odserv - ok

16:39:24.0826 0600        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

16:39:24.0853 0600        ohci1394 - ok

16:39:24.0929 0600        ose             (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

16:39:24.0943 0600        ose - ok

16:39:24.0989 0600        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

16:39:25.0049 0600        p2pimsvc - ok

16:39:25.0089 0600        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll

16:39:25.0127 0600        p2psvc - ok

16:39:25.0161 0600        Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

16:39:25.0178 0600        Parport - ok

16:39:25.0214 0600        partmgr         (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys

16:39:25.0230 0600        partmgr - ok

16:39:25.0254 0600        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll

16:39:25.0297 0600        PcaSvc - ok

16:39:25.0327 0600        pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

16:39:25.0343 0600        pci - ok

16:39:25.0361 0600        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

16:39:25.0374 0600        pciide - ok

16:39:25.0401 0600        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

16:39:25.0420 0600        pcmcia - ok

16:39:25.0438 0600        pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

16:39:25.0452 0600        pcw - ok

16:39:25.0495 0600        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

16:39:25.0576 0600        PEAUTH - ok

16:39:25.0644 0600        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe

16:39:25.0675 0600        PerfHost - ok

16:39:25.0784 0600        pla             (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll

16:39:25.0900 0600        pla - ok

16:39:25.0956 0600        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll

16:39:26.0004 0600        PlugPlay - ok

16:39:26.0021 0600        PNRPAutoReg     (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll

16:39:26.0047 0600        PNRPAutoReg - ok

16:39:26.0079 0600        PNRPsvc         (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

16:39:26.0097 0600        PNRPsvc - ok

16:39:26.0158 0600        PolicyAgent     (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll

16:39:26.0227 0600        PolicyAgent - ok

16:39:26.0266 0600        Power           (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll

16:39:26.0323 0600        Power - ok

16:39:26.0400 0600        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

16:39:26.0455 0600        PptpMiniport - ok

16:39:26.0488 0600        Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

16:39:26.0512 0600        Processor - ok

16:39:26.0574 0600        ProfSvc         (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll

16:39:26.0669 0600        ProfSvc - ok

16:39:26.0696 0600        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

16:39:26.0709 0600        ProtectedStorage - ok

16:39:26.0745 0600        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

16:39:26.0801 0600        Psched - ok

16:39:26.0904 0600        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

16:39:26.0970 0600        ql2300 - ok

16:39:27.0077 0600        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

16:39:27.0098 0600        ql40xx - ok

16:39:27.0139 0600        QWAVE           (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll

16:39:27.0183 0600        QWAVE - ok

16:39:27.0201 0600        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

16:39:27.0245 0600        QWAVEdrv - ok

16:39:27.0285 0600        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

16:39:27.0393 0600        RasAcd - ok

16:39:27.0426 0600        RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

16:39:27.0491 0600        RasAgileVpn - ok

16:39:27.0520 0600        RasAuto         (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll

16:39:27.0574 0600        RasAuto - ok

16:39:27.0614 0600        Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

16:39:27.0685 0600        Rasl2tp - ok

16:39:27.0719 0600        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll

16:39:27.0790 0600        RasMan - ok

16:39:27.0827 0600        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

16:39:27.0878 0600        RasPppoe - ok

16:39:27.0901 0600        RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

16:39:27.0965 0600        RasSstp - ok

16:39:28.0024 0600        rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

16:39:28.0088 0600        rdbss - ok

16:39:28.0130 0600        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

16:39:28.0167 0600        rdpbus - ok

16:39:28.0199 0600        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

16:39:28.0253 0600        RDPCDD - ok

16:39:28.0286 0600        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

16:39:28.0360 0600        RDPENCDD - ok

16:39:28.0390 0600        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

16:39:28.0434 0600        RDPREFMP - ok

16:39:28.0477 0600        RDPWD           (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys

16:39:28.0526 0600        RDPWD - ok

16:39:28.0593 0600        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

16:39:28.0623 0600        rdyboost - ok

16:39:28.0650 0600        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll

16:39:28.0711 0600        RemoteAccess - ok

16:39:28.0754 0600        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll

16:39:28.0862 0600        RemoteRegistry - ok

16:39:28.0892 0600        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll

16:39:28.0945 0600        RpcEptMapper - ok

16:39:28.0965 0600        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe

16:39:29.0013 0600        RpcLocator - ok

16:39:29.0074 0600        RpcSs           (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

16:39:29.0157 0600        RpcSs - ok

16:39:29.0200 0600        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

16:39:29.0247 0600        rspndr - ok

16:39:29.0310 0600        RSUSBSTOR       (db30aa4daa0d492fa5d7717d8181ffa1) C:\Windows\system32\Drivers\RtsUStor.sys

16:39:29.0359 0600        RSUSBSTOR - ok

16:39:29.0403 0600        s217bus         (b49951a2c8fd81307707443d01936e37) C:\Windows\system32\DRIVERS\s217bus.sys

16:39:29.0419 0600        s217bus - ok

16:39:29.0449 0600        SamSs           (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

16:39:29.0466 0600        SamSs - ok

16:39:29.0501 0600        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

16:39:29.0519 0600        sbp2port - ok

16:39:29.0555 0600        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll

16:39:29.0609 0600        SCardSvr - ok

16:39:29.0638 0600        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

16:39:29.0684 0600        scfilter - ok

16:39:29.0783 0600        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll

16:39:29.0871 0600        Schedule - ok

16:39:29.0889 0600        SCPolicySvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

16:39:29.0936 0600        SCPolicySvc - ok

16:39:29.0975 0600        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll

16:39:30.0028 0600        SDRSVC - ok

16:39:30.0084 0600        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

16:39:30.0146 0600        secdrv - ok

16:39:30.0181 0600        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll

16:39:30.0233 0600        seclogon - ok

16:39:30.0273 0600        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll

16:39:30.0326 0600        SENS - ok

16:39:30.0348 0600        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll

16:39:30.0403 0600        SensrSvc - ok

16:39:30.0438 0600        Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

16:39:30.0456 0600        Serenum - ok

16:39:30.0482 0600        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

16:39:30.0510 0600        Serial - ok

16:39:30.0567 0600        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

16:39:30.0598 0600        sermouse - ok

16:39:30.0633 0600        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll

16:39:30.0687 0600        SessionEnv - ok

16:39:30.0701 0600        sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

16:39:30.0741 0600        sffdisk - ok

16:39:30.0766 0600        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

16:39:30.0792 0600        sffp_mmc - ok

16:39:30.0807 0600        sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

16:39:30.0839 0600        sffp_sd - ok

16:39:30.0873 0600        sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

16:39:30.0901 0600        sfloppy - ok

16:39:30.0946 0600        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll

16:39:31.0015 0600        SharedAccess - ok

16:39:31.0078 0600        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll

16:39:31.0140 0600        ShellHWDetection - ok

16:39:31.0162 0600        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

16:39:31.0176 0600        SiSRaid2 - ok

16:39:31.0203 0600        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

16:39:31.0218 0600        SiSRaid4 - ok

16:39:31.0247 0600        Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

16:39:31.0297 0600        Smb - ok

16:39:31.0345 0600        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe

16:39:31.0379 0600        SNMPTRAP - ok

16:39:31.0402 0600        spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

16:39:31.0415 0600        spldr - ok

16:39:31.0474 0600        Spooler         (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe

16:39:31.0525 0600        Spooler - ok

16:39:31.0698 0600        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe

16:39:31.0868 0600        sppsvc - ok

16:39:31.0979 0600        sppuinotify     (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll

16:39:32.0063 0600        sppuinotify - ok

16:39:32.0141 0600        srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

16:39:32.0187 0600        srv - ok

16:39:32.0238 0600        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

16:39:32.0291 0600        srv2 - ok

16:39:32.0317 0600        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

16:39:32.0350 0600        srvnet - ok

16:39:32.0394 0600        SSDPSRV         (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll

16:39:32.0450 0600        SSDPSRV - ok

16:39:32.0475 0600        SstpSvc         (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll

16:39:32.0517 0600        SstpSvc - ok

16:39:32.0545 0600        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

16:39:32.0561 0600        stexstor - ok

16:39:32.0606 0600        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll

16:39:32.0663 0600        stisvc - ok

16:39:32.0703 0600        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys

16:39:32.0715 0600        swenum - ok

16:39:32.0769 0600        swprv           (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll

16:39:32.0840 0600        swprv - ok

16:39:32.0884 0600        SynTP           (bcf305959b53b200ceb2ad25ad22f8a7) C:\Windows\system32\DRIVERS\SynTP.sys

16:39:32.0905 0600        SynTP - ok

16:39:33.0011 0600        SysMain         (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll

16:39:33.0131 0600        SysMain - ok

16:39:33.0223 0600        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll

16:39:33.0254 0600        TabletInputService - ok

16:39:33.0285 0600        TapiSrv         (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll

16:39:33.0367 0600        TapiSrv - ok

16:39:33.0400 0600        TBS             (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll

16:39:33.0460 0600        TBS - ok

16:39:33.0616 0600        Tcpip           (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys

16:39:33.0658 0600        Tcpip - ok

16:39:33.0831 0600        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys

