Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Bundespolzei Trojaner (https://www.trojaner-board.de/123227-bundespolzei-trojaner.html)

Charlene 01.09.2012 08:30
Bundespolzei Trojaner
 
Hallo,

ich habe seit gestern eine Bildschirmsperrung durch einen Trojaner, der behaupetet von der Bundespolizei zu sein. Angezeigt wird die Aufforderung per ucash Geld zu überweisen.

Die Sperrung tritt nur auf, wenn der Rechner eine Verbindung zum Internet hat. Ansonsten funktioniert er normal. im Abgesicherten Modus mit Netzwerktreibern kann ich sogar ins Netz, ohne dass es zur Sperrung kommt.

Ich habe als erstes einen OTL-Scan gemacht:

Code:
OTL logfile created on: 01.09.2012 09:10:46 - Run 3
OTL by OldTimer - Version 3.2.58.1    Folder = C:\Users\XXX\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,79 Gb Total Physical Memory | 2,32 Gb Available Physical Memory | 61,16% Memory free
7,59 Gb Paging File | 6,15 Gb Available in Paging File | 81,06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116,44 Gb Total Space | 21,91 Gb Free Space | 18,81% Space Free | Partition Type: NTFS
Drive D: | 329,79 Gb Total Space | 53,53 Gb Free Space | 16,23% Space Free | Partition Type: NTFS
Drive E: | 3,95 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive G: | 465,76 Gb Total Space | 91,18 Gb Free Space | 19,58% Space Free | Partition Type: NTFS
Drive I: | 931,51 Gb Total Space | 189,23 Gb Free Space | 20,31% Space Free | Partition Type: NTFS
 
Computer Name: XXX-PC | User Name: XXX | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.31 19:15:28 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.08.21 11:51:56 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.31 19:15:27 | 002,242,528 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe -- (LBTServ)
SRV:64bit: - [2010.03.05 19:26:38 | 001,425,168 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2010.03.05 19:07:58 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2010.03.05 19:06:22 | 000,831,760 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2009.09.17 20:36:34 | 000,359,552 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Stopped] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent)
SRV:64bit: - [2009.08.06 23:17:46 | 000,118,672 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012.08.31 19:15:28 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.25 14:04:43 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.08.15 23:38:15 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.04.24 12:53:32 | 000,215,688 | ---- | M] (SPAMfighter ApS) [Auto | Stopped] -- C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe -- (SPAMfighter Update Service)
SRV - [2012.03.27 00:45:44 | 000,077,520 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService)
SRV - [2012.03.27 00:38:46 | 000,542,040 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (hshld)
SRV - [2012.03.26 23:45:22 | 000,329,544 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2012.03.26 23:45:18 | 000,363,336 | ---- | M] (AnchorFree Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2012.01.23 13:40:12 | 001,324,680 | ---- | M] (SPAMfighter ApS) [Auto | Stopped] -- C:\Program Files (x86)\Fighters\FighterSuiteService.exe -- (Suite Service)
SRV - [2011.06.28 22:53:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.05 07:22:00 | 001,997,416 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.04.28 08:34:02 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.18 14:01:06 | 000,462,632 | ---- | M] (Nero AG) [Auto | Stopped] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) [Auto | Stopped] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Stopped] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.09.02 08:30:24 | 000,076,056 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,015,128 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2011.06.28 22:53:03 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.06.28 22:53:03 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.06.05 07:22:00 | 000,025,960 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2011.05.18 08:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.25 07:59:16 | 000,694,888 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.08.25 20:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.04.16 20:45:50 | 000,039,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WDKMD.sys -- (wdkmd)
DRV:64bit: - [2010.03.18 07:21:58 | 007,680,512 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64)
DRV:64bit: - [2010.02.27 01:32:11 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010.02.03 15:38:30 | 000,271,872 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2009.12.17 04:42:07 | 000,538,136 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.10.15 11:23:19 | 000,117,760 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2009.09.17 21:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.09.04 07:39:07 | 000,062,464 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2009.08.21 08:48:17 | 000,044,032 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)
DRV:64bit: - [2009.08.20 20:41:37 | 001,800,192 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC)
DRV:64bit: - [2009.08.06 23:17:34 | 000,013,784 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2009.07.21 03:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.20 04:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.06.18 21:18:10 | 000,015,928 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\lullaby.sys -- (lullaby)
DRV:64bit: - [2009.06.10 22:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.13 18:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2008.12.08 17:35:52 | 000,061,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2008.05.24 02:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.07.03 02:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Stopped] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1001\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1001\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.useDBForOrder: ""
FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?src=2&crg=3.1030000.103003&q="
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.sweetim.com/search.asp?src=2&q="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.31 19:15:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.08.23 20:13:47 | 000,000,000 | ---D | M]
 
