Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   TR/Dldr.Phdet.E.41/ EXP/2008-5353.CP/JAVA/Dldr.Lamar.BD/TR/ATRAPS.Gen2 (https://www.trojaner-board.de/118978-tr-dldr-phdet-e-41-exp-2008-5353-cp-java-dldr-lamar-bd-tr-atraps-gen2.html)

murmeltiermu 09.07.2012 14:41
TR/Dldr.Phdet.E.41/ EXP/2008-5353.CP/JAVA/Dldr.Lamar.BD/TR/ATRAPS.Gen2
 
Hallo

Avira meldet plötzlich wieder diverse Viren :-( nach dem OTL scann gab es keine extra.txt. datei




Avira Free Antivirus
Erstellungsdatum der Reportdatei: Montag, 9. Juli 2012 08:52

Es wird nach 3849144 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira AntiVir Personal - Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : LEHMANN-PC

Versionsinformationen:
BUILD.DAT : 12.0.0.1125 41829 Bytes 02.05.2012 16:34:00
AVSCAN.EXE : 12.3.0.15 466896 Bytes 09.05.2012 05:12:13
AVSCAN.DLL : 12.3.0.15 66256 Bytes 09.05.2012 05:12:13
LUKE.DLL : 12.3.0.15 68304 Bytes 09.05.2012 05:12:14
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 09.05.2012 05:12:14
AVREG.DLL : 12.3.0.17 232200 Bytes 11.05.2012 05:37:56
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 10:49:21
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 07:56:15
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 07:56:21
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 15:39:49
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 16:59:53
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 12:24:53
VBASE006.VDF : 7.11.34.117 2048 Bytes 29.06.2012 12:24:53
VBASE007.VDF : 7.11.34.118 2048 Bytes 29.06.2012 12:24:53
VBASE008.VDF : 7.11.34.119 2048 Bytes 29.06.2012 12:24:53
VBASE009.VDF : 7.11.34.120 2048 Bytes 29.06.2012 12:24:53
VBASE010.VDF : 7.11.34.121 2048 Bytes 29.06.2012 12:24:53
VBASE011.VDF : 7.11.34.122 2048 Bytes 29.06.2012 12:24:53
VBASE012.VDF : 7.11.34.123 2048 Bytes 29.06.2012 12:24:53
VBASE013.VDF : 7.11.34.124 2048 Bytes 29.06.2012 12:24:53
VBASE014.VDF : 7.11.34.201 169472 Bytes 02.07.2012 05:06:48
VBASE015.VDF : 7.11.35.19 122368 Bytes 04.07.2012 05:38:38
VBASE016.VDF : 7.11.35.87 146944 Bytes 06.07.2012 20:15:31
VBASE017.VDF : 7.11.35.88 2048 Bytes 06.07.2012 20:15:31
VBASE018.VDF : 7.11.35.89 2048 Bytes 06.07.2012 20:15:31
VBASE019.VDF : 7.11.35.90 2048 Bytes 06.07.2012 20:15:31
VBASE020.VDF : 7.11.35.91 2048 Bytes 06.07.2012 20:15:31
VBASE021.VDF : 7.11.35.92 2048 Bytes 06.07.2012 20:15:32
VBASE022.VDF : 7.11.35.93 2048 Bytes 06.07.2012 20:15:32
VBASE023.VDF : 7.11.35.94 2048 Bytes 06.07.2012 20:15:32
VBASE024.VDF : 7.11.35.95 2048 Bytes 06.07.2012 20:15:32
VBASE025.VDF : 7.11.35.96 2048 Bytes 06.07.2012 20:15:32
VBASE026.VDF : 7.11.35.97 2048 Bytes 06.07.2012 20:15:32
VBASE027.VDF : 7.11.35.98 2048 Bytes 06.07.2012 20:15:32
VBASE028.VDF : 7.11.35.99 2048 Bytes 06.07.2012 20:15:32
VBASE029.VDF : 7.11.35.100 2048 Bytes 06.07.2012 20:15:32
VBASE030.VDF : 7.11.35.101 2048 Bytes 06.07.2012 20:15:32
VBASE031.VDF : 7.11.35.128 64000 Bytes 08.07.2012 20:15:32
Engineversion : 8.2.10.106
AEVDF.DLL : 8.1.2.8 106867 Bytes 10.06.2012 18:46:34
AESCRIPT.DLL : 8.1.4.32 455034 Bytes 06.07.2012 05:38:38
AESCN.DLL : 8.1.8.2 131444 Bytes 23.03.2012 15:41:12
AESBX.DLL : 8.2.5.12 606578 Bytes 15.06.2012 05:45:25
AERDL.DLL : 8.1.9.15 639348 Bytes 31.01.2012 07:55:37
AEPACK.DLL : 8.2.16.22 807288 Bytes 22.06.2012 05:14:18
AEOFFICE.DLL : 8.1.2.40 201082 Bytes 28.06.2012 12:24:54
AEHEUR.DLL : 8.1.4.64 5009782 Bytes 06.07.2012 05:38:38
AEHELP.DLL : 8.1.23.2 258422 Bytes 28.06.2012 12:24:53
AEGEN.DLL : 8.1.5.32 434548 Bytes 08.07.2012 20:15:32
AEEXP.DLL : 8.1.0.60 86388 Bytes 06.07.2012 05:38:39
AEEMU.DLL : 8.1.3.0 393589 Bytes 31.01.2012 07:55:34
AECORE.DLL : 8.1.25.10 201080 Bytes 31.05.2012 17:38:55
AEBB.DLL : 8.1.1.0 53618 Bytes 31.01.2012 07:55:33
AVWINLL.DLL : 12.3.0.15 27344 Bytes 09.05.2012 05:12:13
AVPREF.DLL : 12.3.0.15 51920 Bytes 09.05.2012 05:12:13
AVREP.DLL : 12.3.0.15 179208 Bytes 09.05.2012 05:12:14
AVARKT.DLL : 12.3.0.15 211408 Bytes 09.05.2012 05:12:13
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 09.05.2012 05:12:13
SQLITE3.DLL : 3.7.0.1 398288 Bytes 09.05.2012 05:12:14
AVSMTP.DLL : 12.3.0.15 63440 Bytes 09.05.2012 05:12:13
NETNT.DLL : 12.3.0.15 17104 Bytes 09.05.2012 05:12:14
RCIMAGE.DLL : 12.3.0.15 4447952 Bytes 09.05.2012 05:12:13
RCTEXT.DLL : 12.3.0.15 98512 Bytes 09.05.2012 05:12:13

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_4ffa6e4f\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: reparieren
Sekundäre Aktion......................: quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig
Abweichende Gefahrenkategorien........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,

Beginn des Suchlaufs: Montag, 9. Juli 2012 08:52

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess '4338200.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WINWORD.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'aoltpsd3.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'shellmon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'aolsoftware.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'waol.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'openvpntray.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AsScrPro.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Kies.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NPSAgent.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'KiesPDLR.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ezprint.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lxeemon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WDC.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'KBFiltr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ATKOSD.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'HControl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sensorsrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wcourier.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ALU.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ControlDeckStartUp.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wtgservice.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hsswd.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hsssrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'openvpnas.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AOLAcsd.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'GFNEXSrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ASLDRSrv.exe' - '1' Modul(e) wurden durchsucht

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\Users\Lehmann\AppData\Local\{00323ace-4188-97dc-19ab-1f56921a2012}\n'
C:\Users\Lehmann\AppData\Local\{00323ace-4188-97dc-19ab-1f56921a2012}\n
[FUND] Ist das Trojanische Pferd TR/ATRAPS.Gen2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5662d557.qua' verschoben!


Ende des Suchlaufs: Montag, 9. Juli 2012 08:52
Benötigte Zeit: 00:40 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

0 Verzeichnisse wurden überprüft
41 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
40 Dateien ohne Befall
0 Archive wurden durchsucht
0 Warnungen
1 Hinweise



Avira Free Antivirus
Erstellungsdatum der Reportdatei: Montag, 9. Juli 2012 09:04

Es wird nach 3849144 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira AntiVir Personal - Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : Lehmann
Computername : LEHMANN-PC

Versionsinformationen:
BUILD.DAT : 12.0.0.1125 41829 Bytes 02.05.2012 16:34:00
AVSCAN.EXE : 12.3.0.15 466896 Bytes 09.05.2012 05:12:13
AVSCAN.DLL : 12.3.0.15 66256 Bytes 09.05.2012 05:12:13
LUKE.DLL : 12.3.0.15 68304 Bytes 09.05.2012 05:12:14
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 09.05.2012 05:12:14
AVREG.DLL : 12.3.0.17 232200 Bytes 11.05.2012 05:37:56
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 10:49:21
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 07:56:15
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 07:56:21
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 15:39:49
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 16:59:53
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 12:24:53
VBASE006.VDF : 7.11.34.117 2048 Bytes 29.06.2012 12:24:53
VBASE007.VDF : 7.11.34.118 2048 Bytes 29.06.2012 12:24:53
VBASE008.VDF : 7.11.34.119 2048 Bytes 29.06.2012 12:24:53
VBASE009.VDF : 7.11.34.120 2048 Bytes 29.06.2012 12:24:53
VBASE010.VDF : 7.11.34.121 2048 Bytes 29.06.2012 12:24:53
VBASE011.VDF : 7.11.34.122 2048 Bytes 29.06.2012 12:24:53
VBASE012.VDF : 7.11.34.123 2048 Bytes 29.06.2012 12:24:53
VBASE013.VDF : 7.11.34.124 2048 Bytes 29.06.2012 12:24:53
VBASE014.VDF : 7.11.34.201 169472 Bytes 02.07.2012 05:06:48
VBASE015.VDF : 7.11.35.19 122368 Bytes 04.07.2012 05:38:38
VBASE016.VDF : 7.11.35.87 146944 Bytes 06.07.2012 20:15:31
VBASE017.VDF : 7.11.35.88 2048 Bytes 06.07.2012 20:15:31
VBASE018.VDF : 7.11.35.89 2048 Bytes 06.07.2012 20:15:31
VBASE019.VDF : 7.11.35.90 2048 Bytes 06.07.2012 20:15:31
VBASE020.VDF : 7.11.35.91 2048 Bytes 06.07.2012 20:15:31
VBASE021.VDF : 7.11.35.92 2048 Bytes 06.07.2012 20:15:32
VBASE022.VDF : 7.11.35.93 2048 Bytes 06.07.2012 20:15:32
VBASE023.VDF : 7.11.35.94 2048 Bytes 06.07.2012 20:15:32
VBASE024.VDF : 7.11.35.95 2048 Bytes 06.07.2012 20:15:32
VBASE025.VDF : 7.11.35.96 2048 Bytes 06.07.2012 20:15:32
VBASE026.VDF : 7.11.35.97 2048 Bytes 06.07.2012 20:15:32
VBASE027.VDF : 7.11.35.98 2048 Bytes 06.07.2012 20:15:32
VBASE028.VDF : 7.11.35.99 2048 Bytes 06.07.2012 20:15:32
VBASE029.VDF : 7.11.35.100 2048 Bytes 06.07.2012 20:15:32
VBASE030.VDF : 7.11.35.101 2048 Bytes 06.07.2012 20:15:32
VBASE031.VDF : 7.11.35.128 64000 Bytes 08.07.2012 20:15:32
Engineversion : 8.2.10.106
AEVDF.DLL : 8.1.2.8 106867 Bytes 10.06.2012 18:46:34
AESCRIPT.DLL : 8.1.4.32 455034 Bytes 06.07.2012 05:38:38
AESCN.DLL : 8.1.8.2 131444 Bytes 23.03.2012 15:41:12
AESBX.DLL : 8.2.5.12 606578 Bytes 15.06.2012 05:45:25
AERDL.DLL : 8.1.9.15 639348 Bytes 31.01.2012 07:55:37
AEPACK.DLL : 8.2.16.22 807288 Bytes 22.06.2012 05:14:18
AEOFFICE.DLL : 8.1.2.40 201082 Bytes 28.06.2012 12:24:54
AEHEUR.DLL : 8.1.4.64 5009782 Bytes 06.07.2012 05:38:38
AEHELP.DLL : 8.1.23.2 258422 Bytes 28.06.2012 12:24:53
AEGEN.DLL : 8.1.5.32 434548 Bytes 08.07.2012 20:15:32
AEEXP.DLL : 8.1.0.60 86388 Bytes 06.07.2012 05:38:39
AEEMU.DLL : 8.1.3.0 393589 Bytes 31.01.2012 07:55:34
AECORE.DLL : 8.1.25.10 201080 Bytes 31.05.2012 17:38:55
AEBB.DLL : 8.1.1.0 53618 Bytes 31.01.2012 07:55:33
AVWINLL.DLL : 12.3.0.15 27344 Bytes 09.05.2012 05:12:13
AVPREF.DLL : 12.3.0.15 51920 Bytes 09.05.2012 05:12:13
AVREP.DLL : 12.3.0.15 179208 Bytes 09.05.2012 05:12:14
AVARKT.DLL : 12.3.0.15 211408 Bytes 09.05.2012 05:12:13
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 09.05.2012 05:12:13
SQLITE3.DLL : 3.7.0.1 398288 Bytes 09.05.2012 05:12:14
AVSMTP.DLL : 12.3.0.15 63440 Bytes 09.05.2012 05:12:13
NETNT.DLL : 12.3.0.15 17104 Bytes 09.05.2012 05:12:14
RCIMAGE.DLL : 12.3.0.15 4447952 Bytes 09.05.2012 05:12:13
RCTEXT.DLL : 12.3.0.15 98512 Bytes 09.05.2012 05:12:13

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Abweichende Gefahrenkategorien........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,

Beginn des Suchlaufs: Montag, 9. Juli 2012 09:04

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'openvpntray.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'AsScrPro.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'Kies.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'NPSAgent.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'KiesPDLR.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'ezprint.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'lxeemon.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'WDC.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'KBFiltr.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'ATKOSD.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'HControl.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'sensorsrv.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'wcourier.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'ALU.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'ControlDeckStartUp.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'wtgservice.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'hsswd.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'hsssrv.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'openvpnas.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.EXE' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'BBSvc.EXE' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'AOLAcsd.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'GFNEXSrv.exe' - '10' Modul(e) wurden durchsucht
Durchsuche Prozess 'ASLDRSrv.exe' - '21' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Program Files (x86)\ClearProg\Uninstall.exe
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Program Files (x86)\DOSBox-0.74\uninstall.exe
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Program Files (x86)\Hotspot Shield\Uninstall.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
Die Registry wurde durchsucht ( '2500' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <OS>
C:\eSupport\eDriver\Software\TrendMicro\TOOLS\32BIT\SICTOOL\SICBASE.DAT
[WARNUNG] Die Datei ist kennwortgeschützt
C:\eSupport\eDriver\Software\TrendMicro\TOOLS\64BIT\SICTOOL\SICBASE.DAT
[WARNUNG] Die Datei ist kennwortgeschützt
C:\Program Files (x86)\AOL 9.0 VR\Jiti\viewpoint.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\Program Files (x86)\ClearProg\Uninstall.exe
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Program Files (x86)\DOSBox-0.74\uninstall.exe
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Program Files (x86)\Hotspot Shield\Uninstall.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\Program Files (x86)\Hotspot Shield\update\hss-update.upd
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\ProgramData\AOL Downloads\waol_de\0.4327.52.1\comps\vwpt\Vwpt.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\Users\Lehmann\AppData\Local\Temp\4329495.exe
[FUND] Ist das Trojanische Pferd TR/Dldr.Phdet.E.41
C:\Windows\king-uninstall.exe
[WARNUNG] Unerwartetes Dateiende erreicht
Beginne mit der Suche in 'D:\' <DATA>
D:\LEHMANN-PC\Backup Set 2012-06-12 080005\Backup Files 2012-06-12 080005\Backup files 5.zip
[WARNUNG] Die Datei ist kennwortgeschützt
D:\LEHMANN-PC\Backup Set 2012-06-12 080005\Backup Files 2012-06-25 080008\Backup files 1.zip
[0] Archivtyp: ZIP
--> C/Users/Lehmann/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/16/23269d90-53e09817
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Lamar.BD
--> C2.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Lamar.BD
--> C3.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/2008-5353.CP
D:\LEHMANN-PC\Backup Set 2012-06-25 103917\Backup Files 2012-06-25 103917\Backup files 21.zip
[0] Archivtyp: ZIP
--> C/Users/Lehmann/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/16/23269d90-53e09817
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Lamar.BD
--> C2.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Lamar.BD
--> C3.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/2008-5353.CP
D:\LEHMANN-PC\Backup Set 2012-06-25 103917\Backup Files 2012-06-25 103917\Backup files 6.zip
[WARNUNG] Die Datei ist kennwortgeschützt
D:\LEHMANN-PC\Backup Set 2012-06-30 231344\Backup Files 2012-06-30 231344\Backup files 5.zip
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Murmel\Download\avira_free_antivirus_898de.exe
[WARNUNG] Die Datei ist kennwortgeschützt
D:\Murmel\Download\HSS-2.52-install-chip-389-conduit.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt

Beginne mit der Desinfektion:
D:\LEHMANN-PC\Backup Set 2012-06-25 103917\Backup Files 2012-06-25 103917\Backup files 21.zip
[FUND] Enthält Erkennungsmuster des Exploits EXP/2008-5353.CP
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '56866a24.qua' verschoben!
D:\LEHMANN-PC\Backup Set 2012-06-12 080005\Backup Files 2012-06-25 080008\Backup files 1.zip
[FUND] Enthält Erkennungsmuster des Exploits EXP/2008-5353.CP
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4e1145b2.qua' verschoben!
C:\Users\Lehmann\AppData\Local\Temp\4329495.exe
[FUND] Ist das Trojanische Pferd TR/Dldr.Phdet.E.41
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1c3f1f77.qua' verschoben!