16:39:33.0875 0600        TCPIP6 - ok

16:39:33.0950 0600        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

16:39:34.0022 0600        tcpipreg - ok

16:39:34.0068 0600        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

16:39:34.0086 0600        TDPIPE - ok

16:39:34.0113 0600        TDTCP           (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys

16:39:34.0146 0600        TDTCP - ok

16:39:34.0213 0600        tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

16:39:34.0273 0600        tdx - ok

16:39:34.0302 0600        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys

16:39:34.0317 0600        TermDD - ok

16:39:34.0379 0600        TermService     (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll

16:39:34.0457 0600        TermService - ok

16:39:34.0488 0600        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll

16:39:34.0519 0600        Themes - ok

16:39:34.0535 0600        THREADORDER     (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

16:39:34.0586 0600        THREADORDER - ok

16:39:34.0605 0600        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll

16:39:34.0666 0600        TrkWks - ok

16:39:34.0723 0600        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe

16:39:34.0802 0600        TrustedInstaller - ok

16:39:34.0832 0600        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

16:39:34.0870 0600        tssecsrv - ok

16:39:34.0887 0600        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

16:39:34.0908 0600        TsUsbFlt - ok

16:39:34.0946 0600        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

16:39:34.0999 0600        tunnel - ok

16:39:35.0033 0600        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

16:39:35.0047 0600        uagp35 - ok

16:39:35.0066 0600        UBHelper        (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys

16:39:35.0075 0600        UBHelper - ok

16:39:35.0110 0600        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

16:39:35.0179 0600        udfs - ok

16:39:35.0207 0600        UI0Detect       (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe

16:39:35.0225 0600        UI0Detect - ok

16:39:35.0250 0600        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

16:39:35.0264 0600        uliagpkx - ok

16:39:35.0309 0600        umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys

16:39:35.0350 0600        umbus - ok

16:39:35.0376 0600        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

16:39:35.0410 0600        UmPass - ok

16:39:35.0499 0600        Updater Service (70dde3a86dbeb1d6c3c30ad687b1877a) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

16:39:35.0521 0600        Updater Service - ok

16:39:35.0568 0600        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll

16:39:35.0630 0600        upnphost - ok

16:39:35.0693 0600        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys

16:39:35.0708 0600        usbaudio - ok

16:39:35.0755 0600        usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

16:39:35.0771 0600        usbccgp - ok

16:39:35.0818 0600        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

16:39:35.0833 0600        usbcir - ok

16:39:35.0849 0600        usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys

16:39:35.0880 0600        usbehci - ok

16:39:35.0911 0600        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

16:39:35.0958 0600        usbhub - ok

16:39:35.0974 0600        usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys

16:39:36.0005 0600        usbohci - ok

16:39:36.0058 0600        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

16:39:36.0090 0600        usbprint - ok

16:39:36.0126 0600        usbscan         (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys

16:39:36.0144 0600        usbscan - ok

16:39:36.0170 0600        USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

16:39:36.0219 0600        USBSTOR - ok

16:39:36.0249 0600        usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys

16:39:36.0276 0600        usbuhci - ok

16:39:36.0332 0600        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\system32\Drivers\usbvideo.sys

16:39:36.0363 0600        usbvideo - ok

16:39:36.0395 0600        UxSms           (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll

16:39:36.0446 0600        UxSms - ok

16:39:36.0480 0600        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

16:39:36.0493 0600        VaultSvc - ok

16:39:36.0527 0600        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

16:39:36.0540 0600        vdrvroot - ok

16:39:36.0600 0600        vds             (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe

16:39:36.0658 0600        vds - ok

16:39:36.0684 0600        vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

16:39:36.0701 0600        vga - ok

16:39:36.0713 0600        VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

16:39:36.0769 0600        VgaSave - ok

16:39:36.0809 0600        vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

16:39:36.0826 0600        vhdmp - ok

16:39:36.0837 0600        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

16:39:36.0850 0600        viaide - ok

16:39:36.0871 0600        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

16:39:36.0886 0600        volmgr - ok

16:39:36.0930 0600        volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

16:39:36.0966 0600        volmgrx - ok

16:39:37.0009 0600        volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

16:39:37.0050 0600        volsnap - ok

16:39:37.0092 0600        vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

16:39:37.0115 0600        vsmraid - ok

16:39:37.0207 0600        VSS             (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe

16:39:37.0315 0600        VSS - ok

16:39:37.0422 0600        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

16:39:37.0453 0600        vwifibus - ok

16:39:37.0496 0600        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

16:39:37.0532 0600        vwififlt - ok

16:39:37.0558 0600        vwifimp         (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys

16:39:37.0575 0600        vwifimp - ok

16:39:37.0621 0600        W32Time         (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll

16:39:37.0699 0600        W32Time - ok

16:39:37.0727 0600        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

16:39:37.0756 0600        WacomPen - ok

16:39:37.0808 0600        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

16:39:37.0872 0600        WANARP - ok

16:39:37.0899 0600        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

16:39:37.0935 0600        Wanarpv6 - ok

16:39:38.0042 0600        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe

16:39:38.0124 0600        wbengine - ok

16:39:38.0229 0600        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll

16:39:38.0264 0600        WbioSrvc - ok

16:39:38.0321 0600        wcncsvc         (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll

16:39:38.0366 0600        wcncsvc - ok

16:39:38.0387 0600        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll

16:39:38.0409 0600        WcsPlugInService - ok

16:39:38.0456 0600        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

16:39:38.0470 0600        Wd - ok

16:39:38.0510 0600        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

16:39:38.0572 0600        Wdf01000 - ok

16:39:38.0608 0600        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

16:39:38.0736 0600        WdiServiceHost - ok

16:39:38.0741 0600        WdiSystemHost   (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

16:39:38.0769 0600        WdiSystemHost - ok

16:39:38.0830 0600        WebClient       (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll

16:39:38.0888 0600        WebClient - ok

16:39:38.0935 0600        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll

16:39:38.0999 0600        Wecsvc - ok

16:39:39.0037 0600        wercplsupport   (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll

16:39:39.0092 0600        wercplsupport - ok

16:39:39.0126 0600        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll

16:39:39.0220 0600        WerSvc - ok

16:39:39.0298 0600        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

16:39:39.0348 0600        WfpLwf - ok

16:39:39.0369 0600        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

16:39:39.0382 0600        WIMMount - ok

16:39:39.0414 0600        WinDefend - ok

16:39:39.0424 0600        WinHttpAutoProxySvc - ok

16:39:39.0474 0600        Winmgmt         (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll

16:39:39.0526 0600        Winmgmt - ok

16:39:39.0678 0600        WinRM           (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll

16:39:39.0784 0600        WinRM - ok

16:39:39.0937 0600        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys

16:39:39.0976 0600        WinUsb - ok

16:39:40.0059 0600        Wlansvc         (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll

16:39:40.0132 0600        Wlansvc - ok

16:39:40.0152 0600        WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys

16:39:40.0166 0600        WmiAcpi - ok

16:39:40.0220 0600        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe

16:39:40.0250 0600        wmiApSrv - ok

16:39:40.0304 0600        WMPNetworkSvc - ok

16:39:40.0335 0600        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll

16:39:40.0382 0600        WPCSvc - ok

16:39:40.0413 0600        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll

16:39:40.0428 0600        WPDBusEnum - ok

16:39:40.0460 0600        ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

16:39:40.0522 0600        ws2ifsl - ok

16:39:40.0538 0600        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll

16:39:40.0569 0600        wscsvc - ok

16:39:40.0569 0600        WSearch - ok

16:39:40.0709 0600        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll

16:39:40.0865 0600        wuauserv - ok

16:39:40.0974 0600        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

16:39:41.0052 0600        WudfPf - ok

16:39:41.0084 0600        wudfsvc         (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll

16:39:41.0115 0600        wudfsvc - ok

16:39:41.0146 0600        WwanSvc         (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll

16:39:41.0208 0600        WwanSvc - ok

16:39:41.0255 0600        MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

16:39:41.0736 0600        \Device\Harddisk0\DR0 - ok

16:39:41.0741 0600        Boot (0x1200)   (e448c47abb9998fd77772387669ed748) \Device\Harddisk0\DR0\Partition0

16:39:41.0744 0600        \Device\Harddisk0\DR0\Partition0 - ok

16:39:41.0779 0600        Boot (0x1200)   (d2c18a15376539e7ce14ea7b4f2f1986) \Device\Harddisk0\DR0\Partition1

16:39:41.0781 0600        \Device\Harddisk0\DR0\Partition1 - ok

16:39:41.0782 0600        ============================================================

16:39:41.0782 0600        Scan finished

16:39:41.0782 0600        ============================================================

16:39:41.0798 0640        Detected object count: 0

16:39:41.0798 0640        Actual detected object count: 0

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Code:

ComboFix 12-06-10.01 - bonny 11.06.2012  17:22:25.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4094.2876 [GMT 2:00]

ausgeführt von:: c:\users\bonny\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\Common Files\Acer GameZone online.ico

c:\users\bonny\%appda~1

c:\users\bonny\%appda~1\Microsoft\Windows\IETldCache\index.dat

c:\users\bonny\Documents\~WRL0001.tmp

c:\users\bonny\Documents\~WRL0002.tmp

c:\users\bonny\Documents\~WRL0003.tmp

c:\users\bonny\Documents\~WRL0004.tmp

c:\users\bonny\Documents\~WRL0005.tmp

c:\users\bonny\Documents\~WRL0006.tmp

c:\users\bonny\Documents\~WRL0007.tmp

c:\users\bonny\Documents\~WRL0008.tmp

c:\users\bonny\Documents\~WRL1340.tmp

c:\users\bonny\Documents\~WRL1647.tmp

c:\users\bonny\Documents\~WRL1958.tmp

c:\users\bonny\Documents\~WRL2040.tmp

c:\users\KSK\Favorites\locked-Teletext, Videotext - n-tv.de.url.thil

c:\windows\assembly\tmp\U

c:\windows\security\Database\tmp.edb

c:\windows\system32\fxsst.dll

c:\windows\system32\slwga.dll

c:\windows\system32\srrstr.dll

c:\windows\system32\systemcpl.dll

c:\windows\system32\termsrv.dll

c:\windows\SysWow64\odbcad32.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-05-11 bis 2012-06-11  ))))))))))))))))))))))))))))))

.