[2010.10.29 18:36:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2012.08.30 21:58:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\rl45wb5x.default\extensions
[2012.08.30 21:58:11 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2012.08.25 20:10:55 | 000,000,000 | ---D | M] (FT DeepDark) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66}
[2012.08.24 19:30:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.05.01 20:34:40 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.09.19 08:50:01 | 000,000,000 | ---D | M] (Babylon OCR) -- C:\Program Files (x86)\mozilla firefox\extensions\ocr@babylon.com
[2012.08.24 23:57:37 | 000,169,792 | ---- | M] () (No name found) -- C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\EXTENSIONS\{EEE6C361-6118-11DC-9C72-001320C79847}.XPI
[2012.08.31 19:15:28 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.07.22 09:41:02 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.31 19:15:27 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.07.22 09:41:02 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.22 09:41:02 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.22 09:41:02 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.22 09:41:02 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2 - BHO: (My Personal Homepage) - {0538CF1C-8419-4800-ADBB-0C00C799FDA2} - C:\Users\XXX\AppData\Roaming\Genieo\Application\IEPlugins\bin\IEWrapper.dll ()
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3:64bit: - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fsaddin64-0.98.dll File not found
O3 - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fsaddin-0.98.dll File not found
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-1764841805-649058455-644050874-1001\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
O4:64bit: - HKLM..\Run: [ASUS WebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe ()
O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PrnStatusMX] C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe (Marvell Semiconductor, Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Boingo Wi-Fi] C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk ()
O4 - HKLM..\Run: [CommonToolkitTray] C:\Program Files (x86)\Fighters\Tray\FightersTray.exe (SPAMfighter ApS)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [HPUsageTracking] C:\Program Files (x86)\Hewlett-Packard\HP UT\bin\hppusg.exe ()
O4 - HKLM..\Run: [NBAgent] C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 File not found
O4 - HKLM..\Run: [sfagent] C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe (SPAMfighter ApS)
O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" File not found
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1001..\Run: [] C:\Users\XXX\AppData\Local\Temp\xosnacrmwe.exe ()
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1001..\Run: [GenieoSystemTray] C:\Users\XXX\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe ()
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1001..\Run: [GenieoUpdaterService] C:\Users\XXX\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe ()
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1001..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1001..\Run: [smsems] C:\Users\XXX\AppData\Roaming\smsems.dll ()
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1001..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab (Java Plug-in 10.6.2)
O16 - DPF: {CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab (Java Plug-in 1.7.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab (Java Plug-in 1.7.0_06)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3F4AA978-173C-429A-A3E3-4BA569375A93}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.11.18 22:59:22 | 000,000,000 | R--D | M] - E:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2004.11.18 22:25:54 | 000,684,032 | R--- | M] (Electronic Arts Inc.) - E:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2004.11.18 22:58:27 | 000,000,103 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2004.11.14 16:08:54 | 000,929,792 | R--- | M] (Electronic Arts Inc.) - E:\AutoRunGUI.dll -- [ UDF ]
O32 - AutoRun File - [2009.12.14 11:00:22 | 000,008,192 | ---- | M] (Microsoft) - I:\AutoOff.exe -- [ NTFS ]
O32 - AutoRun File - [2010.11.02 15:29:16 | 000,000,073 | ---- | M] () - I:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{ac64562a-c0c4-11df-a5de-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{ac64562a-c0c4-11df-a5de-806e6f6e6963}\Shell\AutoRun\command - "" = E:\setup.exe -- [2004.10.29 12:22:40 | 000,110,592 | R--- | M] (Electronic Arts Inc.)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.30 21:24:59 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
[2012.08.30 21:24:19 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012.08.30 21:19:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA GAMES
[2012.08.30 21:10:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA GAMES
[2012.08.27 08:07:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.08.27 08:06:53 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.08.27 08:06:39 | 000,095,208 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.08.25 14:04:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Google
[2012.08.25 13:53:58 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Decrypt Output
[2012.08.25 13:53:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ePUBee
[2012.08.25 13:53:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ePUBee DRM Removal
[2012.08.25 02:21:33 | 000,000,000 | ---D | C] -- C:\Windows\rescache
[2012.08.24 23:02:31 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM
[2012.08.24 23:02:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SweetIM
[2012.08.24 21:07:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft Anti-Malware
[2012.08.24 21:07:12 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Anti-Malware
[2012.08.24 20:03:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2012.08.24 19:44:27 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2012.08.24 19:41:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2012.08.23 20:13:47 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npdeployJava1.dll
[2012.08.23 20:13:47 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.08.23 20:13:47 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.08.23 07:51:03 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.08.22 08:47:19 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2012.08.22 07:54:31 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Malwarebytes
[2012.08.22 07:54:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.22 07:54:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.22 07:54:03 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.22 07:54:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.17 18:46:51 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Anvsoft
[2012.08.15 09:00:29 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2012.08.15 09:00:29 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rstrui.exe
[2012.08.15 09:00:23 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2012.08.15 09:00:23 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2012.08.15 09:00:23 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2012.08.15 09:00:22 | 000,911,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.08.15 09:00:21 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.08.15 09:00:21 | 000,609,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.08.15 09:00:19 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2012.08.15 09:00:19 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2012.08.15 09:00:19 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2012.08.15 09:00:02 | 000,735,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.08.15 09:00:01 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.08.15 09:00:01 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.08.15 09:00:01 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.08.15 09:00:01 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.08.15 09:00:00 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.08.15 09:00:00 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.08.15 08:59:53 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2012.08.13 19:54:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.08.13 19:53:22 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.08.13 19:53:21 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.08.13 19:53:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2012.08.13 19:48:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012.08.06 06:02:49 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\AnvsoftPdfTools
[2012.08.06 06:02:44 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PDFMate
[2012.08.06 06:02:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFMate
[2012.08.05 12:22:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Hotspot Shield
[2012.08.05 12:22:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF to ePub Converter
[2012.08.05 12:22:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDF to ePub Converter
[2012.08.05 12:22:18 | 000,000,000 | ---D | C] -- C:\Hotspot Shield
[2012.08.05 12:22:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
[2012.08.05 12:22:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hotspot Shield
[2012.08.03 18:24:44 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Calibre Bibliothek
[2012.08.03 18:24:42 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\calibre
[2012.08.03 18:24:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Calibre2
[2012.08.03 18:24:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management
[2012.08.03 18:19:03 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\My Digital Editions
[2012.08.03 18:18:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2008.08.12 06:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.01 09:07:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.01 09:07:12 | 3055,706,112 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.01 08:38:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.01 08:10:38 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.01 08:10:38 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.01 08:08:31 | 001,507,342 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.01 08:08:31 | 000,657,910 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.01 08:08:31 | 000,619,146 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.01 08:08:31 | 000,131,250 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.01 08:08:31 | 000,107,466 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.01 08:08:11 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.01 08:02:35 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe
[2012.09.01 08:02:34 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.31 15:50:54 | 000,155,648 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\smsems.dll
[2012.08.30 21:19:30 | 000,002,234 | ---- | M] () -- C:\Users\Public\Desktop\Die Schlacht um Mittelerde(tm).lnk
[2012.08.27 08:06:28 | 000,095,208 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.08.27 08:06:27 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npdeployJava1.dll
[2012.08.27 08:06:27 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2012.08.27 08:06:27 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.08.27 08:06:27 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.08.27 08:06:27 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.08.26 03:20:46 | 000,002,406 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2012.08.25 03:21:49 | 000,002,025 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2012.08.25 03:20:04 | 000,489,344 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.24 20:00:04 | 000,175,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msclmd.dll
[2012.08.24 20:00:04 | 000,152,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msclmd.dll
[2012.08.24 07:22:39 | 000,618,227 | ---- | M] () -- C:\Users\XXX\Desktop\adwcleaner.exe
[2012.08.22 07:54:05 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.21 11:51:56 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2012.08.16 03:27:17 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\cd.dat
[2012.08.15 23:38:15 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.08.15 23:38:15 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.08.13 19:54:10 | 000,001,785 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.08.13 19:48:16 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012.08.11 21:42:01 | 564,213,232 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.08.06 12:58:52 | 000,065,853 | ---- | M] () -- C:\Users\XXX\ESt2011_Seipp_XXX.elfo
[2012.08.05 12:22:32 | 000,001,035 | ---- | M] () -- C:\Users\XXX\Desktop\PDF to ePub Converter.lnk
[2012.08.03 18:24:28 | 000,000,962 | ---- | M] () -- C:\Users\Public\Desktop\calibre - E-book management.lnk
 