Ende des Suchlaufs: Montag, 9. Juli 2012 14:02
Benötigte Zeit: 4:57:30 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

31642 Verzeichnisse wurden überprüft
1892175 Dateien wurden geprüft
7 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
3 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1892168 Dateien ohne Befall
31542 Archive wurden durchsucht
17 Warnungen
3 Hinweise
650721 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden


defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:56 on 09/07/2012 (Lehmann)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

OTL Logfile:
Code:
OTL logfile created on: 09.07.2012 14:56:51 - Run 3
OTL by OldTimer - Version 3.2.53.0    Folder = C:\Users\Lehmann\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 60,16% Memory free
8,00 Gb Paging File | 6,25 Gb Available in Paging File | 78,21% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 74,52 Gb Total Space | 34,68 Gb Free Space | 46,54% Space Free | Partition Type: NTFS
Drive D: | 204,03 Gb Total Space | 34,58 Gb Free Space | 16,95% Space Free | Partition Type: NTFS
 
Computer Name: LEHMANN-PC | User Name: Lehmann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.03 08:16:26 | 000,975,288 | ---- | M] (Samsung) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe
PRC - [2012.06.26 07:18:56 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Lehmann\Desktop\OTL.exe
PRC - [2012.05.09 07:12:14 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.09 07:12:13 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.09 07:12:13 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.04.11 02:04:10 | 001,202,504 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe
PRC - [2012.04.11 01:59:14 | 000,542,552 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.02 20:46:58 | 000,329,544 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.11.15 20:26:48 | 000,363,336 | ---- | M] (AnchorFree Inc.) -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.05.08 22:27:18 | 000,330,696 | ---- | M] () -- C:\Program Files (x86)\Verbindungsassistent\wtgservice.exe
PRC - [2011.04.14 18:40:02 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2011.01.23 20:37:02 | 000,148,280 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe
PRC - [2011.01.23 20:37:00 | 000,770,728 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe
PRC - [2010.09.11 05:51:12 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe
PRC - [2010.07.04 20:13:56 | 000,095,576 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
PRC - [2009.12.11 16:50:00 | 000,239,208 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWOW64\nvSCPAPISvr.exe
PRC - [2009.11.24 22:45:36 | 000,053,888 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
PRC - [2009.11.12 19:10:06 | 001,597,440 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
PRC - [2009.11.10 04:20:36 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
PRC - [2009.11.02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2009.10.26 19:10:42 | 000,174,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
PRC - [2009.07.31 19:38:24 | 000,305,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
PRC - [2009.06.19 19:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
PRC - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
PRC - [2008.12.23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
PRC - [2008.08.14 06:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
PRC - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
PRC - [2006.10.23 14:50:35 | 000,046,640 | R--- | M] (AOL LLC) -- C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.20 09:10:45 | 000,221,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\26e0457a9776a0e9f23e3986686d90a5\System.ServiceProcess.ni.dll
MOD - [2012.06.20 09:10:21 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\7ce183c1bf9fef5fd29cddc5a86878be\System.Runtime.Remoting.ni.dll
MOD - [2012.06.19 14:19:47 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll
MOD - [2012.06.19 00:05:10 | 018,019,840 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll
MOD - [2012.06.19 00:04:43 | 011,522,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll
MOD - [2012.06.19 00:04:26 | 003,881,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll
MOD - [2012.06.19 00:04:15 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll
MOD - [2012.06.19 00:04:09 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\a84262e1224189f93e10cd3c403a9527\System.Configuration.ni.dll
MOD - [2012.06.19 00:04:05 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll
MOD - [2012.06.19 00:03:53 | 009,092,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll
MOD - [2012.06.19 00:03:43 | 014,414,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll
MOD - [2012.05.08 13:47:16 | 008,797,856 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
MOD - [2012.04.11 02:05:12 | 000,010,056 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\lang\gui-ger.dll
MOD - [2012.04.11 02:04:10 | 001,202,504 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe
MOD - [2011.11.02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.11.02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.06.28 11:03:20 | 000,438,272 | ---- | M] () -- C:\Program Files (x86)\Orbitdownloader\addons\OneClickYouTubeDownloader\components\GrabXpcom.dll
MOD - [2011.06.27 11:13:12 | 000,094,208 | ---- | M] () -- C:\Program Files (x86)\Orbitdownloader\addons\OneClickYouTubeDownloader\components\GrabKernel.dll
MOD - [2011.04.14 18:40:02 | 001,874,904 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2011.01.23 20:37:02 | 000,148,280 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe
MOD - [2011.01.23 20:37:00 | 000,770,728 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe
MOD - [2010.04.05 06:56:07 | 000,716,954 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\Epwizard.DLL
MOD - [2010.04.05 06:55:15 | 000,159,890 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\customui.dll
MOD - [2010.04.05 06:55:04 | 000,061,604 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\Epfunct.DLL
MOD - [2010.04.05 06:54:59 | 000,123,033 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\Eputil.DLL
MOD - [2010.04.05 06:54:52 | 000,143,502 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\Imagutil.DLL
MOD - [2010.04.01 13:24:28 | 001,159,168 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeeDRS.dll
MOD - [2010.04.01 13:23:27 | 000,389,120 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeescw.dll
MOD - [2009.11.24 22:45:36 | 000,053,888 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
MOD - [2009.11.12 19:10:06 | 001,597,440 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
MOD - [2009.11.02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2009.11.02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
MOD - [2009.09.23 20:07:14 | 000,204,800 | ---- | M] () -- C:\Program Files (x86)\asus\VirtualCamera\virtualCamera.ax
MOD - [2009.06.23 07:11:04 | 000,102,400 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\EPOEMDll.dll
MOD - [2009.06.23 07:10:29 | 000,045,056 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\epstring.dll
MOD - [2009.06.23 07:09:11 | 002,203,648 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\EPWizRes.dll
MOD - [2009.05.27 08:16:50 | 000,192,512 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeedatr.dll
MOD - [2009.04.28 03:56:29 | 000,024,064 | ---- | M] () -- C:\Windows\SysWOW64\LXEEsmr.dll
MOD - [2009.04.07 15:25:27 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\iptk.dll
MOD - [2009.03.10 01:43:49 | 000,155,648 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeecaps.dll
MOD - [2009.03.02 10:25:47 | 000,151,552 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeeptp.dll
MOD - [2009.02.20 04:48:03 | 000,299,008 | ---- | M] () -- C:\Windows\SysWOW64\LXEEsm.dll
MOD - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.04.14 15:01:44 | 001,052,328 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxeecoms.exe -- (lxee_device)
SRV:64bit: - [2010.04.14 15:01:37 | 000,045,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxeeserv.exe -- (lxeeCATSCustConnectService)
SRV:64bit: - [2009.09.17 20:36:34 | 000,359,552 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012.05.09 07:12:14 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.09 07:12:13 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.11 02:06:10 | 000,077,520 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService)
SRV - [2012.04.11 01:59:14 | 000,542,552 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (hshld)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.04.02 20:46:58 | 000,329,544 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.11.15 20:26:48 | 000,363,336 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.05.08 22:27:18 | 000,330,696 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Verbindungsassistent\wtgservice.exe -- (WTGService)
SRV - [2010.04.14 15:01:37 | 000,045,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\system32\spool\DRIVERS\x64\3\\lxeeserv.exe -- (lxeeCATSCustConnectService)
SRV - [2010.04.14 15:01:23 | 000,598,696 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxeecoms.exe -- (lxee_device)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.12.11 16:50:00 | 000,239,208 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Windows\SysWOW64\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2009.11.10 04:20:36 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.11 10:38:06 | 000,620,544 | ---- | M] (Nokia.) [Disabled | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2007.05.31 17:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 17:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2006.10.23 14:50:35 | 000,046,640 | R--- | M] (AOL LLC) [Auto | Running] -- C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe -- (AOL ACS)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.06.04 09:59:20 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV:64bit: - [2012.06.04 09:59:20 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV:64bit: - [2012.05.09 07:12:14 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.09 07:12:14 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.26 23:45:18 | 000,056,832 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HssDrv.sys -- (HssDrv)
DRV:64bit: - [2012.03.26 23:45:14 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.09.16 17:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.08.02 18:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.06.27 01:37:00 | 002,753,536 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.05.08 22:05:22 | 000,115,328 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.06.14 10:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk)
DRV:64bit: - [2010.01.31 11:57:07 | 002,495,944 | ---- | M] (Digital Camera) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SPUVCBv_x64.sys -- (SPUVCbv)
DRV:64bit: - [2009.12.22 04:31:04 | 000,020,568 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dgderdrv.sys -- (dgderdrv)
DRV:64bit: - [2009.10.15 11:23:19 | 000,117,760 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2009.08.21 23:48:17 | 000,044,032 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)
DRV:64bit: - [2009.08.21 06:24:03 | 000,084,512 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2009.07.20 19:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009.06.10 22:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.13 18:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2008.12.08 17:35:52 | 000,061,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2008.08.28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2008.05.24 02:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV:64bit: - [2006.11.30 00:24:49 | 000,024,064 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wanatw64.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2010.06.14 10:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.07.03 02:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)
DRV - [2008.07.24 11:04:34 | 000,115,328 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ewusbmdm.sys -- (hwdatacard)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.orbitdownloader.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://search.orbitdownloader.com"
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Lehmann\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011.05.25 13:55:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011.05.25 13:55:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.10 21:21:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.12 18:14:23 | 000,000,000 | ---D | M]
 
[2011.05.08 18:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lehmann\AppData\Roaming\mozilla\Extensions
[2012.05.02 07:18:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lehmann\AppData\Roaming\mozilla\Firefox\Profiles\4pc4gfir.default\extensions
[2012.06.10 21:21:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.12.26 13:17:41 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.03.30 13:44:53 | 000,000,000 | ---D | M] (Hotspot Shield Helper (Please allow this installation)) -- C:\Program Files (x86)\mozilla firefox\extensions\afurladvisor@anchorfree.com
[2011.09.20 10:03:47 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Program Files (x86)\mozilla firefox\extensions\quickstores@quickstores.de
[2012.02.28 08:29:56 | 000,000,000 | ---D | M] (OneClick YouTube Downloader) -- C:\PROGRAM FILES (X86)\ORBITDOWNLOADER\ADDONS\ONECLICKYOUTUBEDOWNLOADER
[2011.05.25 12:47:25 | 000,550,833 | ---- | M] () (No name found) -- C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\EXTENSIONS\DIVXWEBPLAYER@DIVX.COM.XPI
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.03.08 12:24:04 | 000,103,168 | ---- | M] (Midasplayer Ltd) -- C:\Program Files (x86)\mozilla firefox\plugins\npmidas.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.06.26 21:51:13 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe ()
O4:64bit: - HKLM..\Run: [lxeemon.exe] C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe ()
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PONS-CD 7] C:\Program Files (x86)\Paragon Software\PONS\PONS-CD.exe ()
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 10.4.1)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 10.4.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{947C3A71-283C-46D6-9EE8-0FA7FDD7F411}: NameServer = 10.24.8.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B601814E-3DC9-410D-86DD-ECD9F54BEAF5}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.05 13:33:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paragon Software
[2012.07.05 13:33:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Paragon Software
[2012.07.05 09:22:06 | 000,203,320 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.07.05 09:22:06 | 000,099,384 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.06.26 21:59:48 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.06.26 21:53:03 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012.06.26 20:38:33 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012.06.26 14:34:09 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.06.26 07:18:49 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Lehmann\Desktop\OTL.exe
[2012.06.25 20:40:07 | 000,000,000 | ---D | C] -- C:\Users\Lehmann\AppData\Roaming\Malwarebytes
[2012.06.25 20:39:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.25 20:39:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.25 20:39:17 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.25 20:39:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.06.23 22:46:01 | 000,000,000 | ---D | C] -- C:\Windows\WindowsMobile
[2012.06.18 23:25:41 | 000,000,000 | ---D | C] -- C:\BauFaktura
[2012.06.10 22:41:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.06.10 22:41:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Oracle
[1 C:\Users\Lehmann\Desktop\*.tmp files -> C:\Users\Lehmann\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.09 14:54:32 | 000,050,477 | ---- | M] () -- C:\Users\Lehmann\Desktop\Defogger.exe
[2012.07.09 14:49:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.09 14:10:02 | 000,000,936 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001UA.job
[2012.07.09 14:10:01 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001Core.job
[2012.07.09 12:37:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.09 09:08:48 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.09 09:08:48 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.09 09:02:41 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.09 09:00:59 | 3220,647,936 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.09 08:52:51 | 000,006,087 | ---- | M] () -- C:\Users\Lehmann\Desktop\Einkaufsliste Filderschule.odt
[2012.07.08 23:57:20 | 000,002,015 | ---- | M] () -- C:\Users\Lehmann\Desktop\Kies Air Discovery Service.lnk
[2012.07.05 16:53:28 | 000,002,122 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2012.07.05 16:52:31 | 000,345,848 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.05 13:33:13 | 000,001,175 | ---- | M] () -- C:\Users\Public\Desktop\Wörterbuch.lnk
[2012.07.05 10:15:28 | 001,591,306 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.07.05 10:15:28 | 000,697,098 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.05 10:15:28 | 000,652,376 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.05 10:15:28 | 000,148,362 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.05 10:15:28 | 000,121,308 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.05 10:15:11 | 001,591,306 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.03 15:27:35 | 000,001,417 | ---- | M] () -- C:\Users\Lehmann\Desktop\Rot12-13_musik - Verknüpfung.lnk
[2012.06.26 21:51:13 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.06.26 09:02:38 | 000,045,320 | ---- | M] (MARKANY) -- C:\Windows\SysWow64\MAMACExtract.dll
[2012.06.26 07:18:56 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Lehmann\Desktop\OTL.exe
[2012.06.26 07:18:15 | 000,000,000 | ---- | M] () -- C:\Users\Lehmann\defogger_reenable
[2012.06.26 07:07:44 | 000,001,651 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2012.06.25 20:39:19 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.25 10:28:28 | 270,703,800 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.06.24 16:36:28 | 000,098,924 | ---- | M] () -- C:\Users\Lehmann\Desktop\EinladungKocheltern.pdf
[2012.06.23 22:47:39 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdRapi2_01_00_00.Wdf
[2012.06.11 16:43:02 | 003,312,029 | ---- | M] () -- C:\Users\Lehmann\Desktop\GrüneGarde12-13.mp3
[2012.06.10 21:21:52 | 000,001,144 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[1 C:\Users\Lehmann\Desktop\*.tmp files -> C:\Users\Lehmann\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.09 14:54:29 | 000,050,477 | ---- | C] () -- C:\Users\Lehmann\Desktop\Defogger.exe
[2012.07.08 23:57:20 | 000,002,015 | ---- | C] () -- C:\Users\Lehmann\Desktop\Kies Air Discovery Service.lnk
[2012.07.05 13:33:13 | 000,001,175 | ---- | C] () -- C:\Users\Public\Desktop\Wörterbuch.lnk
[2012.07.03 15:27:35 | 000,001,417 | ---- | C] () -- C:\Users\Lehmann\Desktop\Rot12-13_musik - Verknüpfung.lnk
[2012.06.26 07:18:15 | 000,000,000 | ---- | C] () -- C:\Users\Lehmann\defogger_reenable
[2012.06.25 20:39:19 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.24 16:36:27 | 000,098,924 | ---- | C] () -- C:\Users\Lehmann\Desktop\EinladungKocheltern.pdf
[2012.06.23 22:47:39 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdRapi2_01_00_00.Wdf
[2012.06.23 22:46:22 | 000,002,419 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Mobile Device Center.lnk
[2012.06.18 23:23:03 | 001,591,306 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.06.11 16:42:34 | 003,312,029 | ---- | C] () -- C:\Users\Lehmann\Desktop\GrüneGarde12-13.mp3
[2012.06.10 21:21:52 | 000,001,144 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.05.11 13:01:42 | 000,001,200 | ---- | C] () -- C:\Users\Lehmann\.recently-used.xbel
[2012.04.26 15:03:42 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\cd.dat
[2012.03.02 09:26:38 | 000,104,065 | ---- | C] () -- C:\Users\Lehmann\Neues_Dokument_13-image3550-392.png
[2012.01.19 16:08:16 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeepmui.dll
[2012.01.19 16:08:16 | 000,364,544 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeeinpa.dll
[2012.01.19 16:08:16 | 000,344,064 | ---- | C] () -- C:\Windows\SysWow64\lxeecomx.dll
[2012.01.19 16:08:16 | 000,344,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeeiesc.dll
[2012.01.19 16:08:16 | 000,331,776 | ---- | C] () -- C:\Windows\SysWow64\LXEEinst.dll
[2012.01.19 16:08:16 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\lxeeinsr.dll
[2012.01.19 16:08:16 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\lxeejswr.dll
[2012.01.19 16:08:16 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\lxeecur.dll
[2012.01.19 16:08:15 | 000,847,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeeusb1.dll
[2012.01.19 16:08:15 | 000,323,584 | ---- | C] () -- C:\Windows\SysWow64\lxeeins.dll
[2012.01.19 16:08:15 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\lxeeinsb.dll
[2012.01.19 16:08:15 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\lxeecu.dll
[2012.01.19 16:08:15 | 000,090,112 | ---- | C] () -- C:\Windows\SysWow64\lxeecub.dll
[2012.01.19 16:08:14 | 001,048,576 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeeserv.dll
[2012.01.19 16:08:14 | 000,688,128 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeehbn3.dll
[2012.01.19 16:08:14 | 000,598,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeecoms.exe
[2012.01.19 16:08:14 | 000,577,536 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeelmpm.dll
[2012.01.19 16:08:14 | 000,372,736 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeecomm.dll
[2012.01.19 16:08:14 | 000,324,264 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeeih.exe
[2012.01.19 16:08:13 | 000,802,816 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeecomc.dll
[2012.01.19 16:08:13 | 000,373,416 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeecfg.exe
[2012.01.19 16:07:43 | 000,299,008 | ---- | C] () -- C:\Windows\SysWow64\LXEEsm.dll
[2012.01.19 16:07:43 | 000,024,064 | ---- | C] () -- C:\Windows\SysWow64\LXEEsmr.dll
[2012.01.11 14:17:23 | 000,007,597 | ---- | C] () -- C:\Users\Lehmann\AppData\Local\Resmon.ResmonCfg
[2012.01.11 11:32:34 | 000,002,048 | -HS- | C] () -- C:\Users\Lehmann\AppData\Local\{00323ace-4188-97dc-19ab-1f56921a2012}\@
[2011.10.31 12:22:42 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.07.08 22:55:21 | 000,025,717 | ---- | C] () -- C:\Windows\MSUMLT06.INI
[2011.06.07 12:13:38 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.06.07 12:13:38 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.06.07 12:13:38 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.06.07 12:13:38 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.05.13 07:22:21 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2011.05.09 13:15:47 | 000,032,608 | ---- | C] () -- C:\Windows\king-uninstall.exe
[2011.05.08 23:31:50 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.05.08 20:10:25 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.09.11 05:29:21 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\LogonStart.dll
 
========== LOP Check ==========
 
[2011.05.10 11:27:42 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Asus WebStorage
[2011.10.10 22:10:24 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\BullGuard
[2011.06.06 21:15:23 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Digiarty
[2011.05.10 11:26:55 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\EeeStorageUploader
[2011.05.17 07:46:35 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\GrabPro
[2011.06.06 21:14:15 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Gutscheinmieze
[2012.01.06 00:58:07 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\inkscape
[2011.05.08 22:14:07 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Lehmann
[2011.05.08 18:56:38 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\OpenCandy
[2012.01.16 19:56:46 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Opera
[2012.07.05 21:44:48 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Orbit
[2011.12.17 21:04:26 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\PC Suite
[2011.05.08 18:57:08 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\ProgSense
[2012.03.03 19:38:48 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Samsung
[2011.10.09 17:26:31 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Software Inspection Library
[2012.06.24 10:19:32 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\temp
[2011.05.08 22:28:37 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent
[2012.07.09 14:10:01 | 000,000,914 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001Core.job
[2012.07.09 14:10:02 | 000,000,936 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001UA.job
[2012.04.23 14:24:50 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---

cosinus 12.07.2012 15:33
Warum machst du einen neuen Strang auf? :balla:
Reicht das nicht wenn du Larusso hier beschäftigst => http://www.trojaner-board.de/118121-...tml#post862670

:confused: :wtf: :balla:

murmeltiermu 12.07.2012 16:08
hi

da dies ein anderer pc und ein anderes problem ist, dachte ich wäre es besser wenn ich etwas neues aufmache und nicht 2 probleme vermische. Ausserdem war ich mir nicht sicher ob ihr die probleme aufteilt z.b. larusso ist spezialist für den trojaner.....
du eher spezialist für trojaner xy...

gruß simone

cosinus 12.07.2012 17:52
Äh da hättest du ja auch ein Wörtchen sagen können, dass es hier um einen anderen Rechner geht oder hab ich das übersehen :confused:

Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

murmeltiermu 12.07.2012 21:22
hier mal das log vom montag gleich nachdem avira alarm gemeldet hat rest kommt noch

Malwarebytes Anti-Malware (Test) 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.07.08.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Lehmann :: LEHMANN-PC [Administrator]

Schutz: Deaktiviert

09.07.2012 08:53:32
mbam-log-2012-07-09 (08-53-32).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 233038
Laufzeit: 5 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\Users\Lehmann\AppData\Local\Temp\4338200.exe (RootKit.0Access) -> 4976 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Lehmann\AppData\Local\Temp\4338200.exe (RootKit.0Access) -> Löschen bei Neustart.
C:\Users\Lehmann\AppData\Local\Temp\msimg32.dll (RootKit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Malwarebytes Anti-Malware 1.62.0.1300
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.07.12.11

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Lehmann :: LEHMANN-PC [Administrator]

12.07.2012 22:28:13
mbam-log-2012-07-12 (22-28-13).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 366320
Laufzeit: 51 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=388612b496c63246b967af342060e626
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-13 03:34:06
# local_time=2012-07-13 05:34:06 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 9615535 9615535 0 0
# compatibility_mode=5893 16776573 100 94 49984 93758861 0 0
# compatibility_mode=8192 67108863 100 0 134 134 0 0
# scanned=146244
# found=1
# cleaned=0
# scan_time=21434
D:\LEHMANN-PC\Backup Set 2012-06-30 231344\Backup Files 2012-07-11 080003\Backup files 2.zip        a variant of Java/Exploit.CVE-2012-1723.C trojan (unable to clean)        00000000000000000000000000000000        I

cosinus 13.07.2012 10:51
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

murmeltiermu 13.07.2012 11:02
hi

nein es scheint alles ohne problem zu funktionieren, firefox stürzt immer ab, wobei das an der veralteten version liegen kann ( bin normalerweise mit aol und opera drin ). im startmenü ist alles so wie es immer war und unter alle programme ist der autostartordner leer.

ich melde mich hiermit übers wochenende ab, bin ab sonntagabend wieder da :-)

cosinus 13.07.2012 20:27
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

murmeltiermu 15.07.2012 20:32
Code:
# AdwCleaner v1.702 - Logfile created 07/15/2012 at 21:30:01
# Updated 13/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Lehmann - LEHMANN-PC
# Running from : C:\Users\Lehmann\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Lehmann\AppData\LocalLow\boost_interprocess
Folder Found : C:\Users\Lehmann\AppData\Roaming\OpenCandy
Folder Found : C:\ProgramData\Viewpoint
Folder Found : C:\ProgramData\Viewpoint
Folder Found : C:\Program Files (x86)\Mozilla Firefox\Extensions\quickstores@quickstores.de
Folder Found : C:\Program Files (x86)\Viewpoint
Folder Found : C:\Program Files (x86)\Viewpoint
Folder Found : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar
File Found : C:\Users\Lehmann\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url
File Found : C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url

***** [Registry] *****

Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Key Found : HKLM\SOFTWARE\MetaStream
Key Found : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Found : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
Key Found : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
Key Found : HKLM\SOFTWARE\Viewpoint
[x64] Key Found : HKCU\Software\Softonic
[x64] Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
[x64] Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
[x64] Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
[x64] Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v4.0.1 (de)

Profile name : default
File : C:\Users\Lehmann\AppData\Roaming\Mozilla\Firefox\Profiles\4pc4gfir.default\prefs.js

Found : user_pref("extensions.enabledAddons", "DivXWebPlayer@divx.com:2.0.2.039,{35379F86-8CCB-4724-AE33-427[...]
Found : user_pref("quickstores.toolbar.affid", "2008");
Found : user_pref("quickstores.toolbar.guid", "{8E11DCF1-38BC-36E5-E33E-4F8CCD080443}");

Profile name : default
File : C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\4b0cob2o.default\prefs.js

[OK] File is clean.