.

2012-06-11 14:57 . 2012-05-08 08:02        8955792        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7F62675D-AE76-4EA8-B562-99A0E6717F34}\mpengine.dll

2012-06-11 13:04 . 2012-06-11 13:04        --------        d-----w-        C:\_OTL

2012-06-11 13:00 . 2012-05-08 08:02        8955792        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-06-06 02:36 . 2012-06-06 02:35        927800        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7A999E4D-089C-4FA4-9146-38B873817F4F}\gapaengine.dll

2012-06-06 02:33 . 2012-06-06 02:33        --------        d-----w-        c:\program files (x86)\Microsoft Security Client

2012-06-06 02:33 . 2012-06-06 02:33        --------        d-----w-        c:\program files\Microsoft Security Client

2012-06-06 02:31 . 2012-06-06 02:31        --------        d-----w-        c:\programdata\ATI

2012-06-06 02:23 . 2012-06-06 02:23        --------        d-----w-        c:\programdata\AMD

2012-06-06 02:23 . 2012-06-06 02:23        --------        d-----w-        c:\program files (x86)\AMD AVT

2012-06-06 02:23 . 2012-06-06 02:23        --------        d-----w-        c:\program files (x86)\AMD APP

2012-06-06 02:23 . 2012-06-06 02:23        --------        d-----w-        c:\program files (x86)\Common Files\ATI Technologies

2012-06-06 02:22 . 2012-06-06 02:22        --------        d-----w-        c:\program files (x86)\ATI Technologies

2012-06-06 02:20 . 2012-06-06 02:23        --------        d-----w-        c:\program files\ATI Technologies

2012-06-06 02:17 . 2012-06-06 02:19        --------        d-----w-        C:\AMD

2012-06-06 00:35 . 2012-06-06 00:35        --------        d-----w-        c:\program files (x86)\Mozilla Maintenance Service

2012-06-06 00:35 . 2012-06-06 00:35        588728        ----a-w-        c:\program files (x86)\Mozilla Firefox\gkmedias.dll

2012-06-06 00:35 . 2012-06-06 00:35        43960        ----a-w-        c:\program files (x86)\Mozilla Firefox\mozglue.dll

2012-06-06 00:35 . 2012-06-06 00:35        157352        ----a-w-        c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe

2012-06-06 00:35 . 2012-06-06 00:35        129976        ----a-w-        c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe

2012-06-05 17:00 . 2012-06-05 17:04        --------        d-----w-        c:\programdata\Spybot - Search & Destroy

2012-06-05 17:00 . 2012-06-05 17:03        --------        d-----w-        c:\program files (x86)\Spybot - Search & Destroy

2012-06-05 16:47 . 2012-06-05 16:47        --------        d-----w-        c:\program files (x86)\Common Files\Adobe

2012-06-04 15:11 . 2012-06-04 15:11        419488        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-06-04 15:11 . 2012-06-04 15:11        70304        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-06-04 13:50 . 2012-06-04 13:56        --------        d-----w-        c:\program files (x86)\Common Files\PC Tools

2012-06-04 13:07 . 2012-06-04 13:07        --------        d-----w-        c:\users\bonny\AppData\Roaming\Malwarebytes

2012-06-04 13:06 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-06-04 13:06 . 2012-06-04 13:06        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2012-06-04 10:44 . 2012-06-04 10:44        8769696        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe

2012-06-04 10:42 . 2012-05-08 17:02        8955792        ------w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{7C1F800E-3683-43AD-A0AF-0A7EFC76C0F1}\mpengine.dll

2012-05-14 15:09 . 2012-02-23 08:18        279656        ------w-        c:\windows\system32\MpSigStub.exe

2012-05-14 15:05 . 2012-05-14 15:05        106648        ----a-w-        c:\windows\system32\drivers\GRD.sys

2012-05-14 15:03 . 2012-03-30 11:35        1918320        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2012-05-14 15:02 . 2012-06-04 10:44        666689        ----a-w-        c:\windows\SysWow64\sig.bin

2012-05-14 14:48 . 2012-05-14 14:48        59768        ----a-w-        c:\windows\system32\drivers\PktIcpt.sys

2012-05-14 14:48 . 2012-05-14 14:48        65912        ----a-w-        c:\windows\system32\drivers\gdwfpcd64.sys

2012-05-14 14:48 . 2012-05-14 14:48        54136        ----a-w-        c:\windows\system32\drivers\GDBehave.sys

2012-05-14 14:48 . 2012-05-14 14:48        122744        ----a-w-        c:\windows\system32\drivers\MiniIcpt.sys

2012-05-14 14:47 . 2012-06-04 13:40        --------        d-----w-        c:\programdata\G DATA

2012-05-14 14:47 . 2012-06-04 13:40        --------        d-----w-        c:\program files (x86)\Common Files\G Data

2012-05-14 14:47 . 2012-06-04 13:10        --------        d-----w-        c:\program files (x86)\G Data

2012-05-14 14:41 . 2012-06-04 13:10        --------        d-----w-        c:\users\bonny\AppData\Local\Downloaded Installations

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-06 05:22 . 2012-04-06 05:22        11174400        ----a-w-        c:\windows\system32\drivers\atikmdag.sys

2012-04-06 02:22 . 2012-04-06 02:22        159744        ----a-w-        c:\windows\system32\atiapfxx.exe

2012-04-06 02:21 . 2012-04-06 02:21        909312        ----a-w-        c:\windows\SysWow64\aticfx32.dll

2012-04-06 02:20 . 2012-04-06 02:20        1067520        ----a-w-        c:\windows\system32\aticfx64.dll

2012-04-06 02:16 . 2012-04-06 02:16        442368        ----a-w-        c:\windows\system32\ATIDEMGX.dll

2012-04-06 02:16 . 2012-04-06 02:16        503808        ----a-w-        c:\windows\system32\atieclxx.exe

2012-04-06 02:16 . 2012-04-06 02:16        236544        ----a-w-        c:\windows\system32\atiesrxx.exe

2012-04-06 02:14 . 2012-04-06 02:14        120320        ----a-w-        c:\windows\system32\atitmm64.dll

2012-04-06 02:14 . 2012-04-06 02:14        21504        ----a-w-        c:\windows\system32\atimuixx.dll

2012-04-06 02:14 . 2012-04-06 02:14        59392        ----a-w-        c:\windows\system32\atiedu64.dll

2012-04-06 02:14 . 2012-04-06 02:14        43520        ----a-w-        c:\windows\SysWow64\ati2edxx.dll

2012-04-06 02:13 . 2012-04-06 02:13        6800896        ----a-w-        c:\windows\SysWow64\atidxx32.dll

2012-04-06 02:10 . 2012-04-06 02:10        26181632        ----a-w-        c:\windows\system32\atio6axx.dll

2012-04-06 02:00 . 2012-04-06 02:00        64000        ----a-w-        c:\windows\system32\coinst.dll

2012-04-06 01:54 . 2009-11-03 03:44        7479296        ----a-w-        c:\windows\system32\atidxx64.dll

2012-04-06 01:50 . 2012-04-06 01:50        19753984        ----a-w-        c:\windows\SysWow64\atioglxx.dll

2012-04-06 01:35 . 2012-04-06 01:35        1120768        ----a-w-        c:\windows\system32\atiumd6v.dll

2012-04-06 01:34 . 2012-04-06 01:34        1831424        ----a-w-        c:\windows\SysWow64\atiumdmv.dll

2012-04-06 01:34 . 2012-04-06 01:34        4731904        ----a-w-        c:\windows\system32\atiumd6a.dll

2012-04-06 01:34 . 2012-04-06 01:34        6203392        ----a-w-        c:\windows\SysWow64\atiumdag.dll

2012-04-06 01:30 . 2012-04-06 01:30        51200        ----a-w-        c:\windows\system32\aticalrt64.dll

2012-04-06 01:30 . 2012-04-06 01:30        46080        ----a-w-        c:\windows\SysWow64\aticalrt.dll

2012-04-06 01:30 . 2012-04-06 01:30        44544        ----a-w-        c:\windows\system32\aticalcl64.dll