========== Files Created - No Company Name ==========
 
[2012.08.31 15:50:55 | 000,155,648 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\smsems.dll
[2012.08.30 21:19:30 | 000,002,234 | ---- | C] () -- C:\Users\Public\Desktop\Die Schlacht um Mittelerde(tm).lnk
[2012.08.24 07:22:49 | 000,618,227 | ---- | C] () -- C:\Users\XXX\Desktop\adwcleaner.exe
[2012.08.22 07:54:05 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.16 03:27:17 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\cd.dat
[2012.08.13 19:54:10 | 000,001,785 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.08.13 19:48:16 | 000,001,847 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012.08.06 12:58:10 | 000,065,853 | ---- | C] () -- C:\Users\XXX\ESt2011_Seipp_XXX.elfo
[2012.08.05 12:22:32 | 000,001,035 | ---- | C] () -- C:\Users\XXX\Desktop\PDF to ePub Converter.lnk
[2012.08.03 18:24:28 | 000,000,962 | ---- | C] () -- C:\Users\Public\Desktop\calibre - E-book management.lnk
[2012.08.03 18:19:00 | 000,002,192 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions.lnk
[2011.09.19 08:53:03 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.09.19 08:50:07 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2011.08.25 21:10:31 | 000,066,861 | ---- | C] () -- C:\Users\XXX\ESt2010_Seipp_XXX_Jörg.elfo
[2011.07.19 08:52:06 | 000,000,600 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\winscp.rnd
[2011.03.19 18:37:35 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.03.11 13:05:42 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.03.07 20:45:01 | 000,160,936 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2010.10.30 20:44:53 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.10.30 20:44:53 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD7030.DAT
[2010.10.29 19:44:05 | 000,000,034 | -H-- | C] () -- C:\Windows\SysWow64\Converter_sysquict.dat
[2010.10.29 19:43:55 | 000,164,352 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010.10.29 19:43:53 | 003,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll
[2010.10.29 19:43:53 | 000,755,027 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.10.29 19:43:53 | 000,159,839 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.10.29 19:43:53 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.09.15 14:29:47 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\LogonStart.dll
[2010.09.15 14:04:19 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2009.04.08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll
[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg
 
========== LOP Check ==========
 
[2011.12.29 14:28:24 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Amazon
[2012.08.06 06:02:49 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\AnvsoftPdfTools
[2010.10.29 22:10:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Asus WebStorage
[2010.12.25 21:21:44 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Big Fish Games
[2012.08.11 10:46:07 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\BSW
[2012.08.24 22:52:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\calibre
[2012.02.18 16:36:20 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoft
[2012.02.18 16:35:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.08.06 12:43:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\elsterformular
[2012.05.01 15:54:23 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Fighters
[2012.07.02 08:24:55 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\FireShot
[2011.09.20 06:31:56 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Genieo
[2011.09.18 14:01:47 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\JAM Software
[2011.11.05 09:32:16 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Leadertech
[2012.08.30 21:54:24 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
[2012.05.03 20:52:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Sports Interactive
[2012.08.05 10:48:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Vyry
[2012.08.04 18:29:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Yqxoho
[2011.12.15 09:27:48 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
Sonst habe ich noch nichts unternommen. Ich wäre euch für Hilfe sehr dankbar.

cosinus 01.09.2012 14:09
Zitat:
Boot Mode: SafeMode with Networking |
Wenn dieser Modus funktioniert, kannst du erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Charlene 02.09.2012 13:25
So. Das wäre erldigt. Hier die beiden log-Files. Zunächst Malwarebytes

Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.09.01.02

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7601.17514
XXX :: XXX-PC [Administrator]

01.09.2012 18:25:06
mbam-log-2012-09-01 (18-25-06).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|G:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 561556
Laufzeit: 2 Stunde(n), 4 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run| (Trojan.Agent) -> Daten: C:\Users\XXX\AppData\Local\Temp\xosnacrmwe.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|smsems (Spyware.Password) -> Daten: rundll32.exe "C:\Users\XXX\AppData\Roaming\smsems.dll",AGetReport -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Users\XXX\AppData\Local\Temp\xosnacrmwe.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\XXX\AppData\Roaming\smsems.dll (Spyware.Password) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\XXX\AppData\Local\Temp\raeoxnmswc.exe (Spyware.Password) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\XXX\AppData\Local\Temp\raonmswcxe.exe (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Ich hatte tatsächlich schon vorher mal einen Malwarebyte-Scan gemacht, kann aber das log-File dazu leider nicht mehr finden :headbang:

Hier jetzt noch das Ergebnis von ESET:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=009811eb5cb9184887c975ae567df274
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-02 12:08:00
# local_time=2012-09-02 02:08:00 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775166 100 94 223280 83113641 299645 0
# compatibility_mode=5893 16776574 66 85 742747 98206635 0 0
# compatibility_mode=8192 67108863 100 0 394 394 0 0
# scanned=353512
# found=0
# cleaned=0
# scan_time=10916
So, damit wäre ich dann durch. Antivir und die Windows-Firewall sind auch wieder aktiviert.

Nach kurzzeitigem erneuten Zugang zum Internet tauchte wieder der Trojaner auf, den ich davor hatte. siehe hier http://www.trojaner-board.de/122630-...ngefangen.html

Kann mir das nicht erklären. Mein Surfverhalten im Internet hat sich nicht verändert. Warum tauchen jetzt dauernd Trojaner auf, die ich früher nie hatte? Soll ich den Computer komplett neu installieren?

cosinus 03.09.2012 19:13
Schau mal nach ob die Logs noch hier zu sehen sind in Form von Textdateien. Damit du die Ordner auch siehst das hier VORHER umsetzen!! => http://www.trojaner-board.de/59624-a...-sichtbar.html

Hauptlogs nach Scans (Quick, Full oder Flash):
  • XP:
    C:\Dokumente und Einstellungen\(USER)\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-yyyy-mm-dd.txt

  • Vista, Windows 7, 2008:
    C:\Users\(USER)\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-yyyy-mm-dd.txt

Charlene 03.09.2012 19:44
Hat funktionierrt. Hier also zwei 14 Tage alte Scans:

Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.03.05

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Klaus :: XXX-PC [Administrator]

22.08.2012 07:55:45
mbam-log-2012-08-22 (07-55-45).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 101381
Laufzeit: 22 Minute(n), 8 Sekunde(n) [Abgebrochen]

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.23.07

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Klaus :: XXX-PC [Administrator]

23.08.2012 20:16:53
mbam-log-2012-08-23 (20-16-53).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 583886
Laufzeit: 2 Stunde(n), 30 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
und hier noch ein aktueller, den ich jetzt heute durchgeführt habe, nachdem die Sperrung gestern erneut auftrat:

Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.09.01.02

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7601.17514
Klaus :: XXX-PC [Administrator]

03.09.2012 08:46:58
mbam-log-2012-09-03 (08-46-58).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 566471
Laufzeit: 2 Stunde(n), 1 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\XXX\AppData\Local\Temp\roper0dun.exe (Exploit.Drop.GS) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

cosinus 03.09.2012 20:51
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Charlene 03.09.2012 22:52
hier das Ergebnis:

Code:
# AdwCleaner v1.801 - Logfile created 09/03/2012 at 23:44:59
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : XXX - XXX-PC
# Boot Mode : Normal
# Running from : C:\Users\XXX\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}
Folder Found : C:\Users\XXX\AppData\LocalLow\SweetIM
Folder Found : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\SweetPacksToolbarData
Folder Found : C:\ProgramData\SweetIM
Folder Found : C:\Program Files (x86)\SweetIM
File Found : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi

***** [Registry] *****

Key Found : HKCU\Software\SweetIm
Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Key Found : HKLM\SOFTWARE\SweetIM
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Sweetpacks Communicator]
[x64] Key Found : HKCU\Software\SweetIm
[x64] Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
[x64] Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
[x64] Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
[x64] Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
[x64] Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
[x64] Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v15.0 (de)

Profile name : default
File : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\prefs.js

Found : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&crg=3.1030000.103003&q=");
Found : user_pref("sweetim.toolbar.Visibility.VisibilityGuardLastUnHide", "1346484252304");
Found : user_pref("sweetim.toolbar.Visibility.enable", "true");
Found : user_pref("sweetim.toolbar.Visibility.intervaldays", "7");
Found : user_pref("sweetim.toolbar.cargo", "3.1030000.103003");
Found : user_pref("sweetim.toolbar.cda.DisableOveride.enable", "true");
Found : user_pref("sweetim.toolbar.cda.HideOveride.enable", "true");
Found : user_pref("sweetim.toolbar.cda.RemoveOveride.enable", "true");
Found : user_pref("sweetim.toolbar.cda.returnValue", "hide");
Found : user_pref("sweetim.toolbar.dialogs.0.enable", "true");
Found : user_pref("sweetim.toolbar.dialogs.0.handler", "chrome://sim_toolbar_package/content/optionsdialog-h[...]
Found : user_pref("sweetim.toolbar.dialogs.0.height", "335");
Found : user_pref("sweetim.toolbar.dialogs.0.id", "id_options_dialog");
Found : user_pref("sweetim.toolbar.dialogs.0.title", "$string.config.label;");
Found : user_pref("sweetim.toolbar.dialogs.0.url", "hxxp://www.sweetim.com/simffbar/options_remote_ff_1_6.ht[...]
Found : user_pref("sweetim.toolbar.dialogs.0.width", "761");
Found : user_pref("sweetim.toolbar.dialogs.1.enable", "true");
Found : user_pref("sweetim.toolbar.dialogs.1.handler", "chrome://sim_toolbar_package/content/exampledialog-h[...]
Found : user_pref("sweetim.toolbar.dialogs.1.height", "300");
Found : user_pref("sweetim.toolbar.dialogs.1.id", "id_example_dialog");
Found : user_pref("sweetim.toolbar.dialogs.1.title", "Example (unit-test) dialog");
Found : user_pref("sweetim.toolbar.dialogs.1.url", "chrome://sim_toolbar_package/content/exampledialog.html"[...]
Found : user_pref("sweetim.toolbar.dialogs.1.width", "500");
Found : user_pref("sweetim.toolbar.dialogs.2.enable", "true");
Found : user_pref("sweetim.toolbar.dialogs.2.handler", "chrome://sim_toolbar_package/content/cdadialog-handl[...]
Found : user_pref("sweetim.toolbar.dialogs.2.height", "150");
Found : user_pref("sweetim.toolbar.dialogs.2.id", "id_dialog_hide_disable_remove");
Found : user_pref("sweetim.toolbar.dialogs.2.title", "Option Dialog");
Found : user_pref("sweetim.toolbar.dialogs.2.url", "hxxp://www.sweetim.com/simffbar/simcdadialog.asp");
Found : user_pref("sweetim.toolbar.dialogs.2.width", "530");
Found : user_pref("sweetim.toolbar.dnscatch.domain-blacklist", ".*.sweetim.com/.*|.*.facebook.com/.*|.*.goog[...]
Found : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
Found : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
Found : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
Found : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
Found : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
Found : user_pref("sweetim.toolbar.mode.debug", "false");
Found : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&q=");
Found : user_pref("sweetim.toolbar.scripts.0.addcontextdiv", "true");
Found : user_pref("sweetim.toolbar.scripts.0.callback", "simVerification");
Found : user_pref("sweetim.toolbar.scripts.0.domain-blacklist", "");
Found : user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*");
Found : user_pref("sweetim.toolbar.scripts.0.elementid", "id_script_sim_fb");
Found : user_pref("sweetim.toolbar.scripts.0.enable", "true");
Found : user_pref("sweetim.toolbar.scripts.0.id", "id_script_fb");
Found : user_pref("sweetim.toolbar.scripts.0.url", "hxxp://sc.sweetim.com/apps/in/fb/infb.js");
Found : user_pref("sweetim.toolbar.scripts.1.addcontextdiv", "true");
Found : user_pref("sweetim.toolbar.scripts.1.callback", "simVerification");
Found : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Found : user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*");
Found : user_pref("sweetim.toolbar.scripts.1.elementid", "id_script_sim_fb");
Found : user_pref("sweetim.toolbar.scripts.1.enable", "false");
Found : user_pref("sweetim.toolbar.scripts.1.id", "id_script_fb_hxxpS");
Found : user_pref("sweetim.toolbar.scripts.1.url", "hxxps://sc.sweetim.com/apps/in/fb/infb.js");
Found : user_pref("sweetim.toolbar.scripts.2.addcontextdiv", "false");
Found : user_pref("sweetim.toolbar.scripts.2.callback", "");
Found : user_pref("sweetim.toolbar.scripts.2.domain-blacklist", ".*.google..*|.*.bing..*|.*.live..*|.*.msn..[...]
Found : user_pref("sweetim.toolbar.scripts.2.domain-whitelist", "");
Found : user_pref("sweetim.toolbar.scripts.2.elementid", "id_predict_include_script");
Found : user_pref("sweetim.toolbar.scripts.2.enable", "false");
Found : user_pref("sweetim.toolbar.scripts.2.id", "id_script_prad");
Found : user_pref("sweetim.toolbar.scripts.2.url", "hxxp://cdn1.certified-apps.com/scripts/shared/enable.js?[...]
Found : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...]
Found : user_pref("sweetim.toolbar.search.history.capacity", "10");
Found : user_pref("sweetim.toolbar.searchguard.enable", "false");
Found : user_pref("sweetim.toolbar.searchguard.initialized_by_rc", "true");
Found : user_pref("sweetim.toolbar.simapp_id", "{1566AB2C-56FB-4F3B-B0AF-1DE006A172AA}");
Found : user_pref("sweetim.toolbar.version", "1.6.0.3");

*************************

AdwCleaner[R1].txt - [43696 octets] - [24/08/2012 07:24:17]
AdwCleaner[S1].txt - [34065 octets] - [24/08/2012 19:30:40]
AdwCleaner[R2].txt - [10809 octets] - [03/09/2012 23:44:59]

########## EOF - C:\AdwCleaner[R2].txt - [10938 octets] ##########

cosinus 04.09.2012 13:35
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Charlene 04.09.2012 23:14
hier das Ergebnis:

Code:
# AdwCleaner v1.801 - Logfile created 09/05/2012 at 00:06:57
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : XXX - XXX-PC
# Boot Mode : Safe mode with networking
# Running from : C:\Users\XXX\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}
Folder Deleted : C:\Users\XXX\AppData\LocalLow\SweetIM
Folder Deleted : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\SweetPacksToolbarData
Folder Deleted : C:\ProgramData\SweetIM
Folder Deleted : C:\Program Files (x86)\SweetIM
File Deleted : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi

***** [Registry] *****

Key Deleted : HKCU\Software\SweetIm
Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Key Deleted : HKLM\SOFTWARE\SweetIM
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Sweetpacks Communicator]

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v15.0 (de)

Profile name : default
File : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\prefs.js

Deleted : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&crg=3.1030000.103003&q=");
Deleted : user_pref("sweetim.toolbar.Visibility.VisibilityGuardLastUnHide", "1346484252304");
Deleted : user_pref("sweetim.toolbar.Visibility.enable", "true");
Deleted : user_pref("sweetim.toolbar.Visibility.intervaldays", "7");
Deleted : user_pref("sweetim.toolbar.cargo", "3.1030000.103003");
Deleted : user_pref("sweetim.toolbar.cda.DisableOveride.enable", "true");
Deleted : user_pref("sweetim.toolbar.cda.HideOveride.enable", "true");
Deleted : user_pref("sweetim.toolbar.cda.RemoveOveride.enable", "true");
Deleted : user_pref("sweetim.toolbar.cda.returnValue", "hide");
Deleted : user_pref("sweetim.toolbar.dialogs.0.enable", "true");
Deleted : user_pref("sweetim.toolbar.dialogs.0.handler", "chrome://sim_toolbar_package/content/optionsdialog-h[...]
Deleted : user_pref("sweetim.toolbar.dialogs.0.height", "335");
Deleted : user_pref("sweetim.toolbar.dialogs.0.id", "id_options_dialog");
Deleted : user_pref("sweetim.toolbar.dialogs.0.title", "$string.config.label;");
Deleted : user_pref("sweetim.toolbar.dialogs.0.url", "hxxp://www.sweetim.com/simffbar/options_remote_ff_1_6.ht[...]
Deleted : user_pref("sweetim.toolbar.dialogs.0.width", "761");
Deleted : user_pref("sweetim.toolbar.dialogs.1.enable", "true");
Deleted : user_pref("sweetim.toolbar.dialogs.1.handler", "chrome://sim_toolbar_package/content/exampledialog-h[...]
Deleted : user_pref("sweetim.toolbar.dialogs.1.height", "300");
Deleted : user_pref("sweetim.toolbar.dialogs.1.id", "id_example_dialog");
Deleted : user_pref("sweetim.toolbar.dialogs.1.title", "Example (unit-test) dialog");
Deleted : user_pref("sweetim.toolbar.dialogs.1.url", "chrome://sim_toolbar_package/content/exampledialog.html"[...]
Deleted : user_pref("sweetim.toolbar.dialogs.1.width", "500");
Deleted : user_pref("sweetim.toolbar.dialogs.2.enable", "true");
Deleted : user_pref("sweetim.toolbar.dialogs.2.handler", "chrome://sim_toolbar_package/content/cdadialog-handl[...]
Deleted : user_pref("sweetim.toolbar.dialogs.2.height", "150");
Deleted : user_pref("sweetim.toolbar.dialogs.2.id", "id_dialog_hide_disable_remove");
Deleted : user_pref("sweetim.toolbar.dialogs.2.title", "Option Dialog");
Deleted : user_pref("sweetim.toolbar.dialogs.2.url", "hxxp://www.sweetim.com/simffbar/simcdadialog.asp");
Deleted : user_pref("sweetim.toolbar.dialogs.2.width", "530");
Deleted : user_pref("sweetim.toolbar.dnscatch.domain-blacklist", ".*.sweetim.com/.*|.*.facebook.com/.*|.*.goog[...]
Deleted : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
Deleted : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
Deleted : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
Deleted : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
Deleted : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
Deleted : user_pref("sweetim.toolbar.mode.debug", "false");
Deleted : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&q=");
Deleted : user_pref("sweetim.toolbar.scripts.0.addcontextdiv", "true");
Deleted : user_pref("sweetim.toolbar.scripts.0.callback", "simVerification");
Deleted : user_pref("sweetim.toolbar.scripts.0.domain-blacklist", "");
Deleted : user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*");
Deleted : user_pref("sweetim.toolbar.scripts.0.elementid", "id_script_sim_fb");
Deleted : user_pref("sweetim.toolbar.scripts.0.enable", "true");
Deleted : user_pref("sweetim.toolbar.scripts.0.id", "id_script_fb");
Deleted : user_pref("sweetim.toolbar.scripts.0.url", "hxxp://sc.sweetim.com/apps/in/fb/infb.js");
Deleted : user_pref("sweetim.toolbar.scripts.1.addcontextdiv", "true");
Deleted : user_pref("sweetim.toolbar.scripts.1.callback", "simVerification");
Deleted : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Deleted : user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*");
Deleted : user_pref("sweetim.toolbar.scripts.1.elementid", "id_script_sim_fb");
Deleted : user_pref("sweetim.toolbar.scripts.1.enable", "false");
Deleted : user_pref("sweetim.toolbar.scripts.1.id", "id_script_fb_hxxpS");
Deleted : user_pref("sweetim.toolbar.scripts.1.url", "hxxps://sc.sweetim.com/apps/in/fb/infb.js");
Deleted : user_pref("sweetim.toolbar.scripts.2.addcontextdiv", "false");
Deleted : user_pref("sweetim.toolbar.scripts.2.callback", "");
Deleted : user_pref("sweetim.toolbar.scripts.2.domain-blacklist", ".*.google..*|.*.bing..*|.*.live..*|.*.msn..[...]
Deleted : user_pref("sweetim.toolbar.scripts.2.domain-whitelist", "");
Deleted : user_pref("sweetim.toolbar.scripts.2.elementid", "id_predict_include_script");
Deleted : user_pref("sweetim.toolbar.scripts.2.enable", "false");
Deleted : user_pref("sweetim.toolbar.scripts.2.id", "id_script_prad");
Deleted : user_pref("sweetim.toolbar.scripts.2.url", "hxxp://cdn1.certified-apps.com/scripts/shared/enable.js?[...]
Deleted : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...]
Deleted : user_pref("sweetim.toolbar.search.history.capacity", "10");
Deleted : user_pref("sweetim.toolbar.searchguard.enable", "false");
Deleted : user_pref("sweetim.toolbar.searchguard.initialized_by_rc", "true");
Deleted : user_pref("sweetim.toolbar.simapp_id", "{1566AB2C-56FB-4F3B-B0AF-1DE006A172AA}");
Deleted : user_pref("sweetim.toolbar.version", "1.6.0.3");

*************************

AdwCleaner[R1].txt - [43696 octets] - [24/08/2012 07:24:17]
AdwCleaner[S1].txt - [34065 octets] - [24/08/2012 19:30:40]
AdwCleaner[R2].txt - [10904 octets] - [03/09/2012 23:44:59]
AdwCleaner[S2].txt - [9734 octets] - [05/09/2012 00:06:57]

########## EOF - C:\AdwCleaner[S2].txt - [9862 octets] ##########

cosinus 05.09.2012 14:12
Warum hast du die alte Version von adwCleaner genutzt ich hatte extra einen Downloadlink dazu angegeben!