-\\ Opera v12.0.1467.0

File : C:\Users\Lehmann\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

File : C:\Users\Holger\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [3572 octets] - [15/07/2012 21:30:01]

########## EOF - C:\AdwCleaner[R1].txt - [3700 octets] ##########

cosinus 15.07.2012 20:54
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

murmeltiermu 15.07.2012 21:04
Code:
# AdwCleaner v1.702 - Logfile created 07/15/2012 at 21:59:56
# Updated 13/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Lehmann - LEHMANN-PC
# Running from : C:\Users\Lehmann\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\Lehmann\AppData\LocalLow\boost_interprocess
Folder Deleted : C:\Users\Lehmann\AppData\Roaming\OpenCandy
Folder Deleted : C:\ProgramData\Viewpoint
Folder Deleted : C:\Program Files (x86)\Mozilla Firefox\Extensions\quickstores@quickstores.de
Folder Deleted : C:\Program Files (x86)\Viewpoint
Folder Deleted : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar
File Deleted : C:\Users\Lehmann\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url
File Deleted : C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url

***** [Registry] *****

Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Key Deleted : HKLM\SOFTWARE\MetaStream
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
Key Deleted : HKLM\SOFTWARE\Viewpoint

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v4.0.1 (de)

Profile name : default
File : C:\Users\Lehmann\AppData\Roaming\Mozilla\Firefox\Profiles\4pc4gfir.default\prefs.js

C:\Users\Lehmann\AppData\Roaming\Mozilla\Firefox\Profiles\4pc4gfir.default\user.js ... Deleted !

Deleted : user_pref("extensions.enabledAddons", "DivXWebPlayer@divx.com:2.0.2.039,{35379F86-8CCB-4724-AE33-427[...]
Deleted : user_pref("quickstores.toolbar.affid", "2008");
Deleted : user_pref("quickstores.toolbar.guid", "{8E11DCF1-38BC-36E5-E33E-4F8CCD080443}");

Profile name : default
File : C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\4b0cob2o.default\prefs.js

[OK] File is clean.

-\\ Opera v12.0.1467.0

File : C:\Users\Lehmann\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

File : C:\Users\Holger\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [3687 octets] - [15/07/2012 21:30:01]
AdwCleaner[S1].txt - [3260 octets] - [15/07/2012 21:59:56]

########## EOF - C:\AdwCleaner[S1].txt - [3388 octets] ##########

cosinus 16.07.2012 13:48
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

murmeltiermu 16.07.2012 14:20
Code:
OTL logfile created on: 16.07.2012 14:57:08 - Run 6
OTL by OldTimer - Version 3.2.53.0    Folder = C:\Users\Lehmann\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,90 Gb Available Physical Memory | 72,47% Memory free
8,00 Gb Paging File | 6,62 Gb Available in Paging File | 82,80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 74,52 Gb Total Space | 33,38 Gb Free Space | 44,79% Space Free | Partition Type: NTFS
Drive D: | 204,03 Gb Total Space | 8,12 Gb Free Space | 3,98% Space Free | Partition Type: NTFS
 
Computer Name: LEHMANN-PC | User Name: Lehmann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 08:16:26 | 000,975,288 | ---- | M] (Samsung) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe
PRC - [2012.06.26 07:18:56 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Lehmann\Desktop\OTL.exe
PRC - [2012.05.09 07:12:14 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.09 07:12:13 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.09 07:12:13 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.04.11 01:59:14 | 000,542,552 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
PRC - [2012.04.02 20:46:58 | 000,329,544 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.11.15 20:26:48 | 000,363,336 | ---- | M] (AnchorFree Inc.) -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.05.08 22:27:18 | 000,330,696 | ---- | M] () -- C:\Program Files (x86)\Verbindungsassistent\wtgservice.exe
PRC - [2011.01.23 20:37:02 | 000,148,280 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe
PRC - [2011.01.23 20:37:00 | 000,770,728 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe
PRC - [2010.09.11 05:51:12 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe
PRC - [2009.12.11 16:50:00 | 000,239,208 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWOW64\nvSCPAPISvr.exe
PRC - [2009.11.24 22:45:36 | 000,053,888 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
PRC - [2009.11.10 04:20:36 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
PRC - [2009.11.02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2009.10.26 19:10:42 | 000,174,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
PRC - [2009.07.31 19:38:24 | 000,305,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
PRC - [2009.06.19 19:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
PRC - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
PRC - [2008.12.23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
PRC - [2008.08.14 06:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
PRC - [2006.10.23 14:50:35 | 000,046,640 | R--- | M] (AOL LLC) -- C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe
PRC - [2006.09.26 02:52:48 | 000,050,736 | ---- | M] (America Online, Inc.) -- C:\Program Files (x86)\Common Files\AOL\1304878352\ee\aolsoftware.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.20 09:10:45 | 000,221,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\26e0457a9776a0e9f23e3986686d90a5\System.ServiceProcess.ni.dll
MOD - [2012.06.20 09:10:21 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\7ce183c1bf9fef5fd29cddc5a86878be\System.Runtime.Remoting.ni.dll
MOD - [2012.06.19 14:19:47 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll
MOD - [2012.06.19 00:05:10 | 018,019,840 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll
MOD - [2012.06.19 00:04:43 | 011,522,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll
MOD - [2012.06.19 00:04:26 | 003,881,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll
MOD - [2012.06.19 00:04:15 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll
MOD - [2012.06.19 00:04:09 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\a84262e1224189f93e10cd3c403a9527\System.Configuration.ni.dll
MOD - [2012.06.19 00:04:05 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll
MOD - [2012.06.19 00:03:53 | 009,092,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll
MOD - [2012.06.19 00:03:43 | 014,414,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll
MOD - [2011.11.02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.11.02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.01.23 20:37:02 | 000,148,280 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe
MOD - [2011.01.23 20:37:00 | 000,770,728 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe
MOD - [2010.04.05 06:56:07 | 000,716,954 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\Epwizard.DLL
MOD - [2010.04.05 06:55:15 | 000,159,890 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\customui.dll
MOD - [2010.04.05 06:55:04 | 000,061,604 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\Epfunct.DLL
MOD - [2010.04.05 06:54:59 | 000,123,033 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\Eputil.DLL
MOD - [2010.04.05 06:54:52 | 000,143,502 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\Imagutil.DLL
MOD - [2010.04.01 13:24:28 | 001,159,168 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeeDRS.dll
MOD - [2010.04.01 13:23:27 | 000,389,120 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeescw.dll
MOD - [2009.11.24 22:45:36 | 000,053,888 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
MOD - [2009.11.02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2009.11.02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
MOD - [2009.06.23 07:11:04 | 000,102,400 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\EPOEMDll.dll
MOD - [2009.06.23 07:10:29 | 000,045,056 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\epstring.dll
MOD - [2009.06.23 07:09:11 | 002,203,648 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\EPWizRes.dll
MOD - [2009.05.27 08:16:50 | 000,192,512 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeedatr.dll
MOD - [2009.04.28 03:56:29 | 000,024,064 | ---- | M] () -- C:\Windows\SysWOW64\LXEEsmr.dll
MOD - [2009.04.07 15:25:27 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\iptk.dll
MOD - [2009.03.10 01:43:49 | 000,155,648 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeecaps.dll
MOD - [2009.03.02 10:25:47 | 000,151,552 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro700 Series\lxeeptp.dll
MOD - [2009.02.20 04:48:03 | 000,299,008 | ---- | M] () -- C:\Windows\SysWOW64\LXEEsm.dll
MOD - [2007.05.24 03:57:52 | 000,094,208 | ---- | M] () -- c:\program files (x86)\common files\aol\1304878352\ee\services\waolTrayMenuService\ver_0_9_1\waolTrayMenuService.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.04.14 15:01:44 | 001,052,328 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxeecoms.exe -- (lxee_device)
SRV:64bit: - [2010.04.14 15:01:37 | 000,045,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxeeserv.exe -- (lxeeCATSCustConnectService)
SRV:64bit: - [2009.09.17 20:36:34 | 000,359,552 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.05.09 07:12:14 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.09 07:12:13 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.11 02:06:10 | 000,077,520 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService)
SRV - [2012.04.11 01:59:14 | 000,542,552 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (hshld)
SRV - [2012.04.02 20:46:58 | 000,329,544 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.11.15 20:26:48 | 000,363,336 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.05.08 22:27:18 | 000,330,696 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Verbindungsassistent\wtgservice.exe -- (WTGService)
SRV - [2010.04.14 15:01:37 | 000,045,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\system32\spool\DRIVERS\x64\3\\lxeeserv.exe -- (lxeeCATSCustConnectService)
SRV - [2010.04.14 15:01:23 | 000,598,696 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxeecoms.exe -- (lxee_device)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.12.11 16:50:00 | 000,239,208 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Windows\SysWOW64\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2009.11.10 04:20:36 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.11 10:38:06 | 000,620,544 | ---- | M] (Nokia.) [Disabled | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2007.05.31 17:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 17:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2006.10.23 14:50:35 | 000,046,640 | R--- | M] (AOL LLC) [Auto | Running] -- C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe -- (AOL ACS)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.06.04 09:59:20 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV:64bit: - [2012.06.04 09:59:20 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV:64bit: - [2012.05.09 07:12:14 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.09 07:12:14 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.26 23:45:18 | 000,056,832 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HssDrv.sys -- (HssDrv)
DRV:64bit: - [2012.03.26 23:45:14 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.09.16 17:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.08.02 18:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.06.27 01:37:00 | 002,753,536 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.05.08 22:05:22 | 000,115,328 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.06.14 10:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk)
DRV:64bit: - [2010.01.31 11:57:07 | 002,495,944 | ---- | M] (Digital Camera) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SPUVCBv_x64.sys -- (SPUVCbv)
DRV:64bit: - [2009.12.22 04:31:04 | 000,020,568 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dgderdrv.sys -- (dgderdrv)
DRV:64bit: - [2009.10.15 11:23:19 | 000,117,760 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2009.08.21 23:48:17 | 000,044,032 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)
DRV:64bit: - [2009.08.21 06:24:03 | 000,084,512 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2009.07.20 19:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009.06.10 22:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.13 18:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2008.12.08 17:35:52 | 000,061,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2008.08.28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2008.05.24 02:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV:64bit: - [2006.11.30 00:24:49 | 000,024,064 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wanatw64.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2010.06.14 10:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.07.03 02:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)
DRV - [2008.07.24 11:04:34 | 000,115,328 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ewusbmdm.sys -- (hwdatacard)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.orbitdownloader.com
IE - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://search.orbitdownloader.com"
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Lehmann\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011.05.25 13:55:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011.05.25 13:55:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.10 21:21:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.12 18:14:23 | 000,000,000 | ---D | M]
 
[2011.05.08 18:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lehmann\AppData\Roaming\mozilla\Extensions
[2012.05.02 07:18:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lehmann\AppData\Roaming\mozilla\Firefox\Profiles\4pc4gfir.default\extensions
[2012.07.15 22:00:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.12.26 13:17:41 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.03.30 13:44:53 | 000,000,000 | ---D | M] (Hotspot Shield Helper (Please allow this installation)) -- C:\Program Files (x86)\mozilla firefox\extensions\afurladvisor@anchorfree.com
[2012.02.28 08:29:56 | 000,000,000 | ---D | M] (OneClick YouTube Downloader) -- C:\PROGRAM FILES (X86)\ORBITDOWNLOADER\ADDONS\ONECLICKYOUTUBEDOWNLOADER
[2011.05.25 12:47:25 | 000,550,833 | ---- | M] () (No name found) -- C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\EXTENSIONS\DIVXWEBPLAYER@DIVX.COM.XPI
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.03.08 12:24:04 | 000,103,168 | ---- | M] (Midasplayer Ltd) -- C:\Program Files (x86)\mozilla firefox\plugins\npmidas.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.06.26 21:51:13 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
O3 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe ()
O4:64bit: - HKLM..\Run: [lxeemon.exe] C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe ()
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PONS-CD 7] C:\Program Files (x86)\Paragon Software\PONS\PONS-CD.exe ()
O4 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001..\Run: [AutoStartNPSAgent] C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001..\Run: [Facebook Update] C:\Users\Lehmann\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)
O16 - DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 10.5.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{947C3A71-283C-46D6-9EE8-0FA7FDD7F411}: NameServer = 10.24.8.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B601814E-3DC9-410D-86DD-ECD9F54BEAF5}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FancyStart daemon.lnk - C:\Windows\Installer\{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}\_A1DDD39913A1970387B7B3.exe - ()
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SRS Premium Sound.lnk - C:\Windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe - (Acresso Software Inc.)
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: AmIcoSinglun64 - hkey= - key= - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
MsConfig:64bit - StartUpReg: AOL Fast Start - hkey= - key= - C:\Program Files (x86)\AOL 9.0 VR\AOL.EXE (AOL, LLC.)
MsConfig:64bit - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)
MsConfig:64bit - StartUpReg: ASUS WebStorage - hkey= - key= - C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe ()
MsConfig:64bit - StartUpReg: ATKMEDIA - hkey= - key= - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
MsConfig:64bit - StartUpReg: ATKOSD2 - hkey= - key= - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
MsConfig:64bit - StartUpReg: Boingo Wi-Fi - hkey= - key= - C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk ()
MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
MsConfig:64bit - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MsConfig:64bit - StartUpReg: ETDWare - hkey= - key= - C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
MsConfig:64bit - StartUpReg: Facebook Update - hkey= - key= - C:\Users\Lehmann\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
MsConfig:64bit - StartUpReg: HControlUser - hkey= - key= - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
MsConfig:64bit - StartUpReg: HostManager - hkey= - key= - C:\Program Files (x86)\Common Files\AOL\1304878352\ee\AOLSoftware.exe (America Online, Inc.)
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: KiesHelper - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: KiesPDLR - hkey= - key= - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
MsConfig:64bit - StartUpReg: KiesTrayAgent - hkey= - key= - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
MsConfig:64bit - StartUpReg: Setwallpaper - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - StartUpReg: Syncables - hkey= - key= - C:\Program Files (x86)\syncables\syncables desktop\Syncables.exe (syncables, LLC)
MsConfig:64bit - StartUpReg: UpdateLBPShortCut - hkey= - key= - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: UpdateP2GoShortCut - hkey= - key= - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig:64bit - State: "services" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.12 23:34:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.07.12 23:34:20 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Lehmann\Desktop\esetsmartinstaller_enu.exe
[2012.07.12 07:28:42 | 000,000,000 | ---D | C] -- C:\Users\Lehmann\AppData\Local\Macromedia
[2012.07.10 15:21:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Oracle
[2012.07.05 13:33:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paragon Software
[2012.07.05 13:33:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Paragon Software
[2012.07.05 09:22:06 | 000,203,320 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.07.05 09:22:06 | 000,099,384 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.06.26 21:59:48 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.06.26 21:53:03 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012.06.26 20:38:33 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012.06.26 14:34:09 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.06.26 07:18:49 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Lehmann\Desktop\OTL.exe
[2012.06.25 20:40:07 | 000,000,000 | ---D | C] -- C:\Users\Lehmann\AppData\Roaming\Malwarebytes
[2012.06.25 20:39:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.25 20:39:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.25 20:39:17 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.25 20:39:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.06.23 22:46:01 | 000,000,000 | ---D | C] -- C:\Windows\WindowsMobile
[2012.06.18 23:25:41 | 000,000,000 | ---D | C] -- C:\BauFaktura
[1 C:\Users\Lehmann\Desktop\*.tmp files -> C:\Users\Lehmann\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.16 14:49:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.16 14:15:01 | 000,001,146 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001UA.job
[2012.07.16 13:33:58 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.16 13:33:58 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.16 13:27:05 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.16 13:25:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.16 13:25:43 | 3220,647,936 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.16 08:44:27 | 000,006,148 | ---- | M] () -- C:\Users\Lehmann\Desktop\Einkaufsliste Filderschule.odt
[2012.07.15 23:15:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001Core.job
[2012.07.15 21:28:26 | 000,624,883 | ---- | M] () -- C:\Users\Lehmann\Desktop\adwcleaner.exe
[2012.07.12 23:33:32 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Lehmann\Desktop\esetsmartinstaller_enu.exe
[2012.07.12 22:23:33 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.12 22:20:10 | 001,613,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.12 22:20:10 | 000,697,098 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.12 22:20:10 | 000,652,376 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.12 22:20:10 | 000,148,362 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.12 22:20:10 | 000,121,308 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.12 07:24:06 | 000,345,848 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.09 14:54:32 | 000,050,477 | ---- | M] () -- C:\Users\Lehmann\Desktop\Defogger.exe
[2012.07.08 23:57:20 | 000,002,015 | ---- | M] () -- C:\Users\Lehmann\Desktop\Kies Air Discovery Service.lnk
[2012.07.05 16:53:28 | 000,002,122 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2012.07.05 13:33:13 | 000,001,175 | ---- | M] () -- C:\Users\Public\Desktop\Wörterbuch.lnk
[2012.07.05 10:15:28 | 001,591,306 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.07.03 15:27:35 | 000,001,417 | ---- | M] () -- C:\Users\Lehmann\Desktop\Rot12-13_musik - Verknüpfung.lnk
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.26 21:51:13 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.06.26 09:02:38 | 000,045,320 | ---- | M] (MARKANY) -- C:\Windows\SysWow64\MAMACExtract.dll
[2012.06.26 07:18:56 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Lehmann\Desktop\OTL.exe
[2012.06.26 07:18:15 | 000,000,000 | ---- | M] () -- C:\Users\Lehmann\defogger_reenable
[2012.06.26 07:07:44 | 000,001,651 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2012.06.25 10:28:28 | 270,703,800 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.06.24 16:36:28 | 000,098,924 | ---- | M] () -- C:\Users\Lehmann\Desktop\EinladungKocheltern.pdf
[2012.06.23 22:47:39 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdRapi2_01_00_00.Wdf
[1 C:\Users\Lehmann\Desktop\*.tmp files -> C:\Users\Lehmann\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.15 21:28:26 | 000,624,883 | ---- | C] () -- C:\Users\Lehmann\Desktop\adwcleaner.exe
[2012.07.09 14:54:29 | 000,050,477 | ---- | C] () -- C:\Users\Lehmann\Desktop\Defogger.exe
[2012.07.08 23:57:20 | 000,002,015 | ---- | C] () -- C:\Users\Lehmann\Desktop\Kies Air Discovery Service.lnk
[2012.07.05 13:33:13 | 000,001,175 | ---- | C] () -- C:\Users\Public\Desktop\Wörterbuch.lnk
[2012.07.03 15:27:35 | 000,001,417 | ---- | C] () -- C:\Users\Lehmann\Desktop\Rot12-13_musik - Verknüpfung.lnk
[2012.06.26 07:18:15 | 000,000,000 | ---- | C] () -- C:\Users\Lehmann\defogger_reenable
[2012.06.25 20:39:19 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.24 16:36:27 | 000,098,924 | ---- | C] () -- C:\Users\Lehmann\Desktop\EinladungKocheltern.pdf
[2012.06.23 22:47:39 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdRapi2_01_00_00.Wdf
[2012.06.23 22:46:22 | 000,002,419 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Mobile Device Center.lnk
[2012.06.18 23:23:03 | 001,591,306 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.05.11 13:01:42 | 000,001,200 | ---- | C] () -- C:\Users\Lehmann\.recently-used.xbel
[2012.04.26 15:03:42 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\cd.dat
[2012.03.02 09:26:38 | 000,104,065 | ---- | C] () -- C:\Users\Lehmann\Neues_Dokument_13-image3550-392.png
[2012.01.19 16:08:16 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeepmui.dll
[2012.01.19 16:08:16 | 000,364,544 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeeinpa.dll
[2012.01.19 16:08:16 | 000,344,064 | ---- | C] () -- C:\Windows\SysWow64\lxeecomx.dll
[2012.01.19 16:08:16 | 000,344,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeeiesc.dll
[2012.01.19 16:08:16 | 000,331,776 | ---- | C] () -- C:\Windows\SysWow64\LXEEinst.dll
[2012.01.19 16:08:16 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\lxeeinsr.dll
[2012.01.19 16:08:16 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\lxeejswr.dll
[2012.01.19 16:08:16 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\lxeecur.dll
[2012.01.19 16:08:15 | 000,847,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeeusb1.dll
[2012.01.19 16:08:15 | 000,323,584 | ---- | C] () -- C:\Windows\SysWow64\lxeeins.dll
[2012.01.19 16:08:15 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\lxeeinsb.dll
[2012.01.19 16:08:15 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\lxeecu.dll
[2012.01.19 16:08:15 | 000,090,112 | ---- | C] () -- C:\Windows\SysWow64\lxeecub.dll
[2012.01.19 16:08:14 | 001,048,576 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeeserv.dll
[2012.01.19 16:08:14 | 000,688,128 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeehbn3.dll
[2012.01.19 16:08:14 | 000,598,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeecoms.exe
[2012.01.19 16:08:14 | 000,577,536 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeelmpm.dll
[2012.01.19 16:08:14 | 000,372,736 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeecomm.dll
[2012.01.19 16:08:14 | 000,324,264 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeeih.exe
[2012.01.19 16:08:13 | 000,802,816 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeecomc.dll
[2012.01.19 16:08:13 | 000,373,416 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeecfg.exe
[2012.01.19 16:07:43 | 000,299,008 | ---- | C] () -- C:\Windows\SysWow64\LXEEsm.dll
[2012.01.19 16:07:43 | 000,024,064 | ---- | C] () -- C:\Windows\SysWow64\LXEEsmr.dll
[2012.01.11 14:17:23 | 000,007,597 | ---- | C] () -- C:\Users\Lehmann\AppData\Local\Resmon.ResmonCfg
[2012.01.11 11:32:34 | 000,002,048 | -HS- | C] () -- C:\Users\Lehmann\AppData\Local\{00323ace-4188-97dc-19ab-1f56921a2012}\@
[2011.10.31 12:22:42 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.07.08 22:55:21 | 000,025,717 | ---- | C] () -- C:\Windows\MSUMLT06.INI
[2011.06.07 12:13:38 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.06.07 12:13:38 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.06.07 12:13:38 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.06.07 12:13:38 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.05.13 07:22:21 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2011.05.09 13:15:47 | 000,032,608 | ---- | C] () -- C:\Windows\king-uninstall.exe
[2011.05.08 23:31:50 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.05.08 20:10:25 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.09.11 05:29:21 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\LogonStart.dll
 