2012-04-06 01:30 . 2012-04-06 01:30        44032        ----a-w-        c:\windows\SysWow64\aticalcl.dll

2012-04-06 01:29 . 2012-04-06 01:29        16090624        ----a-w-        c:\windows\system32\aticaldd64.dll

2012-04-06 01:25 . 2012-04-06 01:25        13764096        ----a-w-        c:\windows\SysWow64\aticaldd.dll

2012-04-06 01:23 . 2012-04-06 01:23        7431680        ----a-w-        c:\windows\system32\atiumd64.dll

2012-04-06 01:22 . 2012-04-06 01:22        4795904        ----a-w-        c:\windows\SysWow64\atiumdva.dll

2012-04-06 01:11 . 2012-04-06 01:11        514560        ----a-w-        c:\windows\system32\atiadlxx.dll

2012-04-06 01:11 . 2012-04-06 01:11        360448        ----a-w-        c:\windows\SysWow64\atiadlxy.dll

2012-04-06 01:11 . 2012-04-06 01:11        17408        ----a-w-        c:\windows\system32\atig6pxx.dll

2012-04-06 01:11 . 2012-04-06 01:11        14848        ----a-w-        c:\windows\SysWow64\atiglpxx.dll

2012-04-06 01:11 . 2012-04-06 01:11        14848        ----a-w-        c:\windows\system32\atiglpxx.dll

2012-04-06 01:11 . 2012-04-06 01:11        41984        ----a-w-        c:\windows\system32\atig6txx.dll

2012-04-06 01:10 . 2012-04-06 01:10        33280        ----a-w-        c:\windows\SysWow64\atigktxx.dll

2012-04-06 01:10 . 2012-04-06 01:10        343040        ----a-w-        c:\windows\system32\drivers\atikmpag.sys

2012-04-06 01:09 . 2012-04-06 01:09        54784        ----a-w-        c:\windows\system32\atiuxp64.dll

2012-04-06 01:09 . 2012-04-06 01:09        41984        ----a-w-        c:\windows\SysWow64\atiuxpag.dll

2012-04-06 01:09 . 2012-04-06 01:09        44544        ----a-w-        c:\windows\system32\atiu9p64.dll

2012-04-06 01:09 . 2012-04-06 01:09        32256        ----a-w-        c:\windows\SysWow64\atiu9pag.dll

2012-04-06 01:09 . 2012-04-06 01:09        53248        ----a-w-        c:\windows\system32\drivers\ati2erec.dll

2012-04-06 01:06 . 2012-04-06 01:06        54784        ----a-w-        c:\windows\system32\atimpc64.dll

2012-04-06 01:06 . 2012-04-06 01:06        54784        ----a-w-        c:\windows\system32\amdpcom64.dll

2012-04-06 01:06 . 2012-04-06 01:06        53760        ----a-w-        c:\windows\SysWow64\atimpc32.dll

2012-04-06 01:06 . 2012-04-06 01:06        53760        ----a-w-        c:\windows\SysWow64\amdpcom32.dll

2012-04-05 20:34 . 2012-04-05 20:34        187392        ----a-w-        c:\windows\system32\clinfo.exe

2012-04-05 20:34 . 2012-04-05 20:34        74752        ----a-w-        c:\windows\system32\OpenVideo64.dll

2012-04-05 20:34 . 2012-04-05 20:34        64512        ----a-w-        c:\windows\SysWow64\OpenVideo.dll

2012-04-05 20:33 . 2012-04-05 20:33        63488        ----a-w-        c:\windows\system32\OVDecode64.dll

2012-04-05 20:33 . 2012-04-05 20:33        56320        ----a-w-        c:\windows\SysWow64\OVDecode.dll

2012-04-05 20:33 . 2012-04-05 20:33        16457216        ----a-w-        c:\windows\system32\amdocl64.dll

2012-04-05 20:32 . 2012-04-05 20:32        13007872        ----a-w-        c:\windows\SysWow64\amdocl.dll

2012-04-05 20:32 . 2012-04-05 20:32        54784        ----a-w-        c:\windows\system32\OpenCL.dll

2012-04-05 20:32 . 2012-04-05 20:32        50176        ----a-w-        c:\windows\SysWow64\OpenCL.dll

2012-03-20 18:44 . 2012-03-20 18:44        98688        ----a-w-        c:\windows\system32\drivers\NisDrvWFP.sys

2012-03-20 18:44 . 2012-03-20 18:44        203888        ----a-w-        c:\windows\system32\drivers\MpFilter.sys

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[7] 2010-11-20 . 2E648163254233755035B46DD7B89123 . 680960 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll

[7] 2009-07-14 . 0F05EC2887BFE197AD82A13287D2F404 . 706560 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7600.16385_none_ea94336f6df51e09\termsrv.dll

.

c:\windows\system32\termsrv.dll ... Fehlt !!

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:41        120104        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]

"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-08-18 1157128]

"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-10-29 419112]

"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-10-22 181480]

"SunJavaUpdateSched"="c:\program files (x86)\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 641664]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer2"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-03 135664]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-04 257696]

R3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [x]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-03 135664]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-06 129976]

R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [x]

R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]

R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-02 225280]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-10-29 844320]

S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]

S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

Inhalt des "geplante Tasks" Ordners

.

2012-06-11 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-04 15:11]

.

2012-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-03 14:15]

.

2012-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-03 14:15]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:44        137512        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112]

"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-10-29 822816]

"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-29 200704]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

uLocal Page = c:\windows\system32\blank.htm

mStart Page = 

mLocal Page = 

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\

FF - prefs.js: browser.search.selectedEngine - 

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

SafeBoot-mcmscsvc

SafeBoot-MCODS

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-123 Free Solitaire_is1 - e:\123 free solitaire\unins000.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-06-11  17:46:53 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-06-11 15:46

.

Vor Suchlauf: 15 Verzeichnis(se), 433.746.923.520 Bytes frei

Nach Suchlauf: 20 Verzeichnis(se), 433.595.645.952 Bytes frei

.

- - End Of File - - 7EF114C6F75EB79FFAC885B4CCDE5986

Problem nach dem ComboFix Log:

Ich wollte MS Security Essentials wieder aktivieren, doch dort steht nun, dass die Echtheit dieser Kopie von Windows nicht bestätigt werden konnte. Essentials wurde daher deaktiviert!!! Klicke ich nun auf den Button "Jetzt beheben" (siehe angefügten Screenshot) komme ich auf eine Microsoft Webseite, wo ich einen Updater für Windows 7 herunterladen kann. Unter diesem Link (hxxp://www.microsoft.com/genuine/validate/DownloadValidationSupport.aspx?displaylang=de&PartnerID=258) findet sich folgender Text:

Zitat:

Diese Software funktioniert mit den meisten Browsern und ermöglicht die Gültigkeitsprüfung von Windows. Sobald die Software installiert ist, wird erkannt, ob es sich bei der Windows-Software um ein ordnungsgemäß lizenziertes Originalprodukt handelt. Bei Bedarf wird zudem versucht, die Windows 7-Lizenzkomponenten zu reparieren, die möglicherweise beschädigt, verschoben oder gelöscht wurden. Des weiteren wird die Software von Zeit zu Zeit einen Gültigkeitstest durchführen, um sicherzustellen, dass es sich bei der Windows 7-Software auf diesem Computer weiterhin um Originalsoftware handelt. Datenschutzbestimmungen anzeigen.

Herunterladen

Wenn Sie dazu aufgefordert werden, wählen Sie Datei speichern, und öffnen Sie die Datei an dem Speicherort, an dem Sie gespeichert wurde. Wählen Sie Ausführen, und folgen Sie den Anweisungen. Warten Sie, bis die Installation beendet ist, und klicken Sie dann auf Weiter um die Gültigkeitsprüfung abzuschließen.

Weiter

Hab die Datei heruntergeladen (WindowsActivationUpdate.exe), installiert, doch der Fehler hat sich bisher noch nicht beheben lassen.

Können Sie mir da weiterhelfen?

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

DeQuarantine::

C:\Qoobox\Quarantine\C\windows\system32\slwga.dll

C:\Qoobox\Quarantine\C\windows\system32\srrstr.dll

C:\Qoobox\Quarantine\C\windows\system32\systemcpl.dll

C:\Qoobox\Quarantine\C\windows\system32\termsrv.dll

C:\Qoobox\Quarantine\C\windows\SysWow64\odbcad32.exe

QUIT::

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

ComboFix 12-06-11.04 - bonny 11.06.2012  22:14:44.2.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4094.2805 [GMT 2:00]

ausgeführt von:: c:\users\bonny\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\bonny\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-05-11 bis 2012-06-11  ))))))))))))))))))))))))))))))

.

.