Bitte den adwCleaner neu runterladen!

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Charlene 05.09.2012 20:40
Tut mir leid. Das hatte ich falsch verstanden. Hier also die Datei mit dem neuen Download des Cleaners:

Code:
# AdwCleaner v2.000 - Datei am 09/05/2012 um 21:37:30 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : XXX - XXX-PC
# Normaler Modus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\XXX\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B16632F1-24E0-4D99-A68D-70BFB6447C48}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C0CEA572-2978-4DFC-A672-8100FF0E276A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\BabylonIEPI.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\BabylonTC.EXE
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BabylonTC.GingerApplication
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BabylonTC.GingerApplication.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{0C2E529C-A82C-4AC6-8807-0B51F7AD7BB2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{A1489C85-4F6F-48C4-AC9E-18B63AF4703E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{F310F027-15CB-4A7F-B10D-3A4AFB5013A5}
Schlüssel Gefunden : HKLM\Software\ilivid
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5F339F0B-716F-408F-A627-DEEB5DEB4020}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{5F339F0B-716F-408F-A627-DEEB5DEB4020}

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v15.0 (de)

Profilname : default
Datei : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [43696 octets] - [24/08/2012 07:24:17]
AdwCleaner[S1].txt - [34065 octets] - [24/08/2012 19:30:40]
AdwCleaner[R2].txt - [10904 octets] - [03/09/2012 23:44:59]
AdwCleaner[S2].txt - [9857 octets] - [05/09/2012 00:06:57]
AdwCleaner[R3].txt - [2435 octets] - [05/09/2012 21:37:30]

########## EOF - C:\AdwCleaner[R3].txt - [2495 octets] ##########

cosinus 06.09.2012 13:54
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x=fortlaufende Nummer)

Charlene 06.09.2012 20:23
hier das log-File:

Code:
# AdwCleaner v2.000 - Datei am 09/06/2012 um 21:18:09 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : XXX - XXX-PC
# Normaler Modus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\XXX\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B16632F1-24E0-4D99-A68D-70BFB6447C48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C0CEA572-2978-4DFC-A672-8100FF0E276A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BabylonIEPI.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BabylonTC.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonTC.GingerApplication
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\BabylonTC.GingerApplication.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{0C2E529C-A82C-4AC6-8807-0B51F7AD7BB2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A1489C85-4F6F-48C4-AC9E-18B63AF4703E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{F310F027-15CB-4A7F-B10D-3A4AFB5013A5}
Schlüssel Gelöscht : HKLM\Software\ilivid
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5F339F0B-716F-408F-A627-DEEB5DEB4020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5F339F0B-716F-408F-A627-DEEB5DEB4020}

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.7601.17514

Wiederhergestellt : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v15.0 (de)

Profilname : default
Datei : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [43696 octets] - [24/08/2012 07:24:17]
AdwCleaner[S1].txt - [34065 octets] - [24/08/2012 19:30:40]
AdwCleaner[R2].txt - [10904 octets] - [03/09/2012 23:44:59]
AdwCleaner[S2].txt - [9857 octets] - [05/09/2012 00:06:57]
AdwCleaner[R3].txt - [2562 octets] - [05/09/2012 21:37:30]
AdwCleaner[S3].txt - [2954 octets] - [06/09/2012 21:18:09]

########## EOF - C:\AdwCleaner[S3].txt - [3014 octets] ##########

cosinus 07.09.2012 08:11
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Charlene 07.09.2012 19:21
zu 1.) Ich kann auch im normalen Modus wieder ins Netz gehen. Kann auch keine anderen Beinträchtigungen feststellen
zu 2.) Ich kann nicht sehen, dass irgendwas fehlen würde.

So weit, so gut also. Andererseits dachte ich das beim ersten Versuch den Trojaner los zu werden auch

cosinus 10.09.2012 14:03
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Charlene 10.09.2012 20:43
okay. Das hier ist das Log-File:

Code:
OTL logfile created on: 10.09.2012 20:37:00 - Run 4
OTL by OldTimer - Version 3.2.61.3    Folder = C:\Users\XXX\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,79 Gb Total Physical Memory | 2,55 Gb Available Physical Memory | 67,07% Memory free
7,59 Gb Paging File | 5,55 Gb Available in Paging File | 73,13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116,44 Gb Total Space | 11,09 Gb Free Space | 9,53% Space Free | Partition Type: NTFS
Drive D: | 329,79 Gb Total Space | 42,60 Gb Free Space | 12,92% Space Free | Partition Type: NTFS
Drive E: | 5,54 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive G: | 465,76 Gb Total Space | 90,08 Gb Free Space | 19,34% Space Free | Partition Type: NTFS
Drive I: | 931,51 Gb Total Space | 189,23 Gb Free Space | 20,31% Space Free | Partition Type: NTFS
 