========== LOP Check ==========
 
[2012.02.23 23:25:03 | 000,000,000 | ---D | M] -- C:\Users\Holger\AppData\Roaming\BullGuard
[2012.03.23 17:08:05 | 000,000,000 | ---D | M] -- C:\Users\Holger\AppData\Roaming\Opera
[2012.03.23 17:29:55 | 000,000,000 | ---D | M] -- C:\Users\Holger\AppData\Roaming\Orbit
[2012.03.23 17:20:29 | 000,000,000 | ---D | M] -- C:\Users\Holger\AppData\Roaming\ProgSense
[2011.05.10 11:27:42 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Asus WebStorage
[2011.10.10 22:10:24 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\BullGuard
[2011.06.06 21:15:23 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Digiarty
[2011.05.10 11:26:55 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\EeeStorageUploader
[2011.05.17 07:46:35 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\GrabPro
[2011.06.06 21:14:15 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Gutscheinmieze
[2012.01.06 00:58:07 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\inkscape
[2011.05.08 22:14:07 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Lehmann
[2012.01.16 19:56:46 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Opera
[2012.07.16 14:55:26 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Orbit
[2011.12.17 21:04:26 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\PC Suite
[2011.05.08 18:57:08 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\ProgSense
[2012.03.03 19:38:48 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Samsung
[2011.10.09 17:26:31 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Software Inspection Library
[2012.06.24 10:19:32 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\temp
[2011.05.08 22:28:37 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent
[2012.07.15 23:15:00 | 000,001,124 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001Core.job
[2012.07.16 14:15:01 | 000,001,146 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001UA.job
[2012.07.12 22:13:23 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.03.08 15:16:11 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Adobe
[2011.05.08 20:13:45 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\AOL
[2011.05.08 22:02:50 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Apple Computer
[2011.05.10 11:27:42 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Asus WebStorage
[2012.03.23 17:43:13 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Avira
[2011.10.10 22:10:24 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\BullGuard
[2011.06.06 21:15:23 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Digiarty
[2011.06.07 07:35:15 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\DivX
[2011.05.10 11:26:55 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\EeeStorageUploader
[2011.05.17 07:46:35 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\GrabPro
[2011.06.06 21:14:15 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Gutscheinmieze
[2011.05.08 10:55:36 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Identities
[2012.01.06 00:58:07 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\inkscape
[2011.05.08 22:14:07 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Lehmann
[2011.05.08 11:32:58 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Macromedia
[2012.06.25 20:40:07 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Malwarebytes
[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Media Center Programs
[2012.06.23 22:48:16 | 000,000,000 | --SD | M] -- C:\Users\Lehmann\AppData\Roaming\Microsoft
[2011.05.08 20:10:25 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Mozilla
[2012.01.16 19:56:46 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Opera
[2012.07.16 14:55:26 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Orbit
[2011.12.17 21:04:26 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\PC Suite
[2011.05.08 18:57:08 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\ProgSense
[2012.03.03 19:38:48 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Samsung
[2012.03.29 10:57:46 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Skype
[2011.12.26 13:15:55 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\skypePM
[2011.10.09 17:26:31 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Software Inspection Library
[2012.06.24 10:19:32 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\temp
[2011.05.08 22:28:37 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent
[2012.07.05 19:05:05 | 000,000,000 | ---D | M] -- C:\Users\Lehmann\AppData\Roaming\vlc
 
< %APPDATA%\*.exe /s >
[2011.05.10 11:26:50 | 000,087,376 | ---- | M] (eCareme Technologies, Inc.) -- C:\Users\Lehmann\AppData\Roaming\Asus WebStorage\EeeStorageUpdate.EXE
[2011.05.10 11:27:21 | 014,462,264 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Asus WebStorage\Update\ASUSWebStorage3.0.84.161.exe
[2011.06.28 07:32:22 | 081,122,288 | ---- | M] (Samsung Electronics Co., Ltd.                                ) -- C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Templates\SamsungKiesSetup.exe
[2012.06.08 13:02:02 | 000,958,392 | ---- | M] (Samsung) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\Kies.exe
[2012.06.08 13:02:04 | 000,278,968 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\KiesDriverInstaller.exe
[2012.05.24 03:51:18 | 000,318,976 | ---- | M] (Samsung) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\KiesLogger.exe
[2012.06.08 13:02:02 | 003,521,464 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\KiesTrayAgent.exe
[2012.05.24 03:50:32 | 000,180,224 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\External\DeviceModules\ConnectionManager.exe
[2012.05.24 03:50:32 | 000,321,024 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\External\DeviceModules\DeviceDataService.exe
[2012.05.30 02:49:14 | 000,721,920 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\External\DeviceModules\DeviceManager.exe
[2012.06.08 13:02:06 | 000,067,512 | ---- | M] (Samsung) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\External\DeviceModules\Kies_Tutorial.exe
[2012.05.24 03:50:18 | 000,106,960 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\External\FirmwareUpdate\AgentInstaller.exe
[2012.05.24 03:50:18 | 000,101,328 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\External\FirmwareUpdate\AgentUpdate.exe
[2012.06.08 13:02:10 | 000,183,736 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\External\FirmwareUpdate\BinaryLoaderMgr.exe
[2012.06.08 13:02:10 | 000,021,432 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\External\FirmwareUpdate\KiesPDLR.exe
[2012.06.08 13:02:12 | 003,570,352 | ---- | M] (Freeware) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\External\MediaModules\MyFreeCodecPack.exe
[2011.10.31 12:22:52 | 000,221,184 | ---- | M] (ENJsoft corp.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\External\TransModules\SelfMV.exe
[2011.10.31 12:22:54 | 000,061,440 | ---- | M] (ENJsoft corp.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\External\TransModules\SelfMV2.exe
[2012.05.24 03:49:28 | 024,162,120 | ---- | M] (SAMSUNG Electronics Co., Ltd.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Backup\USB Driver\SAMSUNG_USB_Driver_for_Mobile_Phones.exe
[2012.07.03 08:16:26 | 000,975,288 | ---- | M] (Samsung) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\Kies.exe
[2012.07.03 08:16:28 | 000,278,968 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\KiesDriverInstaller.exe
[2012.06.26 09:04:30 | 000,320,000 | ---- | M] (Samsung) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\KiesLogger.exe
[2012.07.03 08:16:26 | 003,524,536 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\KiesTrayAgent.exe
[2012.06.26 09:03:34 | 000,182,784 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\External\DeviceModules\ConnectionManager.exe
[2012.06.26 09:03:34 | 000,321,536 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\External\DeviceModules\DeviceDataService.exe
[2012.06.26 09:03:38 | 000,716,800 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\External\DeviceModules\DeviceManager.exe
[2012.07.03 08:16:32 | 000,067,512 | ---- | M] (Samsung) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\External\DeviceModules\Kies_Tutorial.exe
[2012.06.26 09:03:16 | 000,106,960 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\External\FirmwareUpdate\AgentInstaller.exe
[2012.06.26 09:03:16 | 000,101,328 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\External\FirmwareUpdate\AgentUpdate.exe
[2012.07.03 08:16:34 | 000,183,736 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\External\FirmwareUpdate\BinaryLoaderMgr.exe
[2012.07.03 08:16:36 | 000,021,432 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\External\FirmwareUpdate\KiesPDLR.exe
[2012.07.03 08:16:36 | 003,742,648 | ---- | M] (Freeware) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\External\MediaModules\MyFreeCodecPack.exe
[2012.06.26 09:03:02 | 000,262,144 | ---- | M] (ENJsoft corp.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\External\TransModules\SelfMV.exe
[2012.06.26 09:03:04 | 000,090,112 | ---- | M] (ENJsoft corp.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\External\TransModules\SelfMV2.exe
[2012.06.26 09:02:34 | 024,164,152 | ---- | M] (SAMSUNG Electronics Co., Ltd.) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Sub\USB Driver\SAMSUNG_USB_Driver_for_Mobile_Phones.exe
[2012.06.08 13:02:14 | 000,371,128 | ---- | M] (ml) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Temp\Kies.Update.exe
[2012.07.03 08:16:38 | 000,450,488 | ---- | M] (ml) -- C:\Users\Lehmann\AppData\Roaming\Samsung\Kies\UpdateTemp\Updater\Kies.Update.exe
[2009.01.14 11:09:12 | 000,158,152 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent\BackUp\Del_CD_ROM.exe
[2009.03.03 12:44:48 | 000,030,160 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent\BackUp\InstallWTGService.exe
[2009.03.03 12:44:58 | 000,367,056 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent\BackUp\OSU.exe
[2009.03.03 12:45:08 | 000,693,712 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent\BackUp\Setup.exe
[2009.03.03 12:45:05 | 001,091,024 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent\BackUp\Uninstaller.exe
[2009.03.03 12:44:52 | 007,009,744 | ---- | M] (WebToGo Mobile Internet GmbH) -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent\BackUp\Verbindungsassistent.exe
[2009.03.04 08:34:41 | 000,468,432 | ---- | M] (WebToGo Mobiles Internet GmbH) -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent\BackUp\Verbindungsassistent_SMSMMS.exe
[2009.03.03 12:45:11 | 000,296,400 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent\BackUp\WTGService.exe
[2009.03.03 12:45:15 | 000,243,152 | ---- | M] () -- C:\Users\Lehmann\AppData\Roaming\Verbindungsassistent\BackUp\WTGVistaUtil.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\erdnt\cache64\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\erdnt\cache86\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\erdnt\cache64\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\erdnt\cache64\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\erdnt\cache86\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2010.04.27 21:56:03 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=3EBA5767211C34923584AAB02E7C1A20 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WIN7\SATA_IDE\NVSTOR32.SYS
[2010.04.27 21:56:03 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=3EBA5767211C34923584AAB02E7C1A20 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WINVISTA\SATA_IDE\NVSTOR32.SYS
[2010.04.08 20:32:55 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=8C98D67A228B7C4476656B80633CD485 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WIN7\SATARAID\NVSTOR32.SYS
[2010.04.08 20:32:55 | 000,215,656 | ---- | M] (NVIDIA Corporation) MD5=8C98D67A228B7C4476656B80633CD485 -- C:\eSupport\eDriver\Software\Chipset\NVIDIA\MCP_SERIES\WIN7_32_5.1.2600.171\IDE\WINVISTA\SATARAID\NVSTOR32.SYS
 
< MD5 for: SCECLI.DLL  >
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\erdnt\cache86\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\erdnt\cache64\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\erdnt\cache86\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\erdnt\cache64\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\erdnt\cache86\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\erdnt\cache64\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\erdnt\cache64\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\erdnt\cache86\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\erdnt\cache64\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >

< End of report >

cosinus 16.07.2012 16:36
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "http://search.orbitdownloader.com"
FF - user.js - File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\S-1-5-21-2509907102-1040732608-2463916187-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

murmeltiermu 16.07.2012 20:13
Code:
All processes killed
========== OTL ==========
Prefs.js: false removed from browser.search.update
Prefs.js: "hxxp://search.orbitdownloader.com" removed from browser.startup.homepage
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-2509907102-1040732608-2463916187-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2509907102-1040732608-2463916187-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2509907102-1040732608-2463916187-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Holger
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Lehmann
->Temp folder emptied: 110381768 bytes
->Temporary Internet Files folder emptied: 225167073 bytes
->Java cache emptied: 312371 bytes
->FireFox cache emptied: 56580226 bytes
->Opera cache emptied: 50843981 bytes
->Flash cache emptied: 14547 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 763717566 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 49554 bytes
RecycleBin emptied: 4187807 bytes
 
Total Files Cleaned = 1.155,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Holger
->Flash cache emptied: 0 bytes
 
User: Lehmann
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.53.0 log created on 07162012_210739

Files\Folders moved on Reboot...
C:\Users\Lehmann\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\Lehmann\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...