2012-06-11 20:24 . 2012-06-11 20:29        --------        d-----w-        c:\users\bonny\AppData\Local\temp

2012-06-11 20:24 . 2012-06-11 20:24        --------        d-----w-        c:\users\KSK\AppData\Local\temp

2012-06-11 20:24 . 2012-06-11 20:24        --------        d-----w-        c:\users\Firma\AppData\Local\temp

2012-06-11 20:24 . 2012-06-11 20:24        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-06-11 15:51 . 2012-06-11 15:51        --------        d-----w-        c:\windows\SysWow64\Wat

2012-06-11 15:51 . 2012-06-11 15:51        --------        d-----w-        c:\windows\system32\Wat

2012-06-11 15:49 . 2012-05-08 08:02        8955792        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D3D49F50-C2FA-4099-8DA4-165A2F636897}\mpengine.dll

2012-06-11 13:04 . 2012-06-11 13:04        --------        d-----w-        C:\_OTL

2012-06-11 13:00 . 2012-05-08 08:02        8955792        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-06-06 02:36 . 2012-06-06 02:35        927800        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7A999E4D-089C-4FA4-9146-38B873817F4F}\gapaengine.dll

2012-06-06 02:33 . 2012-06-06 02:33        --------        d-----w-        c:\program files (x86)\Microsoft Security Client

2012-06-06 02:33 . 2012-06-06 02:33        --------        d-----w-        c:\program files\Microsoft Security Client

2012-06-06 02:31 . 2012-06-06 02:31        --------        d-----w-        c:\programdata\ATI

2012-06-06 02:23 . 2012-06-06 02:23        --------        d-----w-        c:\programdata\AMD

2012-06-06 02:23 . 2012-06-06 02:23        --------        d-----w-        c:\program files (x86)\AMD AVT

2012-06-06 02:23 . 2012-06-06 02:23        --------        d-----w-        c:\program files (x86)\AMD APP

2012-06-06 02:23 . 2012-06-06 02:23        --------        d-----w-        c:\program files (x86)\Common Files\ATI Technologies

2012-06-06 02:22 . 2012-06-06 02:22        --------        d-----w-        c:\program files (x86)\ATI Technologies

2012-06-06 02:20 . 2012-06-06 02:23        --------        d-----w-        c:\program files\ATI Technologies

2012-06-06 02:17 . 2012-06-06 02:19        --------        d-----w-        C:\AMD

2012-06-06 00:35 . 2012-06-06 00:35        --------        d-----w-        c:\program files (x86)\Mozilla Maintenance Service

2012-06-06 00:35 . 2012-06-06 00:35        588728        ----a-w-        c:\program files (x86)\Mozilla Firefox\gkmedias.dll

2012-06-06 00:35 . 2012-06-06 00:35        43960        ----a-w-        c:\program files (x86)\Mozilla Firefox\mozglue.dll

2012-06-06 00:35 . 2012-06-06 00:35        157352        ----a-w-        c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe

2012-06-06 00:35 . 2012-06-06 00:35        129976        ----a-w-        c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe

2012-06-05 17:00 . 2012-06-05 17:04        --------        d-----w-        c:\programdata\Spybot - Search & Destroy

2012-06-05 17:00 . 2012-06-05 17:03        --------        d-----w-        c:\program files (x86)\Spybot - Search & Destroy

2012-06-05 16:47 . 2012-06-05 16:47        --------        d-----w-        c:\program files (x86)\Common Files\Adobe

2012-06-04 15:11 . 2012-06-04 15:11        419488        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-06-04 15:11 . 2012-06-04 15:11        70304        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-06-04 13:50 . 2012-06-04 13:56        --------        d-----w-        c:\program files (x86)\Common Files\PC Tools

2012-06-04 13:07 . 2012-06-04 13:07        --------        d-----w-        c:\users\bonny\AppData\Roaming\Malwarebytes

2012-06-04 13:06 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-06-04 13:06 . 2012-06-04 13:06        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2012-06-04 10:44 . 2012-06-04 10:44        8769696        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe

2012-06-04 10:42 . 2012-05-08 17:02        8955792        ------w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{7C1F800E-3683-43AD-A0AF-0A7EFC76C0F1}\mpengine.dll

2012-05-14 15:09 . 2012-02-23 08:18        279656        ------w-        c:\windows\system32\MpSigStub.exe

2012-05-14 15:05 . 2012-05-14 15:05        106648        ----a-w-        c:\windows\system32\drivers\GRD.sys

2012-05-14 15:03 . 2012-03-30 11:35        1918320        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2012-05-14 15:02 . 2012-06-04 10:44        666689        ----a-w-        c:\windows\SysWow64\sig.bin

2012-05-14 14:48 . 2012-05-14 14:48        59768        ----a-w-        c:\windows\system32\drivers\PktIcpt.sys

2012-05-14 14:48 . 2012-05-14 14:48        65912        ----a-w-        c:\windows\system32\drivers\gdwfpcd64.sys

2012-05-14 14:48 . 2012-05-14 14:48        54136        ----a-w-        c:\windows\system32\drivers\GDBehave.sys

2012-05-14 14:48 . 2012-05-14 14:48        122744        ----a-w-        c:\windows\system32\drivers\MiniIcpt.sys

2012-05-14 14:47 . 2012-06-04 13:40        --------        d-----w-        c:\programdata\G DATA

2012-05-14 14:47 . 2012-06-04 13:40        --------        d-----w-        c:\program files (x86)\Common Files\G Data

2012-05-14 14:47 . 2012-06-04 13:10        --------        d-----w-        c:\program files (x86)\G Data

2012-05-14 14:41 . 2012-06-04 13:10        --------        d-----w-        c:\users\bonny\AppData\Local\Downloaded Installations

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-06 05:22 . 2012-04-06 05:22        11174400        ----a-w-        c:\windows\system32\drivers\atikmdag.sys

2012-04-06 02:22 . 2012-04-06 02:22        159744        ----a-w-        c:\windows\system32\atiapfxx.exe

2012-04-06 02:21 . 2012-04-06 02:21        909312        ----a-w-        c:\windows\SysWow64\aticfx32.dll

2012-04-06 02:20 . 2012-04-06 02:20        1067520        ----a-w-        c:\windows\system32\aticfx64.dll

2012-04-06 02:16 . 2012-04-06 02:16        442368        ----a-w-        c:\windows\system32\ATIDEMGX.dll

2012-04-06 02:16 . 2012-04-06 02:16        503808        ----a-w-        c:\windows\system32\atieclxx.exe

2012-04-06 02:16 . 2012-04-06 02:16        236544        ----a-w-        c:\windows\system32\atiesrxx.exe

2012-04-06 02:14 . 2012-04-06 02:14        120320        ----a-w-        c:\windows\system32\atitmm64.dll

2012-04-06 02:14 . 2012-04-06 02:14        21504        ----a-w-        c:\windows\system32\atimuixx.dll

2012-04-06 02:14 . 2012-04-06 02:14        59392        ----a-w-        c:\windows\system32\atiedu64.dll

2012-04-06 02:14 . 2012-04-06 02:14        43520        ----a-w-        c:\windows\SysWow64\ati2edxx.dll

2012-04-06 02:13 . 2012-04-06 02:13        6800896        ----a-w-        c:\windows\SysWow64\atidxx32.dll

2012-04-06 02:10 . 2012-04-06 02:10        26181632        ----a-w-        c:\windows\system32\atio6axx.dll

2012-04-06 02:00 . 2012-04-06 02:00        64000        ----a-w-        c:\windows\system32\coinst.dll

2012-04-06 01:54 . 2009-11-03 03:44        7479296        ----a-w-        c:\windows\system32\atidxx64.dll

2012-04-06 01:50 . 2012-04-06 01:50        19753984        ----a-w-        c:\windows\SysWow64\atioglxx.dll

2012-04-06 01:35 . 2012-04-06 01:35        1120768        ----a-w-        c:\windows\system32\atiumd6v.dll

2012-04-06 01:34 . 2012-04-06 01:34        1831424        ----a-w-        c:\windows\SysWow64\atiumdmv.dll

2012-04-06 01:34 . 2012-04-06 01:34        4731904        ----a-w-        c:\windows\system32\atiumd6a.dll

2012-04-06 01:34 . 2012-04-06 01:34        6203392        ----a-w-        c:\windows\SysWow64\atiumdag.dll

2012-04-06 01:30 . 2012-04-06 01:30        51200        ----a-w-        c:\windows\system32\aticalrt64.dll

2012-04-06 01:30 . 2012-04-06 01:30        46080        ----a-w-        c:\windows\SysWow64\aticalrt.dll

2012-04-06 01:30 . 2012-04-06 01:30        44544        ----a-w-        c:\windows\system32\aticalcl64.dll

2012-04-06 01:30 . 2012-04-06 01:30        44032        ----a-w-        c:\windows\SysWow64\aticalcl.dll

2012-04-06 01:29 . 2012-04-06 01:29        16090624        ----a-w-        c:\windows\system32\aticaldd64.dll

2012-04-06 01:25 . 2012-04-06 01:25        13764096        ----a-w-        c:\windows\SysWow64\aticaldd.dll

2012-04-06 01:23 . 2012-04-06 01:23        7431680        ----a-w-        c:\windows\system32\atiumd64.dll

2012-04-06 01:22 . 2012-04-06 01:22        4795904        ----a-w-        c:\windows\SysWow64\atiumdva.dll

2012-04-06 01:11 . 2012-04-06 01:11        514560        ----a-w-        c:\windows\system32\atiadlxx.dll

2012-04-06 01:11 . 2012-04-06 01:11        360448        ----a-w-        c:\windows\SysWow64\atiadlxy.dll

2012-04-06 01:11 . 2012-04-06 01:11        17408        ----a-w-        c:\windows\system32\atig6pxx.dll