Computer Name: XXX-PC | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.10 20:35:02 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
PRC - [2012.08.27 08:06:27 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Program Files (x86)\Java\jre7\bin\javaw.exe
PRC - [2012.04.24 12:53:32 | 000,215,688 | ---- | M] (SPAMfighter ApS) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe
PRC - [2012.04.24 12:53:26 | 001,197,704 | ---- | M] (SPAMfighter ApS) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe
PRC - [2012.03.26 23:45:22 | 000,329,544 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
PRC - [2012.03.26 23:45:18 | 000,363,336 | ---- | M] (AnchorFree Inc.) -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2012.02.23 12:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
PRC - [2012.02.06 11:14:06 | 000,277,344 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe
PRC - [2012.02.06 11:13:48 | 000,558,944 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe
PRC - [2012.02.02 14:08:46 | 001,453,704 | ---- | M] (SPAMfighter ApS) -- C:\Program Files (x86)\Fighters\Tray\FightersTray.exe
PRC - [2012.01.23 13:40:12 | 001,324,680 | ---- | M] (SPAMfighter ApS) -- C:\Program Files (x86)\Fighters\FighterSuiteService.exe
PRC - [2011.06.28 22:53:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.05 07:22:00 | 001,997,416 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.04.28 08:34:02 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2010.11.03 08:45:14 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.09.15 14:34:36 | 003,058,304 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe
PRC - [2010.02.22 16:17:50 | 001,226,024 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe
PRC - [2010.02.18 14:01:06 | 000,462,632 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2010.01.13 18:19:42 | 000,182,912 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
PRC - [2010.01.13 18:11:52 | 007,109,248 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
PRC - [2010.01.05 22:59:12 | 000,170,624 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
PRC - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
PRC - [2009.11.24 22:45:36 | 000,053,888 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
PRC - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.09.16 02:34:34 | 001,593,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
PRC - [2009.08.12 21:32:56 | 000,365,936 | ---- | M] (Boingo Wireless, Inc.) -- C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
PRC - [2009.07.31 19:38:24 | 000,305,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
PRC - [2009.06.19 19:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
PRC - [2009.06.19 19:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
PRC - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
PRC - [2008.12.23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
PRC - [2008.08.14 06:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
PRC - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
PRC - [2007.11.02 15:52:40 | 000,036,864 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP UT\bin\hppusg.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.26 03:24:03 | 000,310,784 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\2ff4e90c5842525f7a7456639de090d8\System.Runtime.Serialization.Formatters.Soap.ni.dll
MOD - [2012.08.26 03:24:02 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012.08.26 03:23:56 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012.08.26 03:23:40 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.08.26 03:23:37 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.08.26 03:23:36 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.08.26 03:23:29 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012.08.23 20:27:03 | 000,541,696 | ---- | M] () -- C:\Users\XXX\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll
MOD - [2012.05.01 15:54:22 | 002,020,416 | ---- | M] () -- C:\Program Files (x86)\Fighters\SPAMfighter\sfse.dll
MOD - [2012.04.24 12:53:54 | 000,549,512 | ---- | M] () -- C:\Program Files (x86)\Fighters\SPAMfighter\sfsg.dll
MOD - [2012.02.06 11:14:06 | 000,277,344 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe
MOD - [2012.02.06 11:13:48 | 000,558,944 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe
MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.12.08 21:06:24 | 000,010,752 | ---- | M] () -- C:\Windows\assembly\GAC\Interop.hpqusg\3.0.0.0__a53cf5803f4c3827\Interop.hpqusg.dll
MOD - [2010.11.13 01:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.11.24 22:45:36 | 000,053,888 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
MOD - [2009.09.16 02:34:34 | 001,593,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
MOD - [2008.02.07 11:05:18 | 000,163,840 | ---- | M] () -- C:\Windows\SysWOW64\hppatusg01.dll
MOD - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
MOD - [2007.11.02 15:52:40 | 000,057,344 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP UT\bin\HPUsageTracking.dll
MOD - [2007.11.02 15:52:40 | 000,036,864 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP UT\bin\hppusg.exe
MOD - [2007.11.02 15:52:38 | 000,114,688 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP UT\bin\HPToolkit.dll
MOD - [2007.11.02 15:52:38 | 000,036,864 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP UT\bin\Enumeration.dll
MOD - [2007.11.02 15:52:22 | 000,065,536 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP UT\bin\HPTools.dll
MOD - [2007.11.02 15:52:16 | 000,016,384 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP UT\bin\HPStreamsInterface.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe -- (LBTServ)
SRV:64bit: - [2010.03.05 19:26:38 | 001,425,168 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2010.03.05 19:07:58 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2010.03.05 19:06:22 | 000,831,760 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2009.09.17 20:36:34 | 000,359,552 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent)
SRV:64bit: - [2009.08.06 23:17:46 | 000,118,672 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012.09.08 09:13:16 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.09.08 09:09:13 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.08.15 23:38:15 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.04.24 12:53:32 | 000,215,688 | ---- | M] (SPAMfighter ApS) [Auto | Running] -- C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe -- (SPAMfighter Update Service)
SRV - [2012.03.27 00:45:44 | 000,077,520 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService)
SRV - [2012.03.27 00:38:46 | 000,542,040 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (hshld)
SRV - [2012.03.26 23:45:22 | 000,329,544 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2012.03.26 23:45:18 | 000,363,336 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2012.01.23 13:40:12 | 001,324,680 | ---- | M] (SPAMfighter ApS) [Auto | Running] -- C:\Program Files (x86)\Fighters\FighterSuiteService.exe -- (Suite Service)
SRV - [2011.06.28 22:53:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.05 07:22:00 | 001,997,416 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.04.28 08:34:02 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.18 14:01:06 | 000,462,632 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.09.02 08:30:24 | 000,076,056 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,015,128 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2011.06.28 22:53:03 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.06.28 22:53:03 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.06.05 07:22:00 | 000,025,960 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2011.05.18 08:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.25 07:59:16 | 000,694,888 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.08.25 20:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.04.16 20:45:50 | 000,039,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WDKMD.sys -- (wdkmd)
DRV:64bit: - [2010.03.18 07:21:58 | 007,680,512 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64)
DRV:64bit: - [2010.02.27 01:32:11 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010.02.03 15:38:30 | 000,271,872 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2009.12.17 04:42:07 | 000,538,136 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.10.15 11:23:19 | 000,117,760 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2009.09.17 21:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.09.04 07:39:07 | 000,062,464 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2009.08.21 08:48:17 | 000,044,032 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)
DRV:64bit: - [2009.08.20 20:41:37 | 001,800,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC)
DRV:64bit: - [2009.08.06 23:17:34 | 000,013,784 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2009.07.21 03:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.20 04:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.06.18 21:18:10 | 000,015,928 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\lullaby.sys -- (lullaby)
DRV:64bit: - [2009.06.10 22:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.13 18:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2008.12.08 17:35:52 | 000,061,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2008.05.24 02:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.07.03 02:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1001\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1764841805-649058455-644050874-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.useDBForOrder: ""
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.08 09:13:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.08 09:13:13 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.08 09:13:16 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.08 09:13:13 | 000,000,000 | ---D | M]
 
[2010.10.29 18:36:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2012.09.09 21:03:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\rl45wb5x.default\extensions
[2012.08.30 21:58:11 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2012.09.09 21:03:52 | 000,000,000 | ---D | M] (FT DeepDark) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66}
[2012.07.27 00:07:25 | 000,184,864 | ---- | M] () (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\rl45wb5x.default\extensions\stealthyextension@gmail.com.xpi
[2012.08.29 21:58:16 | 003,258,540 | ---- | M] () (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\rl45wb5x.default\extensions\{c0c588b6-b11d-4898-af00-079fed05aa32}.xpi
[2012.09.08 09:13:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.09.08 09:13:11 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.09.08 09:13:11 | 000,000,000 | ---D | M] (Babylon OCR) -- C:\Program Files (x86)\mozilla firefox\extensions\ocr@babylon.com
[2012.09.08 09:13:16 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.07.22 09:41:02 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.31 19:15:27 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.07.22 09:41:02 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.22 09:41:02 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.22 09:41:02 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.22 09:41:02 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (My Personal Homepage) - {0538CF1C-8419-4800-ADBB-0C00C799FDA2} - C:\Users\XXX\AppData\Roaming\Genieo\Application\IEPlugins\bin\IEWrapper.dll ()
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fsaddin64-0.98.dll File not found
O3 - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fsaddin-0.98.dll File not found
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
O4:64bit: - HKLM..\Run: [ASUS WebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe ()
O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PrnStatusMX] C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe (Marvell Semiconductor, Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Boingo Wi-Fi] C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk ()
O4 - HKLM..\Run: [CommonToolkitTray] C:\Program Files (x86)\Fighters\Tray\FightersTray.exe (SPAMfighter ApS)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [HPUsageTracking] C:\Program Files (x86)\Hewlett-Packard\HP UT\bin\hppusg.exe ()
O4 - HKLM..\Run: [NBAgent] C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 File not found
O4 - HKLM..\Run: [sfagent] C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe (SPAMfighter ApS)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" File not found
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1000..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1000..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" File not found
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1001..\Run: [GenieoSystemTray] C:\Users\XXX\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe ()
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1001..\Run: [GenieoUpdaterService] C:\Users\XXX\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe ()
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1001..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1001..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O7 - HKU\S-1-5-21-1764841805-649058455-644050874-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab (Java Plug-in 10.6.2)
O16 - DPF: {CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab (Java Plug-in 1.7.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab (Java Plug-in 1.7.0_06)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3F4AA978-173C-429A-A3E3-4BA569375A93}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.02.04 11:33:12 | 000,000,000 | R--D | M] - E:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2006.02.04 11:33:04 | 000,724,992 | R--- | M] (Electronic Arts Inc.) - E:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2006.01.31 04:56:47 | 000,942,080 | R--- | M] (Electronic Arts Inc.) - E:\AutoRunGUI.dll -- [ UDF ]
O32 - AutoRun File - [2006.02.04 12:03:19 | 000,000,161 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2009.12.14 11:00:22 | 000,008,192 | ---- | M] (Microsoft) - I:\AutoOff.exe -- [ NTFS ]
O32 - Unable to obtain root file information for disk I:\
O33 - MountPoints2\{ac64562a-c0c4-11df-a5de-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{ac64562a-c0c4-11df-a5de-806e6f6e6963}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2006.02.04 11:33:04 | 000,724,992 | R--- | M] (Electronic Arts Inc.)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
 