cosinus 17.07.2012 11:00
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

murmeltiermu 17.07.2012 12:36
Code:
13:15:51.0895 4636        TDSS rootkit removing tool 2.7.46.0 Jul 16 2012 22:10:11
13:15:51.0957 4636        ============================================================
13:15:51.0957 4636        Current date / time: 2012/07/17 13:15:51.0957
13:15:51.0957 4636        SystemInfo:
13:15:51.0957 4636       
13:15:51.0957 4636        OS Version: 6.1.7601 ServicePack: 1.0
13:15:51.0957 4636        Product type: Workstation
13:15:51.0957 4636        ComputerName: LEHMANN-PC
13:15:51.0973 4636        UserName: Lehmann
13:15:51.0973 4636        Windows directory: C:\Windows
13:15:51.0973 4636        System windows directory: C:\Windows
13:15:51.0973 4636        Running under WOW64
13:15:51.0973 4636        Processor architecture: Intel x64
13:15:51.0973 4636        Number of processors: 2
13:15:51.0973 4636        Page size: 0x1000
13:15:51.0973 4636        Boot type: Normal boot
13:15:51.0973 4636        ============================================================
13:15:53.0352 4636        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:15:53.0362 4636        ============================================================
13:15:53.0362 4636        \Device\Harddisk0\DR0:
13:15:53.0362 4636        MBR partitions:
13:15:53.0362 4636        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x2711676, BlocksNum 0x950A408
13:15:53.0374 4636        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xBC1C800, BlocksNum 0x19811800
13:15:53.0374 4636        ============================================================
13:15:53.0397 4636        C: <-> \Device\Harddisk0\DR0\Partition0
13:15:53.0427 4636        D: <-> \Device\Harddisk0\DR0\Partition1
13:15:53.0427 4636        ============================================================
13:15:53.0427 4636        Initialize success
13:15:53.0427 4636        ============================================================
13:17:58.0652 2208        ============================================================
13:17:58.0652 2208        Scan started
13:17:58.0652 2208        Mode: Manual; SigCheck; TDLFS;
13:17:58.0652 2208        ============================================================
13:17:59.0588 2208        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
13:17:59.0728 2208        1394ohci - ok
13:17:59.0775 2208        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
13:17:59.0806 2208        ACPI - ok
13:17:59.0853 2208        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
13:17:59.0962 2208        AcpiPmi - ok
13:18:00.0087 2208        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
13:18:00.0118 2208        AdobeARMservice - ok
13:18:00.0180 2208        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
13:18:00.0227 2208        adp94xx - ok
13:18:00.0274 2208        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
13:18:00.0321 2208        adpahci - ok
13:18:00.0336 2208        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
13:18:00.0368 2208        adpu320 - ok
13:18:00.0399 2208        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
13:18:00.0539 2208        AeLookupSvc - ok
13:18:00.0633 2208        AFBAgent        (fb2be0bae9b3f248080cdbf91ef16c7f) C:\Windows\system32\FBAgent.exe
13:18:00.0758 2208        AFBAgent - ok
13:18:00.0820 2208        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
13:18:00.0898 2208        AFD - ok
13:18:00.0929 2208        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
13:18:00.0960 2208        agp440 - ok
13:18:00.0992 2208        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
13:18:01.0070 2208        ALG - ok
13:18:01.0101 2208        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
13:18:01.0132 2208        aliide - ok
13:18:01.0132 2208        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
13:18:01.0163 2208        amdide - ok
13:18:01.0210 2208        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
13:18:01.0257 2208        AmdK8 - ok
13:18:01.0272 2208        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
13:18:01.0335 2208        AmdPPM - ok
13:18:01.0382 2208        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
13:18:01.0413 2208        amdsata - ok
13:18:01.0522 2208        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
13:18:01.0569 2208        amdsbs - ok
13:18:01.0647 2208        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
13:18:01.0662 2208        amdxata - ok
13:18:01.0725 2208        AmUStor        (9c7f164b49cadc658d1b3c575782f346) C:\Windows\system32\drivers\AmUStor.SYS
13:18:01.0787 2208        AmUStor - ok
13:18:01.0881 2208        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
13:18:01.0928 2208        AntiVirSchedulerService - ok
13:18:01.0974 2208        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
13:18:01.0990 2208        AntiVirService - ok
13:18:02.0099 2208        AOL ACS        (85180cf88c5ebad73b452a43a004ca51) C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe
13:18:02.0115 2208        AOL ACS - ok
13:18:02.0162 2208        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
13:18:02.0349 2208        AppID - ok
13:18:02.0380 2208        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
13:18:02.0474 2208        AppIDSvc - ok
13:18:02.0520 2208        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
13:18:02.0598 2208        Appinfo - ok
13:18:02.0676 2208        Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
13:18:02.0692 2208        Apple Mobile Device - ok
13:18:02.0754 2208        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
13:18:02.0770 2208        arc - ok
13:18:02.0801 2208        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
13:18:02.0817 2208        arcsas - ok
13:18:02.0879 2208        ASLDRService    (18e5c2f937f9deb8c282df66a3761925) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
13:18:02.0895 2208        ASLDRService - ok
13:18:02.0926 2208        ASMMAP64        (4c016fd76ed5c05e84ca8cab77993961) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys
13:18:02.0942 2208        ASMMAP64 - ok
13:18:03.0082 2208        aspnet_state    (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
13:18:03.0098 2208        aspnet_state - ok
13:18:03.0129 2208        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
13:18:03.0222 2208        AsyncMac - ok
13:18:03.0269 2208        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
13:18:03.0285 2208        atapi - ok
13:18:03.0441 2208        athr            (a5e770426d18f8ef332a593f3289da91) C:\Windows\system32\DRIVERS\athrx.sys
13:18:03.0612 2208        athr - ok
13:18:03.0659 2208        ATKGFNEXSrv    (63f1212ffe13e62ca1e8d8ee19abd9a7) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
13:18:03.0690 2208        ATKGFNEXSrv - ok
13:18:03.0815 2208        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
13:18:03.0924 2208        AudioEndpointBuilder - ok
13:18:03.0940 2208        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
13:18:04.0018 2208        AudioSrv - ok
13:18:04.0096 2208        avgntflt        (26e38b5a58c6c55fafbc563eeddb0867) C:\Windows\system32\DRIVERS\avgntflt.sys
13:18:04.0127 2208        avgntflt - ok
13:18:04.0158 2208        avipbb          (9d1f00beff84cbbf46d7f052bc7e0565) C:\Windows\system32\DRIVERS\avipbb.sys
13:18:04.0174 2208        avipbb - ok
13:18:04.0190 2208        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys
13:18:04.0205 2208        avkmgr - ok
13:18:04.0268 2208        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
13:18:04.0314 2208        AxInstSV - ok
13:18:04.0377 2208        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
13:18:04.0455 2208        b06bdrv - ok
13:18:04.0502 2208        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
13:18:04.0564 2208        b57nd60a - ok
13:18:04.0673 2208        BBSvc          (01a24b415926bb5f772dbe12459d97de) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
13:18:04.0704 2208        BBSvc - ok
13:18:04.0751 2208        BBUpdate        (785de7abda13309d6065305542829e76) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
13:18:04.0782 2208        BBUpdate - ok
13:18:04.0814 2208        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
13:18:04.0860 2208        BDESVC - ok
13:18:04.0907 2208        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
13:18:04.0985 2208        Beep - ok
13:18:05.0048 2208        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
13:18:05.0172 2208        BFE - ok
13:18:05.0235 2208        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\system32\qmgr.dll
13:18:05.0360 2208        BITS - ok
13:18:05.0422 2208        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
13:18:05.0469 2208        blbdrive - ok
13:18:05.0578 2208        Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe
13:18:05.0625 2208        Bonjour Service - ok
13:18:05.0672 2208        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
13:18:05.0718 2208        bowser - ok
13:18:05.0734 2208        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
13:18:05.0781 2208        BrFiltLo - ok
13:18:05.0812 2208        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
13:18:05.0843 2208        BrFiltUp - ok
13:18:05.0890 2208        BridgeMP        (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys
13:18:05.0984 2208        BridgeMP - ok
13:18:06.0015 2208        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
13:18:06.0108 2208        Browser - ok
13:18:06.0155 2208        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
13:18:06.0249 2208        Brserid - ok
13:18:06.0264 2208        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
13:18:06.0311 2208        BrSerWdm - ok
13:18:06.0358 2208        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
13:18:06.0405 2208        BrUsbMdm - ok
13:18:06.0405 2208        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
13:18:06.0436 2208        BrUsbSer - ok
13:18:06.0467 2208        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
13:18:06.0514 2208        BTHMODEM - ok
13:18:06.0561 2208        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
13:18:06.0654 2208        bthserv - ok
13:18:06.0686 2208        catchme - ok
13:18:06.0717 2208        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
13:18:06.0810 2208        cdfs - ok
13:18:06.0857 2208        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
13:18:06.0888 2208        cdrom - ok
13:18:06.0920 2208        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
13:18:07.0013 2208        CertPropSvc - ok
13:18:07.0060 2208        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
13:18:07.0091 2208        circlass - ok
13:18:07.0138 2208        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
13:18:07.0185 2208        CLFS - ok
13:18:07.0247 2208        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
13:18:07.0263 2208        clr_optimization_v2.0.50727_32 - ok
13:18:07.0310 2208        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
13:18:07.0341 2208        clr_optimization_v2.0.50727_64 - ok
13:18:07.0434 2208        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
13:18:07.0466 2208        clr_optimization_v4.0.30319_32 - ok
13:18:07.0512 2208        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
13:18:07.0528 2208        clr_optimization_v4.0.30319_64 - ok
13:18:07.0575 2208        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
13:18:07.0606 2208        CmBatt - ok
13:18:07.0637 2208        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
13:18:07.0653 2208        cmdide - ok
13:18:07.0700 2208        CNG            (9ac4f97c2d3e93367e2148ea940cd2cd) C:\Windows\system32\Drivers\cng.sys
13:18:07.0778 2208        CNG - ok
13:18:07.0809 2208        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
13:18:07.0840 2208        Compbatt - ok
13:18:07.0871 2208        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
13:18:07.0918 2208        CompositeBus - ok
13:18:07.0934 2208        COMSysApp - ok
13:18:07.0965 2208        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
13:18:07.0980 2208        crcdisk - ok
13:18:08.0027 2208        CryptSvc        (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
13:18:08.0090 2208        CryptSvc - ok
13:18:08.0136 2208        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
13:18:08.0230 2208        DcomLaunch - ok
13:18:08.0277 2208        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
13:18:08.0355 2208        defragsvc - ok
13:18:08.0402 2208        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
13:18:08.0495 2208        DfsC - ok
13:18:08.0542 2208        dgderdrv        (ffccd922f305b8cfba8d99f65e35edd7) C:\Windows\system32\drivers\dgderdrv.sys
13:18:08.0558 2208        dgderdrv - ok
13:18:08.0604 2208        dg_ssudbus      (6060106ce00f32f63f1a73160e46e9d2) C:\Windows\system32\DRIVERS\ssudbus.sys
13:18:08.0620 2208        dg_ssudbus - ok
13:18:08.0682 2208        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
13:18:08.0792 2208        Dhcp - ok
13:18:08.0823 2208        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
13:18:08.0916 2208        discache - ok
13:18:08.0948 2208        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
13:18:08.0963 2208        Disk - ok
13:18:08.0994 2208        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
13:18:09.0072 2208        Dnscache - ok
13:18:09.0119 2208        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
13:18:09.0197 2208        dot3svc - ok
13:18:09.0228 2208        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
13:18:09.0322 2208        DPS - ok
13:18:09.0369 2208        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
13:18:09.0416 2208        drmkaud - ok
13:18:09.0494 2208        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
13:18:09.0556 2208        DXGKrnl - ok
13:18:09.0603 2208        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
13:18:09.0681 2208        EapHost - ok
13:18:09.0868 2208        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
13:18:10.0040 2208        ebdrv - ok
13:18:10.0133 2208        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
13:18:10.0180 2208        EFS - ok
13:18:10.0258 2208        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
13:18:10.0352 2208        ehRecvr - ok
13:18:10.0383 2208        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
13:18:10.0430 2208        ehSched - ok
13:18:10.0508 2208        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
13:18:10.0570 2208        elxstor - ok
13:18:10.0586 2208        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
13:18:10.0632 2208        ErrDev - ok
13:18:10.0679 2208        ETD            (3c38648375b7f3988691f53a7aae10a9) C:\Windows\system32\DRIVERS\ETD.sys
13:18:10.0726 2208        ETD - ok
13:18:10.0773 2208        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
13:18:10.0882 2208        EventSystem - ok
13:18:10.0929 2208        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
13:18:11.0007 2208        exfat - ok
13:18:11.0054 2208        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
13:18:11.0132 2208        fastfat - ok
13:18:11.0210 2208        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
13:18:11.0303 2208        Fax - ok
13:18:11.0334 2208        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
13:18:11.0381 2208        fdc - ok
13:18:11.0412 2208        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
13:18:11.0475 2208        fdPHost - ok
13:18:11.0506 2208        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
13:18:11.0584 2208        FDResPub - ok
13:18:11.0615 2208        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
13:18:11.0646 2208        FileInfo - ok
13:18:11.0662 2208        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
13:18:11.0740 2208        Filetrace - ok
13:18:11.0771 2208        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
13:18:11.0818 2208        flpydisk - ok
13:18:11.0865 2208        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
13:18:11.0896 2208        FltMgr - ok
13:18:11.0990 2208        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
13:18:12.0099 2208        FontCache - ok
13:18:12.0192 2208        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
13:18:12.0208 2208        FontCache3.0.0.0 - ok
13:18:12.0239 2208        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
13:18:12.0270 2208        FsDepends - ok
13:18:12.0302 2208        fssfltr        (5814011b2f6e088e29d689b5fcd49b8f) C:\Windows\system32\DRIVERS\fssfltr.sys
13:18:12.0333 2208        fssfltr - ok
13:18:12.0411 2208        fsssvc          (f6717211c1ec2cddaa81b97b0727c2e9) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
13:18:12.0458 2208        fsssvc - ok
13:18:12.0473 2208        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
13:18:12.0504 2208        Fs_Rec - ok
13:18:12.0551 2208        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
13:18:12.0582 2208        fvevol - ok
13:18:12.0614 2208        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
13:18:12.0645 2208        gagp30kx - ok
13:18:12.0692 2208        GEARAspiWDM    (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
13:18:12.0707 2208        GEARAspiWDM - ok
13:18:12.0770 2208        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
13:18:12.0879 2208        gpsvc - ok
13:18:12.0957 2208        gupdate        (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
13:18:12.0988 2208        gupdate - ok
13:18:13.0004 2208        gupdatem        (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
13:18:13.0019 2208        gupdatem - ok
13:18:13.0050 2208        gusvc          (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
13:18:13.0066 2208        gusvc - ok
13:18:13.0082 2208        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
13:18:13.0128 2208        hcw85cir - ok
13:18:13.0191 2208        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
13:18:13.0253 2208        HdAudAddService - ok
13:18:13.0284 2208        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
13:18:13.0331 2208        HDAudBus - ok
13:18:13.0362 2208        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
13:18:13.0409 2208        HidBatt - ok
13:18:13.0425 2208        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
13:18:13.0472 2208        HidBth - ok
13:18:13.0503 2208        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
13:18:13.0550 2208        HidIr - ok
13:18:13.0581 2208        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\System32\hidserv.dll
13:18:13.0659 2208        hidserv - ok
13:18:13.0690 2208        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
13:18:13.0721 2208        HidUsb - ok
13:18:13.0752 2208        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
13:18:13.0830 2208        hkmsvc - ok
13:18:13.0877 2208        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
13:18:13.0940 2208        HomeGroupListener - ok
13:18:13.0971 2208        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
13:18:14.0018 2208        HomeGroupProvider - ok
13:18:14.0049 2208        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
13:18:14.0064 2208        HpSAMD - ok
13:18:14.0189 2208        hshld          (b7cfe93627e7796624004687125a729f) C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
13:18:14.0220 2208        hshld - ok
13:18:14.0252 2208        HssDrv          (a60c877e1cd3aa2e4e5ccd8af305c0f1) C:\Windows\system32\DRIVERS\HssDrv.sys
13:18:14.0283 2208        HssDrv - ok
13:18:14.0330 2208        HssSrv          (2cfea9c337b699aca38487e8a7438f35) C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
13:18:14.0361 2208        HssSrv - ok
13:18:14.0392 2208        HssTrayService  (b3c6eeeff5c5ea3235b7d84317c1fb3f) C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE
13:18:14.0408 2208        HssTrayService - ok
13:18:14.0423 2208        HssWd - ok
13:18:14.0486 2208        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
13:18:14.0595 2208        HTTP - ok
13:18:14.0642 2208        hwdatacard      (cdaa8e257bb625b2387219e605dde37d) C:\Windows\system32\DRIVERS\ewusbmdm.sys
13:18:14.0704 2208        hwdatacard - ok
13:18:14.0720 2208        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
13:18:14.0751 2208        hwpolicy - ok
13:18:14.0782 2208        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
13:18:14.0813 2208        i8042prt - ok
13:18:14.0860 2208        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
13:18:14.0907 2208        iaStorV - ok
13:18:15.0047 2208        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
13:18:15.0110 2208        idsvc - ok
13:18:15.0125 2208        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
13:18:15.0156 2208        iirsp - ok
13:18:15.0219 2208        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
13:18:15.0344 2208        IKEEXT - ok
13:18:15.0484 2208        IntcAzAudAddService (181e4ff75674a7105ecd0a02c35ef43a) C:\Windows\system32\drivers\RTKVHD64.sys
13:18:15.0609 2208        IntcAzAudAddService - ok
13:18:15.0718 2208        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
13:18:15.0734 2208        intelide - ok
13:18:15.0780 2208        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
13:18:15.0827 2208        intelppm - ok
13:18:15.0858 2208        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
13:18:15.0921 2208        IPBusEnum - ok
13:18:15.0952 2208        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
13:18:16.0030 2208        IpFilterDriver - ok
13:18:16.0092 2208        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
13:18:16.0186 2208        iphlpsvc - ok
13:18:16.0217 2208        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
13:18:16.0264 2208        IPMIDRV - ok
13:18:16.0295 2208        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
13:18:16.0389 2208        IPNAT - ok
13:18:16.0498 2208        iPod Service    (ee4c2a137c7088911a8919effc9812e7) C:\Program Files\iPod\bin\iPodService.exe
13:18:16.0560 2208        iPod Service - ok
13:18:16.0592 2208        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
13:18:16.0638 2208        IRENUM - ok
13:18:16.0654 2208        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
13:18:16.0685 2208        isapnp - ok
13:18:16.0716 2208        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
13:18:16.0763 2208        iScsiPrt - ok
13:18:16.0794 2208        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
13:18:16.0810 2208        kbdclass - ok
13:18:16.0857 2208        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
13:18:16.0888 2208        kbdhid - ok
13:18:16.0935 2208        kbfiltr        (e63ef8c3271d014f14e2469ce75fecb4) C:\Windows\system32\DRIVERS\kbfiltr.sys
13:18:16.0950 2208        kbfiltr - ok
13:18:16.0982 2208        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
13:18:17.0013 2208        KeyIso - ok
13:18:17.0044 2208        KSecDD          (97a7070aea4c058b6418519e869a63b4) C:\Windows\system32\Drivers\ksecdd.sys
13:18:17.0075 2208        KSecDD - ok
13:18:17.0106 2208        KSecPkg        (26c43a7c2862447ec59deda188d1da07) C:\Windows\system32\Drivers\ksecpkg.sys
13:18:17.0122 2208        KSecPkg - ok
13:18:17.0169 2208        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
13:18:17.0247 2208        ksthunk - ok
13:18:17.0294 2208        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
13:18:17.0387 2208        KtmRm - ok
13:18:17.0450 2208        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\System32\srvsvc.dll
13:18:17.0528 2208        LanmanServer - ok
13:18:17.0574 2208        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
13:18:17.0652 2208        LanmanWorkstation - ok
13:18:17.0715 2208        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
13:18:17.0793 2208        lltdio - ok
13:18:17.0840 2208        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
13:18:17.0933 2208        lltdsvc - ok
13:18:17.0964 2208        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
13:18:18.0042 2208        lmhosts - ok
13:18:18.0105 2208        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
13:18:18.0136 2208        LSI_FC - ok
13:18:18.0167 2208        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
13:18:18.0198 2208        LSI_SAS - ok
13:18:18.0214 2208        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
13:18:18.0230 2208        LSI_SAS2 - ok
13:18:18.0245 2208        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
13:18:18.0276 2208        LSI_SCSI - ok
13:18:18.0308 2208        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
13:18:18.0386 2208        luafv - ok
13:18:18.0495 2208        lxeeCATSCustConnectService (60b3548ffa9a2eaaed75e9f0704dfce0) C:\Windows\system32\spool\DRIVERS\x64\3\\lxeeserv.exe
13:18:18.0542 2208        lxeeCATSCustConnectService - ok
13:18:18.0573 2208        lxee_device - ok
13:18:18.0620 2208        MBAMProtector  (dc8490812a3b72811ae534f423b4c206) C:\Windows\system32\drivers\mbam.sys
13:18:18.0651 2208        MBAMProtector - ok
13:18:18.0744 2208        MBAMService    (43683e970f008c93c9429ef428147a54) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
13:18:18.0807 2208        MBAMService - ok
13:18:18.0838 2208        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
13:18:18.0869 2208        Mcx2Svc - ok
13:18:18.0900 2208        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
13:18:18.0916 2208        megasas - ok
13:18:18.0947 2208        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
13:18:18.0994 2208        MegaSR - ok
13:18:19.0025 2208        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
13:18:19.0119 2208        MMCSS - ok
13:18:19.0134 2208        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
13:18:19.0212 2208        Modem - ok
13:18:19.0244 2208        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
13:18:19.0290 2208        monitor - ok
13:18:19.0322 2208        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
13:18:19.0353 2208        mouclass - ok
13:18:19.0400 2208        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
13:18:19.0431 2208        mouhid - ok
13:18:19.0462 2208        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
13:18:19.0493 2208        mountmgr - ok
13:18:19.0524 2208        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
13:18:19.0556 2208        mpio - ok
13:18:19.0571 2208        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
13:18:19.0649 2208        mpsdrv - ok
13:18:19.0712 2208        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
13:18:19.0805 2208        MpsSvc - ok
13:18:19.0836 2208        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
13:18:19.0899 2208        MRxDAV - ok
13:18:19.0930 2208        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
13:18:19.0992 2208        mrxsmb - ok
13:18:20.0039 2208        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
13:18:20.0086 2208        mrxsmb10 - ok
13:18:20.0133 2208        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
13:18:20.0164 2208        mrxsmb20 - ok
13:18:20.0195 2208        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
13:18:20.0226 2208        msahci - ok
13:18:20.0258 2208        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
13:18:20.0273 2208        msdsm - ok
13:18:20.0320 2208        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
13:18:20.0382 2208        MSDTC - ok
13:18:20.0429 2208        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
13:18:20.0507 2208        Msfs - ok
13:18:20.0538 2208        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
13:18:20.0616 2208        mshidkmdf - ok
13:18:20.0648 2208        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
13:18:20.0663 2208        msisadrv - ok
13:18:20.0726 2208        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
13:18:20.0788 2208        MSiSCSI - ok
13:18:20.0804 2208        msiserver - ok
13:18:20.0835 2208        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
13:18:20.0897 2208        MSKSSRV - ok
13:18:20.0913 2208        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
13:18:20.0991 2208        MSPCLOCK - ok
13:18:21.0006 2208        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
13:18:21.0100 2208        MSPQM - ok
13:18:21.0147 2208        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
13:18:21.0194 2208        MsRPC - ok
13:18:21.0225 2208        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
13:18:21.0240 2208        mssmbios - ok
13:18:21.0272 2208        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
13:18:21.0350 2208        MSTEE - ok
13:18:21.0381 2208        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
13:18:21.0428 2208        MTConfig - ok
13:18:21.0443 2208        MTsensor        (032d35c996f21d19a205a7c8f0b76f3c) C:\Windows\system32\DRIVERS\ATK64AMD.sys
13:18:21.0459 2208        MTsensor - ok
13:18:21.0474 2208        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
13:18:21.0506 2208        Mup - ok
13:18:21.0537 2208        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
13:18:21.0646 2208        napagent - ok
13:18:21.0708 2208        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
13:18:21.0771 2208        NativeWifiP - ok
13:18:21.0864 2208        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
13:18:21.0927 2208        NDIS - ok
13:18:21.0958 2208        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