2012-04-06 01:11 . 2012-04-06 01:11        14848        ----a-w-        c:\windows\SysWow64\atiglpxx.dll

2012-04-06 01:11 . 2012-04-06 01:11        14848        ----a-w-        c:\windows\system32\atiglpxx.dll

2012-04-06 01:11 . 2012-04-06 01:11        41984        ----a-w-        c:\windows\system32\atig6txx.dll

2012-04-06 01:10 . 2012-04-06 01:10        33280        ----a-w-        c:\windows\SysWow64\atigktxx.dll

2012-04-06 01:10 . 2012-04-06 01:10        343040        ----a-w-        c:\windows\system32\drivers\atikmpag.sys

2012-04-06 01:09 . 2012-04-06 01:09        54784        ----a-w-        c:\windows\system32\atiuxp64.dll

2012-04-06 01:09 . 2012-04-06 01:09        41984        ----a-w-        c:\windows\SysWow64\atiuxpag.dll

2012-04-06 01:09 . 2012-04-06 01:09        44544        ----a-w-        c:\windows\system32\atiu9p64.dll

2012-04-06 01:09 . 2012-04-06 01:09        32256        ----a-w-        c:\windows\SysWow64\atiu9pag.dll

2012-04-06 01:09 . 2012-04-06 01:09        53248        ----a-w-        c:\windows\system32\drivers\ati2erec.dll

2012-04-06 01:06 . 2012-04-06 01:06        54784        ----a-w-        c:\windows\system32\atimpc64.dll

2012-04-06 01:06 . 2012-04-06 01:06        54784        ----a-w-        c:\windows\system32\amdpcom64.dll

2012-04-06 01:06 . 2012-04-06 01:06        53760        ----a-w-        c:\windows\SysWow64\atimpc32.dll

2012-04-06 01:06 . 2012-04-06 01:06        53760        ----a-w-        c:\windows\SysWow64\amdpcom32.dll

2012-04-05 20:34 . 2012-04-05 20:34        187392        ----a-w-        c:\windows\system32\clinfo.exe

2012-04-05 20:34 . 2012-04-05 20:34        74752        ----a-w-        c:\windows\system32\OpenVideo64.dll

2012-04-05 20:34 . 2012-04-05 20:34        64512        ----a-w-        c:\windows\SysWow64\OpenVideo.dll

2012-04-05 20:33 . 2012-04-05 20:33        63488        ----a-w-        c:\windows\system32\OVDecode64.dll

2012-04-05 20:33 . 2012-04-05 20:33        56320        ----a-w-        c:\windows\SysWow64\OVDecode.dll

2012-04-05 20:33 . 2012-04-05 20:33        16457216        ----a-w-        c:\windows\system32\amdocl64.dll

2012-04-05 20:32 . 2012-04-05 20:32        13007872        ----a-w-        c:\windows\SysWow64\amdocl.dll

2012-04-05 20:32 . 2012-04-05 20:32        54784        ----a-w-        c:\windows\system32\OpenCL.dll

2012-04-05 20:32 . 2012-04-05 20:32        50176        ----a-w-        c:\windows\SysWow64\OpenCL.dll

2012-03-20 18:44 . 2012-03-20 18:44        98688        ----a-w-        c:\windows\system32\drivers\NisDrvWFP.sys

2012-03-20 18:44 . 2012-03-20 18:44        203888        ----a-w-        c:\windows\system32\drivers\MpFilter.sys

.

.

(((((((((((((((((((((((((((((   SnapShot@2012-06-11_15.35.46   )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-11-03 04:04 . 2012-06-11 15:50        70984              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2009-07-14 05:10 . 2012-06-11 15:50        45686              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

+ 2010-01-30 11:36 . 2012-06-11 15:50        18896              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2079184332-2997649951-1821268657-1000_UserData.bin

+ 2012-06-11 16:24 . 2012-06-11 18:48        32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-07-14 04:46 . 2012-06-11 20:28        91888              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat

+ 2010-03-22 18:20 . 2012-06-11 15:47        4456              c:\windows\system32\wdi\ERCQueuedResolutions.dat

- 2012-06-11 15:35 . 2012-06-11 15:35        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2012-06-11 20:25 . 2012-06-11 20:25        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2012-06-11 20:25 . 2012-06-11 20:25        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2012-06-11 15:35 . 2012-06-11 15:35        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2012-06-11 15:51 . 2012-06-11 15:51        128424              c:\windows\SysWOW64\Wat\WatWeb.dll

+ 2012-06-11 15:51 . 2012-06-11 15:51        114600              c:\windows\SysWOW64\Wat\npWatWeb.dll

+ 2010-01-30 17:21 . 2012-06-11 19:43        268720              c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin

+ 2012-06-11 15:51 . 2012-06-11 15:51        152888              c:\windows\system32\Wat\WatWeb.dll

+ 2012-06-11 15:51 . 2012-06-11 15:51        249656              c:\windows\system32\Wat\WatUX.exe

+ 2012-06-11 15:51 . 2012-06-11 15:51        138664              c:\windows\system32\Wat\npWatWeb.dll

+ 2009-12-24 17:35 . 2012-06-11 18:48        278528              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2009-12-24 17:35 . 2012-06-06 15:55        278528              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2011-10-01 20:33 . 2012-06-11 15:34        472480              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

+ 2011-10-01 20:33 . 2012-06-11 20:25        472480              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

- 2009-07-14 05:01 . 2012-06-11 15:34        401008              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 05:01 . 2012-06-11 20:25        401008              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2012-06-11 15:51 . 2012-06-11 15:51        1255736              c:\windows\system32\Wat\WatAdminSvc.exe

+ 2009-07-14 04:45 . 2012-06-11 19:10        7113171              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat

- 2009-07-14 04:45 . 2012-06-04 11:25        7113171              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat

+ 2011-05-09 06:56 . 2012-06-11 20:25        3077380              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2079184332-2997649951-1821268657-1000-8192.dat

+ 2009-07-14 04:54 . 2012-06-11 18:48        10813440              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2009-07-14 04:54 . 2012-06-06 15:55        10813440              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:41        120104        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]

"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-08-18 1157128]

"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-10-29 419112]

"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-10-22 181480]

"SunJavaUpdateSched"="c:\program files (x86)\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 641664]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer2"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-03 135664]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-04 257696]

R3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [x]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-03 135664]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-06 129976]

R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [x]

R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]

R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-02 225280]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-10-29 844320]

S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]

S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2012-06-11 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-04 15:11]

.

2012-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-03 14:15]

.

2012-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-03 14:15]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:44        137512        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112]

"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-10-29 822816]

"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]

"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-29 200704]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

uLocal Page = c:\windows\system32\blank.htm

mStart Page = 

mLocal Page = 

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\bonny\AppData\Roaming\Mozilla\Firefox\Profiles\2tx3ff8e.default\

FF - prefs.js: browser.search.selectedEngine - 

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-06-11  22:39:01 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-06-11 20:38

ComboFix2.txt  2012-06-11 15:46

.

Vor Suchlauf: 19 Verzeichnis(se), 433.428.611.072 Bytes frei

Nach Suchlauf: 20 Verzeichnis(se), 432.990.826.496 Bytes frei

.

- - End Of File - - 7660D585044A895A09024A984228BB8C

Die Geschichte mit der Windows 7 Aktivierung -> Echtheitszertifikat besteht wohl immer noch!

Ich wollte eigentlich mit CF versehentlich gelöschte wiederherstellen...offenbar klappte das irgendwie nicht

Ich brauch den Quarantäneordner von Combofix. Bitte folgendes machen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinflussen!
2.) Ordner Quarantine in C:\Qoobox in eine Datei zippen
3.) die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

So Ordner Qoobox wurde als ZIP hochgeladen!

Virenscanner Essentials geht nicht, da er die Echtheit der Windows Version bezweifelt -> siehe vorherige Post inkl. Screen

Daten angekommen?

Neuer Versuch

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

DeQuarantine::

C:\Qoobox\Quarantine\C\windows\system32\slwga.dll.vir

C:\Qoobox\Quarantine\C\windows\system32\srrstr.dll.vir

C:\Qoobox\Quarantine\C\windows\system32\systemcpl.dll.vir

C:\Qoobox\Quarantine\C\windows\system32\termsrv.dll.vir

C:\Qoobox\Quarantine\C\windows\SysWow64\odbcad32.exe.vir

QUIT::

So Anweisung befolgt. CF hat Aktualisierung durchgeführt. Dann DOS Fenster mit Hinweis auf 10 minütigen Scan gezeigt. Danach war jedoch nach ca. 2 Minuten Ende und es wurde ein leeres Editorfenster geöffnet (siehe Screen im Anhang).

Tja, dann muss man es manuell probieren :balla:

Du musst diese Dateien umbenennen => .vir abschneiden

Code:

C:\Qoobox\Quarantine\C\windows\system32\slwga.dll.vir

C:\Qoobox\Quarantine\C\windows\system32\srrstr.dll.vir

C:\Qoobox\Quarantine\C\windows\system32\systemcpl.dll.vir

C:\Qoobox\Quarantine\C\windows\system32\termsrv.dll.vir

C:\Qoobox\Quarantine\C\windows\SysWow64\odbcad32.exe.vir

Dann hast du diese Dateinamen

Code:

C:\Qoobox\Quarantine\C\windows\system32\slwga.dll

C:\Qoobox\Quarantine\C\windows\system32\srrstr.dll

C:\Qoobox\Quarantine\C\windows\system32\systemcpl.dll

C:\Qoobox\Quarantine\C\windows\system32\termsrv.dll

C:\Qoobox\Quarantine\C\windows\SysWow64\odbcad32.exe

Diese musst du zurück kopieren in die jew. Urpsrungsverzeichnisse:

Code:

C:\Qoobox\Quarantine\C\windows\system32\slwga.dll     => C:\windows\system32\slwga.dll

C:\Qoobox\Quarantine\C\windows\system32\srrstr.dll    => C:\windows\system32\srrstr.dll

C:\Qoobox\Quarantine\C\windows\system32\systemcpl.dll => C:\windows\system32\systemcpl.dll

C:\Qoobox\Quarantine\C\windows\system32\termsrv.dll   => C:\windows\system32\termsrv.dll

C:\Qoobox\Quarantine\C\windows\SysWow64\odbcad32.exe  => C:\windows\SysWow64\odbcad32.exe

Zitat:

Tja, dann muss man es manuell probieren

Erledigt! Echtheitszertifikat läuft wieder, ebenso kann ich MS Sec. Essentials wieder aktivieren! :applaus: :dankeschoen:

Wie gehts weiter?

Puh, dann lag ich ja goldrichtig :abklatsch: :daumenhoc

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Der GMER Scan hat nicht funktioniert! Deshalb hab ich dann mit dem OSAM weitergemacht. Hier nun das Log:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 15:50:28 on 12.06.2012
 

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 64-bit

Default Browser: Mozilla Corporation Firefox 12.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

[Control Panel Objects]

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLCFG32.CPL
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"GDPkIcpt" (GDPkIcpt) - "G Data Software AG" - C:\Windows\system32\drivers\PktIcpt.sys

"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys

"NTIDrvr" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\system32\drivers\NTIDrvr.sys

"UBHelper" (UBHelper) - "NewTech Infosystems Corporation" - C:\Windows\system32\drivers\UBHelper.sys
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files (x86)\7-Zip\7-zip.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "Catalyst Context Menu extension" - ? -   (File not found | COM-object registry key not found)

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll

{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files (x86)\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll

{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files (x86)\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll

{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "DragDropProtect Class" - "Egis Technology Inc." - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll

{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\ONFILTER.DLL

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\OLKFSTUB.DLL

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files (x86)\WinRAR\rarext.dll

{B41DB860-64E4-11D2-9906-E49FADC173CA} "WinRAR shell extension" - ? -   (File not found | COM-object registry key not found)

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "Java Plug-in 1.6.0_02" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{C345E174-3E87-4F41-A01C-B066A90A49B4} "WRC Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\wrc32.ocx / hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\bonny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"ArcadeDeluxeAgent" - "CyberLink Corp." - "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"

"DivXUpdate" - ? - "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

"LifeCam" - "Microsoft Corporation" - "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"

"LManager" - "Dritek System Inc." - C:\Program Files (x86)\Launch Manager\LManager.exe

"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

"PlayMovie" - "Acer Corp." - "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe"

"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Java\jre1.6.0_02\bin\jusched.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)

"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)

"@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - c:\Program Files\Microsoft Security Client\NisSrv.exe

"Acer ePower Service" (ePowerSvc) - "Acer Incorporated" - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

"GRegService" (Greg_Service) - "Acer Incorporated" - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - c:\Program Files\Microsoft Security Client\MsMpEng.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe

"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"MSCamSvc" (MSCamSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft LifeCam\MSCamS64.exe

"MyWinLocker Service" (MWLService) - "Egis Technology Inc." - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe

"NTI Backup Now 5 Backup Service" (NTIBackupSvc) - "NewTech InfoSystems, Inc." - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

"NTI Backup Now 5 Scheduler Service" (NTISchedulerSvc) - "NewTech Infosystems, Inc." - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Updater Service" (Updater Service) - "Acer" - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Dazu nun noch der aswMBR Log:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-06-12 15:55:36

-----------------------------

15:55:36.362    OS Version: Windows x64 6.1.7601 Service Pack 1

15:55:36.362    Number of processors: 2 586 0x170A

15:55:36.362    ComputerName: BONNY-PC  UserName: bonny

15:55:37.298    Initialize success

15:56:45.705    AVAST engine defs: 12061200

15:56:59.297    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

15:56:59.297    Disk 0 Vendor: ST950032 0001 Size: 476940MB BusType: 3

15:56:59.328    Disk 0 MBR read successfully

15:56:59.328    Disk 0 MBR scan

15:56:59.328    Disk 0 Windows 7 default MBR code

15:56:59.344    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        12291 MB offset 63

15:56:59.360    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          101 MB offset 25173855

15:56:59.375    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       464545 MB offset 25382700

15:56:59.391    Disk 0 scanning C:\Windows\system32\drivers

15:57:14.613    Service scanning

15:57:41.024    Modules scanning

15:57:41.024    Disk 0 trace - called modules:

15:57:41.102    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 

15:57:41.118    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004b57060]

15:57:41.118    3 CLASSPNP.SYS[fffff8800148b43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800473a050]

15:57:42.459    AVAST engine scan C:\Windows

15:57:46.203    AVAST engine scan C:\Windows\system32

16:01:09.994    AVAST engine scan C:\Windows\system32\drivers

16:01:26.550    AVAST engine scan C:\Users\bonny

16:02:53.454    AVAST engine scan C:\ProgramData

16:03:19.752    Scan finished successfully

16:04:33.120    Disk 0 MBR has been saved successfully to "C:\Users\bonny\Desktop\MBR.dat"

16:04:33.135    The log file has been saved successfully to "C:\Users\bonny\Desktop\aswMBR.txt"

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

So hier schon mal das Malwarebyte Vollscan Log:

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.06.12.06
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

bonny :: BONNY-PC [Administrator]
 

Schutz: Deaktiviert
 

12.06.2012 18:08:03

mbam-log-2012-06-12 (18-08-03).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 375665

Laufzeit: 46 Minute(n), 16 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 06/12/2012 at 08:29 PM
 

Application Version : 5.0.1150
 

Core Rules Database Version : 8721

Trace Rules Database Version: 6533
 

Scan type       : Quick Scan

Total Scan Time : 00:04:20
 

Operating System Information

Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Administrator
 

Memory items scanned      : 764

Memory threats detected   : 0

Registry items scanned    : 54243

Registry threats detected : 0

File items scanned        : 10897

File threats detected     : 195
 

Adware.Tracking Cookie

        C:\USERS\KSK\AppData\Roaming\Microsoft\Windows\Cookies\Low\8QCO6RY9.txt [ Cookie:ksk@zanox.com/ ]

        C:\USERS\KSK\AppData\Roaming\Microsoft\Windows\Cookies\Low\0PM3W51V.txt [ Cookie:ksk@adfarm1.adition.com/ ]

        C:\USERS\KSK\AppData\Roaming\Microsoft\Windows\Cookies\Low\2NXVN9ZV.txt [ Cookie:ksk@ad.zanox.com/ ]

        C:\USERS\KSK\AppData\Roaming\Microsoft\Windows\Cookies\Low\DR5AYT0W.txt [ Cookie:ksk@ad2.adfarm1.adition.com/ ]

        C:\USERS\KSK\AppData\Roaming\Microsoft\Windows\Cookies\Low\303Q6R8J.txt [ Cookie:ksk@2o7.net/ ]

        .doubleclick.net [ C:\USERS\BONNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2TX3FF8E.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\BONNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2TX3FF8E.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .specificclick.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        tracking.mlsat02.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .apmebf.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .mediaplex.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adviva.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adtech.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .yieldmanager.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .atdmt.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        e2.emediate.se [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        e2.emediate.se [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .everysport.112.2o7.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .imrworldwide.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .atdmt.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .c.atdmt.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .c.atdmt.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .imrworldwide.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.dyntracker.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.zanox-affiliate.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .im.banner.t-online.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .a.revenuemax.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.counter-go.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.googleadservices.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.googleadservices.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eas.apm.emediate.eu [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        track.adform.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adserver.anschlusstor.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        banners.victor.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .banners.victor.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .bs.serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        tomtailor.dyntracker.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.dyntracker.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .247realmedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad1.adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        server.adformdsp.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adformdsp.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adform.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .ru4.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adserv.kwick.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adserv.kwick.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .apmebf.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .ad.adnet.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .ad.adnet.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tracking.quisma.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tracking.quisma.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.zanox.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        statse.webtrendslive.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .www.unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adtech.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eas.apm.emediate.eu [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        delivery.atkmedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        media.gan-online.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad2.adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        banner.testberichte.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adtech.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .doubleclick.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .exoclick.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .syndication.traffichaus.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .syndication.traffichaus.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .syndication.traffichaus.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .accounts.google.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .accounts.google.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        accounts.google.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        accounts.google.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        accounts.google.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tradedoubler.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad3.adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .lucidmedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .advertising.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .advertising.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .media6degrees.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .media6degrees.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .media6degrees.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .trinitymirror.112.2o7.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adbrite.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adbrite.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .www.burstnet.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.burstnet.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eas.apm.emediate.eu [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eas.apm.emediate.eu [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        track.adform.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tracking.quisma.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.googleadservices.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .doubleclick.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .mediaplex.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .statcounter.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .zanox-affiliate.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tradedoubler.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tradedoubler.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .traffictrack.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ww251.smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        server.adform.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adform.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .zanox.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        afe2.specificclick.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        banners.webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