13:18:22.0036 2208        NdisCap - ok
13:18:22.0067 2208        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
13:18:22.0161 2208        NdisTapi - ok
13:18:22.0192 2208        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
13:18:22.0270 2208        Ndisuio - ok
13:18:22.0301 2208        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
13:18:22.0395 2208        NdisWan - ok
13:18:22.0426 2208        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
13:18:22.0488 2208        NDProxy - ok
13:18:22.0504 2208        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
13:18:22.0598 2208        NetBIOS - ok
13:18:22.0644 2208        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
13:18:22.0722 2208        NetBT - ok
13:18:22.0738 2208        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
13:18:22.0769 2208        Netlogon - ok
13:18:22.0832 2208        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
13:18:22.0925 2208        Netman - ok
13:18:23.0050 2208        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:18:23.0066 2208        NetMsmqActivator - ok
13:18:23.0081 2208        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:18:23.0097 2208        NetPipeActivator - ok
13:18:23.0144 2208        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
13:18:23.0253 2208        netprofm - ok
13:18:23.0268 2208        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:18:23.0284 2208        NetTcpActivator - ok
13:18:23.0300 2208        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:18:23.0315 2208        NetTcpPortSharing - ok
13:18:23.0378 2208        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
13:18:23.0409 2208        nfrd960 - ok
13:18:23.0456 2208        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
13:18:23.0534 2208        NlaSvc - ok
13:18:23.0549 2208        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
13:18:23.0627 2208        Npfs - ok
13:18:23.0643 2208        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
13:18:23.0721 2208        nsi - ok
13:18:23.0752 2208        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
13:18:23.0830 2208        nsiproxy - ok
13:18:23.0939 2208        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
13:18:24.0033 2208        Ntfs - ok
13:18:24.0158 2208        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
13:18:24.0236 2208        Null - ok
13:18:24.0282 2208        NVHDA          (ad37248bd442d41c9a896e53eb8a85ee) C:\Windows\system32\drivers\nvhda64v.sys
13:18:24.0314 2208        NVHDA - ok
13:18:24.0844 2208        nvlddmkm        (bc2d2480f58c3bc7f03c1e36a8ad4bf9) C:\Windows\system32\DRIVERS\nvlddmkm.sys
13:18:25.0328 2208        nvlddmkm - ok
13:18:25.0468 2208        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
13:18:25.0499 2208        nvraid - ok
13:18:25.0546 2208        nvsmu          (e58d81fb8616d0cb55c1e36aa0b213c9) C:\Windows\system32\DRIVERS\nvsmu.sys
13:18:25.0562 2208        nvsmu - ok
13:18:25.0577 2208        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
13:18:25.0608 2208        nvstor - ok
13:18:25.0640 2208        nvstor64        (b253bb1adeb4004fdb1b640750eb2b4e) C:\Windows\system32\DRIVERS\nvstor64.sys
13:18:25.0655 2208        nvstor64 - ok
13:18:25.0718 2208        nvsvc          (d900eee33edf655872cba55adae0201a) C:\Windows\system32\nvvsvc.exe
13:18:25.0749 2208        nvsvc - ok
13:18:25.0796 2208        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
13:18:25.0827 2208        nv_agp - ok
13:18:25.0842 2208        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
13:18:25.0874 2208        ohci1394 - ok
13:18:25.0967 2208        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
13:18:25.0983 2208        ose - ok
13:18:26.0279 2208        osppsvc        (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
13:18:26.0498 2208        osppsvc - ok
13:18:26.0607 2208        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
13:18:26.0685 2208        p2pimsvc - ok
13:18:26.0716 2208        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
13:18:26.0778 2208        p2psvc - ok
13:18:26.0841 2208        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
13:18:26.0888 2208        Parport - ok
13:18:26.0934 2208        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
13:18:26.0950 2208        partmgr - ok
13:18:26.0997 2208        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
13:18:27.0044 2208        PcaSvc - ok
13:18:27.0106 2208        pccsmcfd        (bc0018c2d29f655188a0ed3fa94fdb24) C:\Windows\system32\DRIVERS\pccsmcfdx64.sys
13:18:27.0153 2208        pccsmcfd - ok
13:18:27.0184 2208        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
13:18:27.0215 2208        pci - ok
13:18:27.0231 2208        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
13:18:27.0262 2208        pciide - ok
13:18:27.0293 2208        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
13:18:27.0324 2208        pcmcia - ok
13:18:27.0340 2208        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
13:18:27.0371 2208        pcw - ok
13:18:27.0418 2208        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
13:18:27.0527 2208        PEAUTH - ok
13:18:27.0605 2208        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
13:18:27.0636 2208        PerfHost - ok
13:18:27.0746 2208        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
13:18:27.0886 2208        pla - ok
13:18:27.0948 2208        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
13:18:28.0026 2208        PlugPlay - ok
13:18:28.0058 2208        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
13:18:28.0089 2208        PNRPAutoReg - ok
13:18:28.0120 2208        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
13:18:28.0151 2208        PNRPsvc - ok
13:18:28.0198 2208        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
13:18:28.0276 2208        PolicyAgent - ok
13:18:28.0307 2208        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
13:18:28.0385 2208        Power - ok
13:18:28.0448 2208        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
13:18:28.0526 2208        PptpMiniport - ok
13:18:28.0557 2208        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
13:18:28.0604 2208        Processor - ok
13:18:28.0697 2208        ProfSvc        (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll
13:18:28.0744 2208        ProfSvc - ok
13:18:28.0775 2208        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
13:18:28.0791 2208        ProtectedStorage - ok
13:18:28.0838 2208        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
13:18:28.0916 2208        Psched - ok
13:18:29.0025 2208        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
13:18:29.0118 2208        ql2300 - ok
13:18:29.0228 2208        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
13:18:29.0259 2208        ql40xx - ok
13:18:29.0290 2208        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
13:18:29.0337 2208        QWAVE - ok
13:18:29.0337 2208        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
13:18:29.0399 2208        QWAVEdrv - ok
13:18:29.0462 2208        RapiMgr        (a55e7d0d873b2c97585b3b5926ac6ade) C:\Windows\WindowsMobile\rapimgr.dll
13:18:29.0493 2208        RapiMgr - ok
13:18:29.0524 2208        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
13:18:29.0602 2208        RasAcd - ok
13:18:29.0649 2208        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
13:18:29.0727 2208        RasAgileVpn - ok
13:18:29.0758 2208        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
13:18:29.0852 2208        RasAuto - ok
13:18:29.0883 2208        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
13:18:29.0961 2208        Rasl2tp - ok
13:18:30.0023 2208        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
13:18:30.0101 2208        RasMan - ok
13:18:30.0164 2208        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
13:18:30.0242 2208        RasPppoe - ok
13:18:30.0273 2208        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
13:18:30.0351 2208        RasSstp - ok
13:18:30.0398 2208        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
13:18:30.0491 2208        rdbss - ok
13:18:30.0522 2208        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
13:18:30.0569 2208        rdpbus - ok
13:18:30.0585 2208        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
13:18:30.0647 2208        RDPCDD - ok
13:18:30.0694 2208        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
13:18:30.0772 2208        RDPENCDD - ok
13:18:30.0788 2208        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
13:18:30.0850 2208        RDPREFMP - ok
13:18:30.0897 2208        RDPWD          (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
13:18:30.0959 2208        RDPWD - ok
13:18:31.0006 2208        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
13:18:31.0037 2208        rdyboost - ok
13:18:31.0053 2208        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
13:18:31.0146 2208        RemoteAccess - ok
13:18:31.0178 2208        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
13:18:31.0271 2208        RemoteRegistry - ok
13:18:31.0287 2208        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
13:18:31.0365 2208        RpcEptMapper - ok
13:18:31.0396 2208        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
13:18:31.0443 2208        RpcLocator - ok
13:18:31.0490 2208        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
13:18:31.0568 2208        RpcSs - ok
13:18:31.0614 2208        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
13:18:31.0692 2208        rspndr - ok
13:18:31.0755 2208        RTL8167        (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys
13:18:31.0802 2208        RTL8167 - ok
13:18:31.0833 2208        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
13:18:31.0864 2208        SamSs - ok
13:18:31.0880 2208        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
13:18:31.0911 2208        sbp2port - ok
13:18:31.0942 2208        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
13:18:32.0020 2208        SCardSvr - ok
13:18:32.0051 2208        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
13:18:32.0129 2208        scfilter - ok
13:18:32.0223 2208        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
13:18:32.0316 2208        Schedule - ok
13:18:32.0348 2208        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
13:18:32.0410 2208        SCPolicySvc - ok
13:18:32.0441 2208        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
13:18:32.0504 2208        SDRSVC - ok
13:18:32.0566 2208        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
13:18:32.0644 2208        secdrv - ok
13:18:32.0675 2208        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
13:18:32.0753 2208        seclogon - ok
13:18:32.0800 2208        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\system32\sens.dll
13:18:32.0878 2208        SENS - ok
13:18:32.0909 2208        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
13:18:32.0956 2208        SensrSvc - ok
13:18:32.0987 2208        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
13:18:33.0034 2208        Serenum - ok
13:18:33.0065 2208        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
13:18:33.0112 2208        Serial - ok
13:18:33.0128 2208        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
13:18:33.0174 2208        sermouse - ok
13:18:33.0284 2208        ServiceLayer    (3ec8de67b1c78c31e54c0f030e6bd7d5) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
13:18:33.0315 2208        ServiceLayer ( UnsignedFile.Multi.Generic ) - warning
13:18:33.0315 2208        ServiceLayer - detected UnsignedFile.Multi.Generic (1)
13:18:33.0362 2208        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
13:18:33.0440 2208        SessionEnv - ok
13:18:33.0471 2208        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
13:18:33.0518 2208        sffdisk - ok
13:18:33.0533 2208        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
13:18:33.0580 2208        sffp_mmc - ok
13:18:33.0596 2208        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
13:18:33.0642 2208        sffp_sd - ok
13:18:33.0674 2208        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
13:18:33.0705 2208        sfloppy - ok
13:18:33.0752 2208        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
13:18:33.0861 2208        SharedAccess - ok
13:18:33.0908 2208        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
13:18:34.0017 2208        ShellHWDetection - ok
13:18:34.0048 2208        SiSGbeLH        (1bc348cf6baa90ec8e533ef6e6a69933) C:\Windows\system32\DRIVERS\SiSG664.sys
13:18:34.0064 2208        SiSGbeLH - ok
13:18:34.0095 2208        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
13:18:34.0126 2208        SiSRaid2 - ok
13:18:34.0142 2208        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
13:18:34.0173 2208        SiSRaid4 - ok
13:18:34.0204 2208        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
13:18:34.0282 2208        Smb - ok
13:18:34.0344 2208        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
13:18:34.0391 2208        SNMPTRAP - ok
13:18:34.0422 2208        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
13:18:34.0454 2208        spldr - ok
13:18:34.0500 2208        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
13:18:34.0578 2208        Spooler - ok
13:18:34.0750 2208        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
13:18:34.0953 2208        sppsvc - ok
13:18:35.0062 2208        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
13:18:35.0140 2208        sppuinotify - ok
13:18:35.0343 2208        SPUVCbv        (d8816ded1ab7979400a1940c8a1fc020) C:\Windows\system32\Drivers\SPUVCbv_x64.sys
13:18:35.0514 2208        SPUVCbv - ok
13:18:35.0655 2208        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
13:18:35.0733 2208        srv - ok
13:18:35.0780 2208        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
13:18:35.0842 2208        srv2 - ok
13:18:35.0889 2208        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
13:18:35.0936 2208        srvnet - ok
13:18:35.0967 2208        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
13:18:36.0060 2208        SSDPSRV - ok
13:18:36.0076 2208        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
13:18:36.0154 2208        SstpSvc - ok
13:18:36.0232 2208        ssudmdm        (855335bf5792e56164f98c012e3d92dd) C:\Windows\system32\DRIVERS\ssudmdm.sys
13:18:36.0248 2208        ssudmdm - ok
13:18:36.0357 2208        Stereo Service  (e55f8d27eb014b31073f2f60270b6b3e) C:\Windows\SysWOW64\nvSCPAPISvr.exe
13:18:36.0372 2208        Stereo Service - ok
13:18:36.0404 2208        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
13:18:36.0419 2208        stexstor - ok
13:18:36.0482 2208        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
13:18:36.0560 2208        stisvc - ok
13:18:36.0591 2208        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
13:18:36.0622 2208        swenum - ok
13:18:36.0669 2208        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
13:18:36.0762 2208        swprv - ok
13:18:36.0872 2208        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
13:18:36.0981 2208        SysMain - ok
13:18:37.0090 2208        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
13:18:37.0137 2208        TabletInputService - ok
13:18:37.0199 2208        taphss          (f33fdc72298df4bf9813a55d21f4eb31) C:\Windows\system32\DRIVERS\taphss.sys
13:18:37.0215 2208        taphss - ok
13:18:37.0246 2208        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
13:18:37.0355 2208        TapiSrv - ok
13:18:37.0386 2208        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
13:18:37.0480 2208        TBS - ok
13:18:37.0605 2208        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
13:18:37.0698 2208        Tcpip - ok
13:18:37.0901 2208        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
13:18:37.0979 2208        TCPIP6 - ok
13:18:38.0042 2208        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
13:18:38.0104 2208        tcpipreg - ok
13:18:38.0151 2208        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
13:18:38.0198 2208        TDPIPE - ok
13:18:38.0229 2208        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
13:18:38.0260 2208        TDTCP - ok
13:18:38.0276 2208        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
13:18:38.0369 2208        tdx - ok
13:18:38.0400 2208        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
13:18:38.0432 2208        TermDD - ok
13:18:38.0494 2208        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
13:18:38.0619 2208        TermService - ok
13:18:38.0681 2208        TFsExDisk      (48d9d00c2e0e72c3d4f52772c80355f6) C:\Windows\System32\Drivers\TFsExDisk.sys
13:18:38.0712 2208        TFsExDisk - ok
13:18:38.0728 2208        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
13:18:38.0790 2208        Themes - ok
13:18:38.0822 2208        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
13:18:38.0884 2208        THREADORDER - ok
13:18:38.0931 2208        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
13:18:39.0009 2208        TrkWks - ok
13:18:39.0071 2208        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
13:18:39.0149 2208        TrustedInstaller - ok
13:18:39.0180 2208        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
13:18:39.0258 2208        tssecsrv - ok
13:18:39.0305 2208        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
13:18:39.0352 2208        TsUsbFlt - ok
13:18:39.0399 2208        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
13:18:39.0492 2208        tunnel - ok
13:18:39.0524 2208        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
13:18:39.0555 2208        uagp35 - ok
13:18:39.0586 2208        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
13:18:39.0664 2208        udfs - ok
13:18:39.0711 2208        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
13:18:39.0758 2208        UI0Detect - ok
13:18:39.0789 2208        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
13:18:39.0820 2208        uliagpkx - ok
13:18:39.0851 2208        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
13:18:39.0898 2208        umbus - ok
13:18:39.0929 2208        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
13:18:39.0960 2208        UmPass - ok
13:18:40.0007 2208        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
13:18:40.0116 2208        upnphost - ok
13:18:40.0163 2208        USBAAPL64      (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys
13:18:40.0210 2208        USBAAPL64 - ok
13:18:40.0241 2208        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
13:18:40.0272 2208        usbccgp - ok
13:18:40.0319 2208        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
13:18:40.0366 2208        usbcir - ok
13:18:40.0382 2208        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
13:18:40.0428 2208        usbehci - ok
13:18:40.0475 2208        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
13:18:40.0522 2208        usbhub - ok
13:18:40.0538 2208        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
13:18:40.0569 2208        usbohci - ok
13:18:40.0600 2208        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
13:18:40.0647 2208        usbprint - ok
13:18:40.0725 2208        usbscan        (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
13:18:40.0772 2208        usbscan - ok
13:18:40.0803 2208        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
13:18:40.0834 2208        USBSTOR - ok
13:18:40.0865 2208        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
13:18:40.0896 2208        usbuhci - ok
13:18:40.0943 2208        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
13:18:40.0990 2208        usbvideo - ok
13:18:41.0037 2208        usb_rndisx      (70d05ee263568a742d14e1876df80532) C:\Windows\system32\DRIVERS\usb8023x.sys
13:18:41.0084 2208        usb_rndisx - ok
13:18:41.0099 2208        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
13:18:41.0193 2208        UxSms - ok
13:18:41.0224 2208        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
13:18:41.0240 2208        VaultSvc - ok
13:18:41.0286 2208        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
13:18:41.0302 2208        vdrvroot - ok
13:18:41.0364 2208        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
13:18:41.0458 2208        vds - ok
13:18:41.0505 2208        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
13:18:41.0536 2208        vga - ok
13:18:41.0552 2208        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
13:18:41.0630 2208        VgaSave - ok
13:18:41.0661 2208        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
13:18:41.0692 2208        vhdmp - ok
13:18:41.0708 2208        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
13:18:41.0739 2208        viaide - ok
13:18:41.0754 2208        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
13:18:41.0786 2208        volmgr - ok
13:18:41.0817 2208        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
13:18:41.0864 2208        volmgrx - ok
13:18:41.0895 2208        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
13:18:41.0926 2208        volsnap - ok
13:18:41.0957 2208        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
13:18:41.0988 2208        vsmraid - ok
13:18:42.0082 2208        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
13:18:42.0222 2208        VSS - ok
13:18:42.0347 2208        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
13:18:42.0394 2208        vwifibus - ok
13:18:42.0410 2208        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
13:18:42.0456 2208        vwififlt - ok
13:18:42.0472 2208        vwifimp        (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
13:18:42.0519 2208        vwifimp - ok
13:18:42.0550 2208        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
13:18:42.0644 2208        W32Time - ok
13:18:42.0675 2208        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
13:18:42.0722 2208        WacomPen - ok
13:18:42.0753 2208        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
13:18:42.0846 2208        WANARP - ok
13:18:42.0862 2208        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
13:18:42.0924 2208        Wanarpv6 - ok
13:18:42.0971 2208        wanatw          (eceb715bece47e101ddec06b11126066) C:\Windows\system32\DRIVERS\wanatw64.sys
13:18:43.0018 2208        wanatw - ok
13:18:43.0112 2208        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
13:18:43.0221 2208        wbengine - ok
13:18:43.0314 2208        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
13:18:43.0361 2208        WbioSrvc - ok
13:18:43.0455 2208        WcesComm        (8bda6db43aa54e8bb5e0794541ddc209) C:\Windows\WindowsMobile\wcescomm.dll
13:18:43.0502 2208        WcesComm - ok
13:18:43.0533 2208        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
13:18:43.0595 2208        wcncsvc - ok
13:18:43.0626 2208        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
13:18:43.0673 2208        WcsPlugInService - ok
13:18:43.0736 2208        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
13:18:43.0751 2208        Wd - ok
13:18:43.0814 2208        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
13:18:43.0876 2208        Wdf01000 - ok
13:18:43.0907 2208        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
13:18:44.0032 2208        WdiServiceHost - ok
13:18:44.0032 2208        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
13:18:44.0063 2208        WdiSystemHost - ok
13:18:44.0094 2208        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
13:18:44.0141 2208        WebClient - ok
13:18:44.0172 2208        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
13:18:44.0250 2208        Wecsvc - ok
13:18:44.0282 2208        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
13:18:44.0375 2208        wercplsupport - ok
13:18:44.0406 2208        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
13:18:44.0484 2208        WerSvc - ok
13:18:44.0547 2208        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
13:18:44.0609 2208        WfpLwf - ok
13:18:44.0656 2208        WimFltr        (52ded146e4797e6ccf94799e8e22bb2a) C:\Windows\system32\DRIVERS\wimfltr.sys
13:18:44.0672 2208        WimFltr - ok
13:18:44.0703 2208        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
13:18:44.0718 2208        WIMMount - ok
13:18:44.0781 2208        WinDefend - ok
13:18:44.0796 2208        WinHttpAutoProxySvc - ok
13:18:44.0859 2208        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
13:18:44.0937 2208        Winmgmt - ok
13:18:45.0062 2208        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
13:18:45.0218 2208        WinRM - ok
13:18:45.0358 2208        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
13:18:45.0405 2208        WinUsb - ok
13:18:45.0467 2208        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
13:18:45.0545 2208        Wlansvc - ok
13:18:45.0576 2208        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
13:18:45.0623 2208        WmiAcpi - ok
13:18:45.0686 2208        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
13:18:45.0732 2208        wmiApSrv - ok
13:18:45.0779 2208        WMPNetworkSvc - ok
13:18:45.0810 2208        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
13:18:45.0842 2208        WPCSvc - ok
13:18:45.0888 2208        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
13:18:45.0935 2208        WPDBusEnum - ok
13:18:45.0982 2208        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
13:18:46.0060 2208        ws2ifsl - ok
13:18:46.0091 2208        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\system32\wscsvc.dll
13:18:46.0122 2208        wscsvc - ok
13:18:46.0138 2208        WSearch - ok
13:18:46.0216 2208        WTGService      (a583f4bf607ebc5709578433207a76a8) C:\Program Files (x86)\Verbindungsassistent\wtgservice.exe
13:18:46.0247 2208        WTGService - ok
13:18:46.0388 2208        wuauserv        (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll
13:18:46.0512 2208        wuauserv - ok
13:18:46.0637 2208        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
13:18:46.0715 2208        WudfPf - ok
13:18:46.0746 2208        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
13:18:46.0809 2208        WUDFRd - ok
13:18:46.0840 2208        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
13:18:46.0918 2208        wudfsvc - ok
13:18:46.0949 2208        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
13:18:46.0996 2208        WwanSvc - ok
13:18:47.0074 2208        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
13:18:47.0448 2208        \Device\Harddisk0\DR0 - ok
13:18:47.0448 2208        Boot (0x1200)  (2c4a1defa3e7c0ea1bdf7c1d4b92199d) \Device\Harddisk0\DR0\Partition0
13:18:47.0464 2208        \Device\Harddisk0\DR0\Partition0 - ok
13:18:47.0495 2208        Boot (0x1200)  (c6f5097cd1c94e431f91ca1dcbdb2c5a) \Device\Harddisk0\DR0\Partition1
13:18:47.0495 2208        \Device\Harddisk0\DR0\Partition1 - ok
13:18:47.0495 2208        ============================================================
13:18:47.0495 2208        Scan finished
13:18:47.0495 2208        ============================================================
13:18:47.0526 5424        Detected object count: 1
13:18:47.0526 5424        Actual detected object count: 1
13:32:17.0326 5424        ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user
13:32:17.0326 5424        ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip
das hier war das erste log hab ich eben erst gesehen
Code:
13:15:24.0945 5464        TDSS rootkit removing tool 2.7.46.0 Jul 16 2012 22:10:11
13:15:25.0014 5464        ============================================================
13:15:25.0014 5464        Current date / time: 2012/07/17 13:15:25.0014
13:15:25.0014 5464        SystemInfo:
13:15:25.0014 5464       
13:15:25.0014 5464        OS Version: 6.1.7601 ServicePack: 1.0
13:15:25.0014 5464        Product type: Workstation
13:15:25.0015 5464        ComputerName: LEHMANN-PC
13:15:25.0015 5464        UserName: Lehmann
13:15:25.0015 5464        Windows directory: C:\Windows
13:15:25.0015 5464        System windows directory: C:\Windows
13:15:25.0015 5464        Running under WOW64
13:15:25.0015 5464        Processor architecture: Intel x64
13:15:25.0015 5464        Number of processors: 2
13:15:25.0015 5464        Page size: 0x1000
13:15:25.0015 5464        Boot type: Normal boot
13:15:25.0015 5464        ============================================================
13:15:27.0625 5464        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:15:27.0635 5464        ============================================================
13:15:27.0635 5464        \Device\Harddisk0\DR0:
13:15:27.0635 5464        MBR partitions:
13:15:27.0635 5464        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x2711676, BlocksNum 0x950A408
13:15:27.0648 5464        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xBC1C800, BlocksNum 0x19811800
13:15:27.0648 5464        ============================================================
13:15:27.0703 5464        C: <-> \Device\Harddisk0\DR0\Partition0
13:15:27.0733 5464        D: <-> \Device\Harddisk0\DR0\Partition1
13:15:27.0734 5464        ============================================================
13:15:27.0734 5464        Initialize success
13:15:27.0734 5464        ============================================================
13:15:35.0116 3044        Deinitialize success