Zitat:

Scan type : Quick Scan

Warum machst du denn mit SASW nur einen Quickscan :(

Zitat:

Zitat von cosinus (Beitrag 845325)

Warum machst du denn mit SASW nur einen Quickscan :(

Sorry, war ein bisschen überfordert, da die Benutzeroberfläche von Super-Anti-Spyware, etwas anders aus sah, als in der Anleitung beschrieben. Komplettscan läuft gerade und wird gleich noch gepostet. :pfeiff:

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 06/13/2012 at 09:27 AM
 

Application Version : 5.0.1150
 

Core Rules Database Version : 8721

Trace Rules Database Version: 6533
 

Scan type       : Complete Scan

Total Scan Time : 05:41:25
 

Operating System Information

Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Administrator
 

Memory items scanned      : 763

Memory threats detected   : 0

Registry items scanned    : 66699

Registry threats detected : 0

File items scanned        : 138914

File threats detected     : 374
 

Adware.Tracking Cookie

        C:\USERS\KSK\AppData\Roaming\Microsoft\Windows\Cookies\Low\8QCO6RY9.txt [ Cookie:ksk@zanox.com/ ]

        C:\USERS\KSK\AppData\Roaming\Microsoft\Windows\Cookies\Low\0PM3W51V.txt [ Cookie:ksk@adfarm1.adition.com/ ]

        C:\USERS\KSK\AppData\Roaming\Microsoft\Windows\Cookies\Low\2NXVN9ZV.txt [ Cookie:ksk@ad.zanox.com/ ]

        C:\USERS\KSK\AppData\Roaming\Microsoft\Windows\Cookies\Low\DR5AYT0W.txt [ Cookie:ksk@ad2.adfarm1.adition.com/ ]

        C:\USERS\KSK\AppData\Roaming\Microsoft\Windows\Cookies\Low\303Q6R8J.txt [ Cookie:ksk@2o7.net/ ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .specificclick.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        tracking.mlsat02.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .apmebf.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .mediaplex.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adviva.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adtech.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .yieldmanager.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .atdmt.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        e2.emediate.se [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .everysport.112.2o7.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .imrworldwide.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .atdmt.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .c.atdmt.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .c.atdmt.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .imrworldwide.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.dyntracker.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.zanox-affiliate.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .im.banner.t-online.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .a.revenuemax.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.counter-go.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.googleadservices.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.googleadservices.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eas.apm.emediate.eu [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        track.adform.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adserver.anschlusstor.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        banners.victor.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .banners.victor.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .bs.serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        tomtailor.dyntracker.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.dyntracker.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad1.adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        server.adformdsp.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adformdsp.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adform.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .ru4.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adserv.kwick.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adserv.kwick.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .apmebf.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .ad.adnet.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .ad.adnet.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.zanox.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        statse.webtrendslive.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .www.unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adtech.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eas.apm.emediate.eu [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        delivery.atkmedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        media.gan-online.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        banner.testberichte.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adtech.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .exoclick.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .syndication.traffichaus.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .syndication.traffichaus.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .syndication.traffichaus.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adultfriendfinder.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .accounts.google.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .accounts.google.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        accounts.google.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tradedoubler.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .lucidmedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .advertising.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .advertising.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .media6degrees.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .media6degrees.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .trinitymirror.112.2o7.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adbrite.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adbrite.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .casalemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .www.burstnet.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.burstnet.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eas.apm.emediate.eu [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        eas.apm.emediate.eu [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        track.adform.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.googleadservices.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .doubleclick.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .mediaplex.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .statcounter.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .zanox-affiliate.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tradedoubler.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tradedoubler.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .traffictrack.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        server.adform.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adform.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        adx.chip.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        banners.webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .zanox.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        partners.webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .webmasterplan.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        e2.emediate.se [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        oasc00454.247realmedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .247realmedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        www.eliteprospects.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tracking.quisma.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tracking.quisma.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .tracking.quisma.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .media6degrees.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .invitemedia.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        afe2.specificclick.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad3.adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ww251.smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ww251.smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        tracking.dc-storm.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        tracking.dc-storm.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        tracking.dc-storm.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        tracking.dc-storm.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .unitymedia.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .smartadserver.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .im.banner.t-online.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .im.banner.t-online.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad4.adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad2.adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .adfarm1.adition.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .im.banner.t-online.de [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .olympiaverlag.122.2o7.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        ad.yieldmanager.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .revsci.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .serving-sys.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        accounts.google.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        accounts.google.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        accounts.google.com [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .doubleclick.net [ C:\USERS\BONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        .doubleclick.net [ C:\USERS\BONNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2TX3FF8E.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\BONNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2TX3FF8E.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        .at.atwola.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\FIRMA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E2O0Z6DQ.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        ad4.adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .histats.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adserver.adtechus.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .technoratimedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .technoratimedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .tribalfusion.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .questionmarket.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track1.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track2.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track2.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track2.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track2.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track2.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track2.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        track2.httptrack.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .kontera.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .at.atwola.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adxpansion.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        ox-d.secure-clicks.org [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .adultfriendfinder.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .syndication.traffichaus.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .syndication.traffichaus.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .syndication.traffichaus.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .exoclick.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4DDYWO0.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .de.at.atwola.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\KSK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTPAUKM7.DEFAULT\COOKIES.SQLITE ]
 

Trojan.Agent/Gen-FraudTool[Tiny]

        C:\_OTL\MOVEDFILES\06112012_150448\C_USERS\BONNY\APPDATA\ROAMING\.#\MBX@BF0@20527A0.###

Was muss ich denn nach dem Vollscann mit Super-Anti-Spyware anklicken?
Noch hab ich das Programm offen.

- Remove Threats
- Abbrechen

Sieht ok aus, da wurden nur Cookies gefunden. Der andere Fund ist nur ein quarantänisierter Schädling.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Zitat:

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Beim zweiten Benutzernamen bekomme ich beim Start von Microsoft Security Essentials immer eine Fehlermeldung. Ich hänge sie mal als Screenshot hier an.

Hab schon mal gegooglet nach dem Fehlercode, der dort angezeigt wird, doch leider nichts gefunden.

Dann hab ich bei diesem Benutzernamen ne Menge Dateien mit "lockedXXXX.Dateiendung.xyz" angezeigt (siehe 2. Screen im Anhang) Zum Beispiel Fotos, die ich mir nicht anschauen kann. Wenn ich die Datei umbenenne, sprich das "locked" und die wirre Dateiendung, kann ich sie trotzdem nicht öffnen.

Kannst Du mir bei diesen Problemen auch weiterhelfen?

Zitat:

das "locked" und die wirre Dateiendung, kann ich sie trotzdem nicht öffnen.

Da gibt doch hier tonnenweise Hinweise zu :wtf:
Bei der locked-Variante könnte man Glück mit dem decrpythelper von Matthias haben
Und zu MSE, da hilft evtl eine Deinstallation, Neustart von Windows, erneutes Installieren von MSE

Hinweise bzgl. der verschlüsselten Dateien:
Wann genau deine Daten entschlüsselt werden können wird dir niemand genau sagen können außer vllt einer :glaskugel: es kann sein, dass du eine neuere Variante hast, deren Verschlüsselungsalgorithmus noch unbekannt ist. Sowas kann man (noch) nicht entschlüsseln und ohne Schlüssel schon garnicht - ist ja auch logisch, sonst wär es ja keine vernünftige Verschlüsselung
Einfach hier nochmal reinsehen in regelmäßigen Abständen, obige Hinweise beachten. 8 Tools mitsamt hunderten Diskussionsbeiträgen stehen da schon

Eine Notlösung für Vista und Win7-User => http://www.trojaner-board.de/115496-...erstellen.html

Entschlüsselungsversuche der verschlüsselten Dateien sind nur auf zusätzliche Kopien der verschlüsselten Dateien anzuwenden, sonst zerhackt man sich die noch weiter ohne die "original" verschlüsselte Datei mehr zu haben. Das willst du sicher nicht!

Man darf sich aber keine falschen Hoffnungen machen. Mittlerweile sieht es finster aus => Delphi-PRAXiS - Einzelnen Beitrag anzeigen - Verschlüsselungs-Trojaner, Hilfe benötigt

Und in Zukunft willst du sicher mal an ein besseres Backupkonzept denken. Hier ein Denkanstoß => http://www.trojaner-board.de/115678-...r-backups.html

Ok, werde mich mal daran versuchen! Du hattest ja danach gefragt, ob es noch Probleme gibt.... :crazy:

Ja, sry meinte abgesehen von der Verschlüsselung :lach:

Abgesehen davon wären wir aber durch
Entfern bitte noch nichts aus der Quarantäne, die schädlichen Dateien, Ordner etc die wir gelöscht haben, liegen noch als Sicherheitskopie in diversen Ordner wie Qoobox oder _OTL/MovedFiles - die werden evtl. noch für eine Entschlüsselung benötigt

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.