cosinus 18.07.2012 11:25
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

murmeltiermu 18.07.2012 14:45
Code:
ComboFix 12-07-18.01 - Lehmann 18.07.2012  14:14:05.2.2 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.4095.2964 [GMT 2:00]
ausgeführt von:: c:\users\Lehmann\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Lehmann\AppData\Local\Temp\99cab429-f99d-4f69-9d04-113ad532bd0f\CliSecureRT.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-06-18 bis 2012-07-18  ))))))))))))))))))))))))))))))
.
.
2012-07-18 13:25 . 2012-07-18 13:25        --------        d-----w-        c:\users\Holger\AppData\Local\temp
2012-07-18 13:25 . 2012-07-18 13:25        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-07-17 07:24 . 2012-06-29 10:04        9133488        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{CE034E66-B845-410A-8BEA-794291430E14}\mpengine.dll
2012-07-12 21:34 . 2012-07-12 21:34        --------        d-----w-        c:\program files (x86)\ESET
2012-07-12 05:28 . 2012-07-12 05:28        --------        d-----w-        c:\users\Lehmann\AppData\Local\Macromedia
2012-07-12 05:19 . 2012-06-12 03:08        3148800        ----a-w-        c:\windows\system32\win32k.sys
2012-07-10 13:21 . 2012-07-10 13:21        --------        d-----w-        c:\program files (x86)\Oracle
2012-07-05 11:33 . 2012-07-05 11:33        --------        d-----w-        c:\program files (x86)\Paragon Software
2012-07-05 07:22 . 2012-06-04 07:59        99384        ----a-w-        c:\windows\system32\drivers\ssudbus.sys
2012-07-05 07:22 . 2012-06-04 07:59        203320        ----a-w-        c:\windows\system32\drivers\ssudmdm.sys
2012-07-05 07:20 . 2011-06-02 05:47        177640        ----a-w-        c:\windows\system32\drivers\ssadmdm.sys
2012-07-05 07:20 . 2011-06-02 05:47        16872        ----a-w-        c:\windows\system32\drivers\ssadmdfl.sys
2012-07-05 07:20 . 2011-06-02 05:47        13800        ----a-w-        c:\windows\system32\drivers\ssadwhnt.sys
2012-07-05 07:20 . 2011-06-02 05:47        13800        ----a-w-        c:\windows\system32\drivers\ssadwh.sys
2012-07-05 07:20 . 2010-12-21 05:55        1917416        ----a-w-        c:\windows\system32\WdfCoInstaller01005.dll
2012-07-05 07:20 . 2010-12-21 05:55        1917416        ----a-w-        c:\windows\system32\drivers\WdfCoInstaller01005.dll
2012-07-05 07:20 . 2011-06-02 05:47        157672        ----a-w-        c:\windows\system32\drivers\ssadbus.sys
2012-07-05 07:20 . 2011-06-02 05:47        13288        ----a-w-        c:\windows\system32\drivers\ssadcmnt.sys
2012-07-05 07:20 . 2011-06-02 05:47        13288        ----a-w-        c:\windows\system32\drivers\ssadcm.sys
2012-07-05 07:20 . 2010-12-21 05:55        36328        ----a-w-        c:\windows\system32\drivers\ssadadb.sys
2012-07-05 07:20 . 2011-06-02 05:47        146920        ----a-w-        c:\windows\system32\drivers\ssadserd.sys
2012-07-05 07:19 . 2010-12-21 05:55        15944        ----a-w-        c:\windows\system32\drivers\sscdwhnt.sys
2012-07-05 07:19 . 2010-12-21 05:55        15944        ----a-w-        c:\windows\system32\drivers\sscdwh.sys
2012-07-05 07:19 . 2010-12-21 05:55        19016        ----a-w-        c:\windows\system32\drivers\sscdmdfl.sys
2012-07-05 07:19 . 2010-12-21 05:55        172104        ----a-w-        c:\windows\system32\drivers\sscdmdm.sys
2012-07-05 07:19 . 2010-12-21 05:55        15432        ----a-w-        c:\windows\system32\drivers\sscdcmnt.sys
2012-07-05 07:19 . 2010-12-21 05:55        15432        ----a-w-        c:\windows\system32\drivers\sscdcm.sys
2012-07-05 07:19 . 2010-12-21 05:55        136264        ----a-w-        c:\windows\system32\drivers\sscdbus.sys
2012-07-04 20:46 . 2012-07-04 20:46        --------        d-----w-        c:\users\Default\AppData\Local\Power2Go
2012-07-04 10:36 . 2012-05-04 11:00        366592        ----a-w-        c:\windows\system32\qdvd.dll
2012-07-04 10:36 . 2012-05-04 09:59        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll
2012-06-26 12:34 . 2012-06-26 12:34        --------        d-----w-        C:\_OTL
2012-06-25 18:40 . 2012-06-25 18:40        --------        d-----w-        c:\users\Lehmann\AppData\Roaming\Malwarebytes
2012-06-25 18:39 . 2012-06-25 18:39        --------        d-----w-        c:\programdata\Malwarebytes
2012-06-25 18:39 . 2012-07-12 20:24        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-25 18:39 . 2012-07-03 11:46        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-06-25 14:04 . 2012-06-25 14:04        1394248        ----a-w-        c:\windows\SysWow64\msxml4.dll
2012-06-23 20:46 . 2012-06-23 20:47        --------        d-----w-        c:\windows\WindowsMobile
2012-06-19 05:03 . 2012-06-02 22:19        2428952        ----a-w-        c:\windows\system32\wuaueng.dll
2012-06-19 05:03 . 2012-06-02 22:19        57880        ----a-w-        c:\windows\system32\wuauclt.exe
2012-06-19 05:03 . 2012-06-02 22:19        44056        ----a-w-        c:\windows\system32\wups2.dll
2012-06-19 05:03 . 2012-06-02 22:15        2622464        ----a-w-        c:\windows\system32\wucltux.dll
2012-06-19 05:03 . 2012-06-02 22:19        38424        ----a-w-        c:\windows\system32\wups.dll
2012-06-19 05:03 . 2012-06-02 22:19        701976        ----a-w-        c:\windows\system32\wuapi.dll
2012-06-19 05:03 . 2012-06-02 22:15        99840        ----a-w-        c:\windows\system32\wudriver.dll
2012-06-19 05:03 . 2012-06-02 13:19        186752        ----a-w-        c:\windows\system32\wuwebv.dll
2012-06-19 05:03 . 2012-06-02 13:15        36864        ----a-w-        c:\windows\system32\wuapp.exe
2012-06-18 21:25 . 2012-06-18 21:25        --------        d-----w-        C:\BauFaktura
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-18 05:07 . 2012-05-01 16:45        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-18 05:07 . 2011-06-27 05:17        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-26 07:02 . 2011-06-07 10:13        45320        ----a-w-        c:\windows\SysWow64\MAMACExtract.dll
2012-05-31 10:25 . 2012-03-08 12:42        279656        ------w-        c:\windows\system32\MpSigStub.exe
2012-05-29 07:38 . 2011-10-31 10:22        330240        ----a-w-        c:\windows\MASetupCaller.dll
2012-05-09 05:12 . 2012-03-23 15:37        98848        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-05-09 05:12 . 2012-03-23 15:37        132832        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-05-08 11:47 . 2012-05-08 11:47        8744608        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-05-04 17:29 . 2012-06-10 20:40        772504        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll
2012-05-04 17:29 . 2011-05-09 06:38        687504        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2012-05-04 11:06 . 2012-06-14 05:16        5559664        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-14 05:16        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-14 05:16        3913072        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2012-05-01 05:40 . 2012-06-14 05:16        209920        ----a-w-        c:\windows\system32\profsvc.dll
2012-04-28 03:55 . 2012-06-14 05:16        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-14 05:16        77312        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-14 05:16        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-14 05:16        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-04-24 05:37 . 2012-06-14 05:15        184320        ----a-w-        c:\windows\system32\cryptsvc.dll
2012-04-24 05:37 . 2012-06-14 05:15        140288        ----a-w-        c:\windows\system32\cryptnet.dll
2012-04-24 05:37 . 2012-06-14 05:15        1462272        ----a-w-        c:\windows\system32\crypt32.dll
2012-04-24 04:36 . 2012-06-14 05:15        1158656        ----a-w-        c:\windows\SysWow64\crypt32.dll
2012-04-24 04:36 . 2012-06-14 05:15        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll
2012-04-24 04:36 . 2012-06-14 05:15        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-07-03 21432]
"AutoStartNPSAgent"="c:\program files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-07-04 95576]
"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2012-07-03 975288]
"Facebook Update"="c:\users\Lehmann\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-11 138096]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-09 348624]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
"PONS-CD 7"="c:\program files (x86)\Paragon Software\PONS\PONS-CD.exe" [2012-05-21 5878784]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-11 135664]
R2 lxeeCATSCustConnectService;lxeeCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxeeserv.exe [2010-04-14 45736]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-08-21 44032]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2010-12-21 36328]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-06-04 99384]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2009-12-22 20568]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-11 135664]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-06-02 157672]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 16872]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 177640]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-06-02 146920]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-06-04 203320]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-02 51712]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-09-16 27760]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2009-09-17 359552]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-09 86224]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
S2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]
S2 hshld;Hotspot Shield Service;c:\program files (x86)\Hotspot Shield\bin\openvpnas.exe [2012-04-10 542552]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [2012-04-02 329544]
S2 lxee_device;lxee_device;c:\windows\system32\lxeecoms.exe [2010-04-14 1052328]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\windows\SysWOW64\nvSCPAPISvr.exe [2009-12-11 239208]
S2 WTGService;WTGService;c:\program files (x86)\Verbindungsassistent\wtgservice.exe [2011-05-08 330696]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2009-10-15 117760]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2009-08-21 84512]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\SPUVCbv_x64.sys [2010-01-31 2495944]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-17 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001Core.job
- c:\users\Lehmann\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-25 21:10]
.
2012-07-18 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001UA.job
- c:\users\Lehmann\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-25 21:10]
.
2012-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-11 03:35]
.
2012-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-11 03:35]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-11 16414824]
"lxeemon.exe"="c:\program files (x86)\Lexmark Pro700 Series\lxeemon.exe" [2011-01-23 770728]
"EzPrint"="c:\program files (x86)\Lexmark Pro700 Series\ezprint.exe" [2011-01-23 148280]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.orbitdownloader.com
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/204
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Do&wnload selected by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/202
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{947C3A71-283C-46D6-9EE8-0FA7FDD7F411}: NameServer = 10.24.8.1
FF - ProfilePath - c:\users\Lehmann\AppData\Roaming\Mozilla\Firefox\Profiles\4pc4gfir.default\
FF - prefs.js: browser.startup.homepage -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-ASUS_Screensaver - c:\windows\system32\ASUS_Screensaver.scr
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
c:\program files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
c:\program files (x86)\Hotspot Shield\bin\openvpntray.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-07-18  15:34:54 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-07-18 13:34
ComboFix2.txt  2012-06-26 19:59
.
Vor Suchlauf: 21 Verzeichnis(se), 36.609.810.432 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 36.384.477.184 Bytes frei
.
- - End Of File - - BD24151FA15C95D494218E14184906BE

cosinus 18.07.2012 20:20
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

murmeltiermu 19.07.2012 06:32
Guten Morgen,

ich hab eine 64 bit version und hab irgendwo am anfang gelesen das man den gmer nur bei 32 bit laufen lassen soll, gillt das hier jetzt auch? oder soll ich gleich nur den osam laufen lassen

cosinus 19.07.2012 16:52
Nein, versuch ruhig den Lauf mit GMER

murmeltiermu 20.07.2012 07:21
ok nächstes problem, wenn ich den gmer öffne kommt in der auswahl an der seite nur die untersten 3 zum anhaken - service, regestry und files und darunter ads in der großen box steht aber garnichts alle anderen felder sind nur grau hinterlegt soll ich trotzdem mit der einstellung laufen lassen?

cosinus 20.07.2012 15:54
Ja versuch es ruhig

murmeltiermu 20.07.2012 20:26
GMER Logfile:
Code:
GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2012-07-20 21:20:32
Windows 6.1.7601 Service Pack 1
Running: xi3o3xvk.exe


---- Files - GMER 1.0.15 ----

File  C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{ED666F91-13E5-4F89-BC33-860755A194F3}  7328 bytes
File  C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{FD4A3851-AAB9-41DB-83B3-DC842E170F31}  7354 bytes
File  C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{90CAB1BC-6DA4-4BD9-A34A-18B9263606F4}  7264 bytes
File  C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{30ED9199-5E7B-49C5-8631-81C9D9C9EDD7}  7264 bytes
File  C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{B80E1D34-86AA-4884-A9D9-790D48C2ED1C}  7262 bytes

---- EOF - GMER 1.0.15 ----
--- --- ---


OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
Online Solutions. Complex Protection for Information Systems
Saved at 21:41:27 on 20.07.2012

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 64-bit
Default Browser: Mozilla Corporation Firefox 4.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001Core.job" - "Facebook Inc." - C:\Users\Lehmann\AppData\Local\Facebook\Update\FacebookUpdate.exe
"FacebookUpdateTaskUserS-1-5-21-2509907102-1040732608-2463916187-1001UA.job" - "Facebook Inc." - C:\Users\Lehmann\AppData\Local\Facebook\Update\FacebookUpdate.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ASMMAP64" (ASMMAP64) - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"dgderdrv" (dgderdrv) - "Devguru Co., Ltd" - C:\Windows\System32\drivers\dgderdrv.sys
"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\fssfltr.sys
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"TFsExDisk" (TFsExDisk) - "Teruten Inc" - C:\Windows\System32\Drivers\TFsExDisk.sys
"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\wimfltr.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files (x86)\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll
{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files (x86)\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Grab Pro" - ? - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Oracle Corporation" - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 10.5.1" - "Oracle Corporation" - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 10.5.1" - "Oracle Corporation" - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
{1B00725B-C455-4DE6-BFB6-AD540AD427CD} "{1B00725B-C455-4DE6-BFB6-AD540AD427CD}" - ? -  (File not found | COM-object registry key not found) / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "@C:\Windows\WindowsMobile\INetRepl.dll,-222" - "Microsoft Corporation" - C:\Windows\WindowsMobile\INetRepl.dll
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\Windows\WindowsMobile\INetRepl.dll
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{8dcb7100-df86-4384-8842-8fa844297b3f} "Bing Bar" - "Microsoft Corporation." - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
<binary data> "Grab Pro" - ? - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{d2ce3e00-f94a-4740-988e-03dc2f38c34f} "Bing Bar Helper" - "Microsoft Corporation." - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll
{593DDEC6-7468-4cdd-90E1-42DADAA222E9} "DivX HiQ" - "DivX, LLC" - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
{326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} "Google Dictionary Compression sdch" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
{000123B4-9B42-4900-B3F7-F4B073EFC214} "Octh Class" - "Orbitdownloader.com" - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"AutoStartNPSAgent" - "Samsung Electronics Co., Ltd." - C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
"Facebook Update" - "Facebook Inc." - "C:\Users\Lehmann\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
"KiesPDLR" - ? - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
"KiesPreload" - "Samsung" - C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"APSDaemon" - "Apple Inc." - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"iTunesHelper" - "Apple Inc." - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"PONS-CD 7" - ? - "C:\Program Files (x86)\Paragon Software\PONS\PONS-CD.exe" -autorun  (File found, but it contains no detailed information)
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"FPR6:" - "FinePrint Software, LLC" - C:\Windows\system32\fpmon6.dll
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
"AFBAgent" (AFBAgent) - "ASUSTeK Computer Inc." - C:\Windows\system32\FBAgent.exe
"AOL Connectivity Service" (AOL ACS) - "AOL LLC" - C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASLDR Service" (ASLDRService) - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"ATKGFNEX Service" (ATKGFNEXSrv) - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
"BBUpdate" (BBUpdate) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
"Bing Bar Update Service" (BBSvc) - "Microsoft Corporation." - C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Hotspot Shield Monitoring Service" (HssWd) - ? - C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe  (File found, but it contains no detailed information)
"Hotspot Shield Routing Service" (HssSrv) - ? - C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
"Hotspot Shield Service" (hshld) - ? - C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe  (File found, but it contains no detailed information)
"Hotspot Shield Tray Service" (HssTrayService) - ? - C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE  (File found, but it contains no detailed information)
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Windows\SysWOW64\nvSCPAPISvr.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Windows Live Family Safety" (fsssvc) - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
"WTGService" (WTGService) - ? - C:\Program Files (x86)\Verbindungsassistent\wtgservice.exe  (File found, but it contains no detailed information)

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-07-20 21:59:01
-----------------------------
21:59:01.354    OS Version: Windows x64 6.1.7601 Service Pack 1
21:59:01.354    Number of processors: 2 586 0x170A
21:59:01.354    ComputerName: LEHMANN-PC  UserName: Lehmann
21:59:02.556    Initialize success
21:59:11.198    AVAST engine defs: 12072000
21:59:17.672    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000070
21:59:17.672    Disk 0 Vendor: ST932032 0003 Size: 305245MB BusType: 11
21:59:17.750    Disk 0 MBR read successfully
21:59:17.766    Disk 0 MBR scan
21:59:17.766    Disk 0 Windows 7 default MBR code
21:59:17.781    Disk 0 Partition 1 00    1C Hidd FAT32 LBA MSDOS5.0    20002 MB offset 63
21:59:17.797    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        76308 MB offset 40965750
21:59:17.812    Disk 0 Partition - 00    0F Extended LBA            208932 MB offset 197246976
21:59:17.844    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      208931 MB offset 197249024
21:59:17.906    Disk 0 scanning C:\Windows\system32\drivers
21:59:36.331    Service scanning
22:00:06.345    Modules scanning
22:00:06.361    Disk 0 trace - called modules:
22:00:06.423    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor64.sys
22:00:06.439    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004217060]
22:00:06.439    3 CLASSPNP.SYS[fffff8800199c43f] -> nt!IofCallDriver -> [0xfffffa8004146e40]
22:00:06.454    5 ACPI.sys[fffff88000fae7a1] -> nt!IofCallDriver -> \Device\00000070[0xfffffa800407c060]
22:00:06.454    Scan finished successfully
22:00:53.254    Disk 0 MBR has been saved successfully to "C:\Users\Lehmann\Desktop\MBR.dat"
22:00:53.270    The log file has been saved successfully to "C:\Users\Lehmann\Desktop\aswMBR.txt"

cosinus 21.07.2012 15:44
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

murmeltiermu 21.07.2012 17:22
Malwarebytes Anti-Malware 1.62.0.1300
Malwarebytes : Free anti-malware download

Datenbank Version: v2012.07.21.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Lehmann :: LEHMANN-PC [Administrator]

21.07.2012 17:10:18
mbam-log-2012-07-21 (17-10-18).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 344201
Laufzeit: 49 Minute(n), 3 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 07/21/2012 at 08:29 PM

Application Version : 5.5.1006

Core Rules Database Version : 8939
Trace Rules Database Version: 6751

Scan type      : Complete Scan
Total Scan Time : 01:56:57

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 700
Memory threats detected  : 0
Registry items scanned    : 66986
Registry threats detected : 0
File items scanned        : 140225
File threats detected    : 703

Adware.Tracking Cookie
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\8C5UO2Q5.txt [ /tracking.quisma.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\WJGZA7VQ.txt [ /zanox.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\GQZVWHVM.txt [ /www.traffictrack.de ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\JB0V09QK.txt [ /2o7.net ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\J8P15O9U.txt [ /ad3.adfarm1.adition.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\RS3S06Z7.txt [ /stats.paypal.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\5YM56U5S.txt [ /casalemedia.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\WU2ZQ5X4.txt [ /www.etracker.de ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\B17P1LTO.txt [ /ad.adc-serv.net ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\5HD3K4O2.txt [ /td-tracker.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\OVLFZJJR.txt [ /e-2dj6aekigpdpaho.stats.esomniture.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\26D2X8LC.txt [ /smartadserver.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\DDI7E3OY.txt [ /mediaplex.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\2Y8CAAFT.txt [ /www.googleadservices.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\HHRPFUCT.txt [ /de.at.atwola.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\2KO1WGCB.txt [ /ad.adserver01.de ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\05BL19S3.txt [ /statcounter.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\ORCQ4DW0.txt [ /serving-sys.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\F6K293DI.txt [ /advertising.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\219V6O3J.txt [ /xiti.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\HI26I4M8.txt [ /apmebf.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\2LBEK2QL.txt [ /traffictrack.de ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\0GNIWSGW.txt [ /ar.atwola.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\W9CV37QM.txt [ /rotator.wigetmedia.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\CJ4FMZ6H.txt [ /fastclick.net ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\CL0PCUA6.txt [ /doubleclick.net ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\N79EPCKM.txt [ /accounts.google.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\OTLP9HLU.txt [ /gostats.de ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\FEWGQ0DQ.txt [ /adx.chip.de ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\WT2B4JIR.txt [ /histats.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\2F05YSCF.txt [ /ad4.adfarm1.adition.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\W83Q8YKX.txt [ /tto2.traffictrack.de ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\DJK8AZYJ.txt [ /webmasterplan.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\WFBLY58I.txt [ /im.banner.t-online.de ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\LJWI6ODF.txt [ /bwincom.122.2o7.net ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\4YRQ3BH6.txt [ /adtech.de ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\QE8BHMN5.txt [ /at.atwola.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\5SWGNP8J.txt [ /zanox-affiliate.de ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\4W7LQLPA.txt [ /ad.yieldmanager.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\5W95SNCI.txt [ /paypal.112.2o7.net ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\T58FYDXZ.txt [ /track.adform.net ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\2XWUA80M.txt [ /imrworldwide.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\VKZNQ0AV.txt [ /invitemedia.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\1C23P3Z6.txt [ /atwola.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\AHE3U69E.txt [ /ad.360yield.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\ZBEWJB69.txt [ /7.rotator.wigetmedia.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\1772OSX2.txt [ /ad.zanox.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\RVIV0IDR.txt [ /www.zanox-affiliate.de ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\E2CMZKU7.txt [ /statse.webtrendslive.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\IE7G0OZK.txt [ /adbrite.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\IB2DMTV3.txt [ /ads.creative-serving.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\XQBRGX99.txt [ /adfarm1.adition.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\E168CXX1.txt [ /revsci.net ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\3M7HH2MW.txt [ /ad2.adfarm1.adition.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\CV2EP2Y3.txt [ /atdmt.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\VZSY77BU.txt [ /tacoda.at.atwola.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\QJNBRPXT.txt [ /ad1.adfarm1.adition.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\1NXEMERK.txt [ /adform.net ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\P12PVJ8K.txt [ /tomtailor.dyntracker.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\TF0RMGGY.txt [ /tradedoubler.com ]
        C:\Users\Lehmann\AppData\Roaming\Microsoft\Windows\Cookies\7UUZD72P.txt [ /unitymedia.de ]
        C:\USERS\HOLGER\AppData\Roaming\Microsoft\Windows\Cookies\C9UA73CJ.txt [ Cookie:holger@apmebf.com/ ]
        C:\USERS\HOLGER\Cookies\C9UA73CJ.txt [ Cookie:holger@apmebf.com/ ]
        C:\USERS\LEHMANN\AppData\Roaming\Microsoft\Windows\Cookies\602UY8RF.txt [ Cookie:lehmann@ubesttorrent2011.com/tracking/ ]
        C:\USERS\LEHMANN\AppData\Roaming\Microsoft\Windows\Cookies\QOB21I7R.txt [ Cookie:lehmann@google.com/accounts/ ]
        C:\USERS\LEHMANN\Cookies\GQZVWHVM.txt [ Cookie:lehmann@www.traffictrack.de/ ]
        C:\USERS\LEHMANN\Cookies\J8P15O9U.txt [ Cookie:lehmann@ad3.adfarm1.adition.com/ ]
        C:\USERS\LEHMANN\Cookies\RS3S06Z7.txt [ Cookie:lehmann@stats.paypal.com/ ]
        C:\USERS\LEHMANN\Cookies\5YM56U5S.txt [ Cookie:lehmann@casalemedia.com/ ]
        C:\USERS\LEHMANN\Cookies\WU2ZQ5X4.txt [ Cookie:lehmann@www.etracker.de/ ]
        C:\USERS\LEHMANN\Cookies\5HD3K4O2.txt [ Cookie:lehmann@td-tracker.com/ ]
        C:\USERS\LEHMANN\Cookies\OVLFZJJR.txt [ Cookie:lehmann@e-2dj6aekigpdpaho.stats.esomniture.com/ ]
        C:\USERS\LEHMANN\Cookies\26D2X8LC.txt [ Cookie:lehmann@smartadserver.com/ ]
        C:\USERS\LEHMANN\Cookies\DDI7E3OY.txt [ Cookie:lehmann@mediaplex.com/ ]
        C:\USERS\LEHMANN\Cookies\2Y8CAAFT.txt [ Cookie:lehmann@www.googleadservices.com/pagead/conversion/983437618/ ]
        C:\USERS\LEHMANN\Cookies\HHRPFUCT.txt [ Cookie:lehmann@de.at.atwola.com/ ]
        C:\USERS\LEHMANN\Cookies\2KO1WGCB.txt [ Cookie:lehmann@ad.adserver01.de/ ]
        C:\USERS\LEHMANN\Cookies\05BL19S3.txt [ Cookie:lehmann@statcounter.com/ ]
        C:\USERS\LEHMANN\Cookies\ORCQ4DW0.txt [ Cookie:lehmann@serving-sys.com/ ]
        C:\USERS\LEHMANN\Cookies\F6K293DI.txt [ Cookie:lehmann@advertising.com/ ]
        C:\USERS\LEHMANN\Cookies\2LBEK2QL.txt [ Cookie:lehmann@traffictrack.de/ ]
        C:\USERS\LEHMANN\Cookies\0GNIWSGW.txt [ Cookie:lehmann@ar.atwola.com/ ]
        C:\USERS\LEHMANN\Cookies\W9CV37QM.txt [ Cookie:lehmann@rotator.wigetmedia.com/servlet/ajrotator/track/pt203774 ]
        C:\USERS\LEHMANN\Cookies\CL0PCUA6.txt [ Cookie:lehmann@doubleclick.net/ ]
        C:\USERS\LEHMANN\Cookies\N79EPCKM.txt [ Cookie:lehmann@accounts.google.com/ ]
        C:\USERS\LEHMANN\Cookies\OTLP9HLU.txt [ Cookie:lehmann@gostats.de/ ]
        C:\USERS\LEHMANN\Cookies\FEWGQ0DQ.txt [ Cookie:lehmann@adx.chip.de/ ]
        C:\USERS\LEHMANN\Cookies\W83Q8YKX.txt [ Cookie:lehmann@tto2.traffictrack.de/ ]
        C:\USERS\LEHMANN\Cookies\DJK8AZYJ.txt [ Cookie:lehmann@webmasterplan.com/ ]
        C:\USERS\LEHMANN\Cookies\WFBLY58I.txt [ Cookie:lehmann@im.banner.t-online.de/ ]
        C:\USERS\LEHMANN\Cookies\LJWI6ODF.txt [ Cookie:lehmann@bwincom.122.2o7.net/ ]
        C:\USERS\LEHMANN\Cookies\4YRQ3BH6.txt [ Cookie:lehmann@adtech.de/ ]
        C:\USERS\LEHMANN\Cookies\QE8BHMN5.txt [ Cookie:lehmann@at.atwola.com/ ]
        C:\USERS\LEHMANN\Cookies\5SWGNP8J.txt [ Cookie:lehmann@zanox-affiliate.de/ ]
        C:\USERS\LEHMANN\Cookies\4W7LQLPA.txt [ Cookie:lehmann@ad.yieldmanager.com/ ]
        C:\USERS\LEHMANN\Cookies\T58FYDXZ.txt [ Cookie:lehmann@track.adform.net/ ]
        C:\USERS\LEHMANN\Cookies\2XWUA80M.txt [ Cookie:lehmann@imrworldwide.com/cgi-bin ]
        C:\USERS\LEHMANN\Cookies\VKZNQ0AV.txt [ Cookie:lehmann@invitemedia.com/ ]
        C:\USERS\LEHMANN\Cookies\1C23P3Z6.txt [ Cookie:lehmann@atwola.com/ ]
        C:\USERS\LEHMANN\Cookies\ZBEWJB69.txt [ Cookie:lehmann@7.rotator.wigetmedia.com/ ]
        C:\USERS\LEHMANN\Cookies\1772OSX2.txt [ Cookie:lehmann@ad.zanox.com/ ]
        C:\USERS\LEHMANN\Cookies\602UY8RF.txt [ Cookie:lehmann@ubesttorrent2011.com/tracking/ ]
        C:\USERS\LEHMANN\Cookies\RVIV0IDR.txt [ Cookie:lehmann@www.zanox-affiliate.de/ ]
        C:\USERS\LEHMANN\Cookies\E2CMZKU7.txt [ Cookie:lehmann@statse.webtrendslive.com/ ]
        C:\USERS\LEHMANN\Cookies\XQBRGX99.txt [ Cookie:lehmann@adfarm1.adition.com/ ]
        C:\USERS\LEHMANN\Cookies\3M7HH2MW.txt [ Cookie:lehmann@ad2.adfarm1.adition.com/ ]
        C:\USERS\LEHMANN\Cookies\CV2EP2Y3.txt [ Cookie:lehmann@atdmt.com/ ]
        C:\USERS\LEHMANN\Cookies\VZSY77BU.txt [ Cookie:lehmann@tacoda.at.atwola.com/ ]
        C:\USERS\LEHMANN\Cookies\QOB21I7R.txt [ Cookie:lehmann@google.com/accounts/ ]
        C:\USERS\LEHMANN\Cookies\P12PVJ8K.txt [ Cookie:lehmann@tomtailor.dyntracker.com/ ]
        C:\USERS\LEHMANN\Cookies\TF0RMGGY.txt [ Cookie:lehmann@tradedoubler.com/ ]
        .doubleclick.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .kabelbw.112.2o7.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        tracking.mlsat02.de [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        server.lon.liveperson.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        a.visualrevenue.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\HOLGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4B0COB2O.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.mediamarkt.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.mediamarkt.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .vodafone.122.2o7.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.digital-eliteboard.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.digital-eliteboard.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .digital-eliteboard.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .digital-eliteboard.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .digital-eliteboard.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .mswmw7mobilemainprod.122.2o7.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .htc.122.2o7.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.hsselite.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.hsselite.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.hsselite.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .a1.interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .a1.interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .a1.interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .a1.interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .a1.interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .a1.interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .a1.interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .a1.interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        mediaservices-d.openxenterprise.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adserver.adtechus.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        7.rotator.wigetmedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        7.rotator.wigetmedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .bwincom.122.2o7.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.adserverhome.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adinterax.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        banner.testberichte.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        partners.webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ads.pointroll.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .pointroll.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .pointroll.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ads.pointroll.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ads.pointroll.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ads.pointroll.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ads.pointroll.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ads.pointroll.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ads.pointroll.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .h.atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .mmotraffic.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .mmotraffic.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .goclicker.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        tomtailor.dyntracker.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .rotator.wigetmedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        stat.easydate.biz [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        stat.ed.cupidplc.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .advertisingenhanced.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .advertisingenhanced.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .advertisingenhanced.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .mediatraffic.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        tracker.bmtsystem.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .myroitracking.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        trekmedia.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adinterax.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .de.at.atwola.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .eaeacom.112.2o7.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        media.neodau.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        media.neodau.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        media.neodau.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tradetracker.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .account.frogster-online.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tradetracker.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .www.burstnet.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adlegend.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tradetracker.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tradetracker.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.adcocktail.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .www.mobildiscounter.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .yieldmanager.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aekigpdpaho.stats.esomniture.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .paypal.112.2o7.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .stats.paypal.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.popmog.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .c1.atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .c1.atdmt.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        server.adformdsp.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        server.adformdsp.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adformdsp.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        rotation.linuxnewmedia.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        rotation.linuxnewmedia.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aekigndpgfp.stats.esomniture.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.usenext.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.zalando.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .urbia.wwe-media.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .quartermedia.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .quartermedia.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        viewad.exchangecash.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.blogcounter.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.dyntracker.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .flagcounter.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .mm.chitika.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .tracker.vinsight.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.adserver01.de [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .rotator.wigetmedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        7.rotator.wigetmedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\LEHMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4PC4GFIR.DEFAULT\COOKIES.SQLITE ]

cosinus 23.07.2012 13:57
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

murmeltiermu 23.07.2012 14:07
Hallo

danke für deine Hilfe:bussi:

nein es läuft alles normal und ohne Probleme, und ich hab bis jetzt auch keine neuen Meldungen von Avira bekommen :lach:.

Das mit den Browser für "wildes surfen" werde ich mir mal überlegen, denn das ständige neu einloggen nach dem cookies löschen ist schon nervig.

Wie gesagt ich danke dir herzlich und hoffe ich schaff es vorsichtiger zu surfen

gruß Simone:daumenhoc

cosinus 23.07.2012 15:32
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:26 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19