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)
MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.ac3acm - C:\Windows\SysWow64\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (hxxp://www.mp3dev.org/)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\Windows\SysWow64\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: vidc.i420 - C:\Windows\SysWow64\i420vfw.dll (www.helixcommunity.org)
Drivers32: VIDC.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.10 20:35:11 | 000,600,064 | ---- | C] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2012.09.09 15:53:55 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Edain Mod
[2012.09.09 13:51:30 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Die Schlacht um Mittelerde™ II Vista Patch
[2012.09.09 13:41:16 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Die Schlacht um Beleriand II
[2012.09.09 13:41:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Schlacht um Beleriand II
[2012.09.09 13:40:30 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
[2012.09.09 13:37:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts
[2012.09.09 13:25:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Electronic Arts
[2012.09.09 13:20:18 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\EM 6.1 Fix-Version
[2012.09.09 13:19:59 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Elvenstar Mod
[2012.09.09 13:10:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elvenstar Mod
[2012.09.09 13:09:53 | 017,239,542 | ---- | C] (Elvenstar Team                                              ) -- C:\Users\XXX\Desktop\ElvenstarMod5.7.exe
[2012.09.09 11:30:49 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.09.08 19:31:00 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\ini
[2012.09.08 18:42:45 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\My Battle for Middle-earth Files
[2012.09.08 09:13:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.09.02 10:59:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.08.30 21:24:59 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
[2012.08.30 21:24:19 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012.08.30 21:19:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA GAMES
[2012.08.30 21:10:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA GAMES
[2012.08.27 08:07:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.08.25 14:04:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Google
[2012.08.25 13:53:58 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Decrypt Output
[2012.08.25 02:21:33 | 000,000,000 | ---D | C] -- C:\Windows\rescache
[2012.08.24 21:07:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft Anti-Malware
[2012.08.24 21:07:12 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Anti-Malware
[2012.08.24 20:03:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2012.08.24 19:44:27 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2012.08.24 19:41:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2012.08.23 07:51:03 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.08.22 07:54:31 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Malwarebytes
[2012.08.22 07:54:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.22 07:54:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.22 07:54:03 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.22 07:54:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.17 18:46:51 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Anvsoft
[2012.08.13 19:54:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.08.13 19:53:22 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.08.13 19:53:21 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.08.13 19:53:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2012.08.13 19:48:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2008.08.12 06:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.10 20:38:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.10 20:35:02 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2012.09.10 20:08:02 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.10 20:08:01 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.10 19:23:29 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.10 19:23:29 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.10 19:14:56 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe
[2012.09.10 19:14:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.10 19:14:29 | 3055,706,112 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.09 15:53:56 | 000,000,345 | ---- | M] () -- C:\Users\XXX\Desktop\Edain Mod Switcher.lnk
[2012.09.09 13:45:07 | 000,000,305 | ---- | M] () -- C:\Users\XXX\Desktop\The Battle for Numenor.lnk
[2012.09.09 13:41:16 | 000,002,321 | ---- | M] () -- C:\Users\XXX\Desktop\Die Schlacht um Beleriand II starten.lnk
[2012.09.09 13:38:28 | 000,002,293 | ---- | M] () -- C:\Users\Public\Desktop\Die Schlacht um Mittelerde™ II.lnk
[2012.09.09 13:20:08 | 000,001,294 | ---- | M] () -- C:\Users\XXX\Desktop\ElvenstarMod 6.0.lnk
[2012.09.09 13:10:31 | 000,002,236 | ---- | M] () -- C:\Users\XXX\Desktop\Elvenstar Mod 5.7.lnk
[2012.09.07 08:17:35 | 001,507,342 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.07 08:17:35 | 000,657,910 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.07 08:17:35 | 000,619,146 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.07 08:17:35 | 000,131,250 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.07 08:17:35 | 000,107,466 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.05 21:36:30 | 000,511,265 | ---- | M] () -- C:\Users\XXX\Desktop\adwcleaner.exe
[2012.09.03 08:31:50 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad
[2012.08.30 21:19:30 | 000,002,234 | ---- | M] () -- C:\Users\Public\Desktop\Die Schlacht um Mittelerde(tm).lnk
[2012.08.26 03:20:46 | 000,002,406 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2012.08.25 03:21:49 | 000,002,025 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2012.08.25 03:20:04 | 000,489,344 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.22 07:54:05 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.16 03:27:17 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\cd.dat
[2012.08.13 19:54:10 | 000,001,785 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.08.13 19:48:16 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012.08.11 21:42:01 | 564,213,232 | ---- | M] () -- C:\Windows\MEMORY.DMP
 
========== Files Created - No Company Name ==========
 
[2012.09.09 15:53:56 | 000,000,345 | ---- | C] () -- C:\Users\XXX\Desktop\Edain Mod Switcher.lnk
[2012.09.09 13:45:07 | 000,000,305 | ---- | C] () -- C:\Users\XXX\Desktop\The Battle for Numenor.lnk
[2012.09.09 13:41:16 | 000,002,321 | ---- | C] () -- C:\Users\XXX\Desktop\Die Schlacht um Beleriand II starten.lnk
[2012.09.09 13:38:28 | 000,002,293 | ---- | C] () -- C:\Users\Public\Desktop\Die Schlacht um Mittelerde™ II.lnk
[2012.09.09 13:20:00 | 000,001,294 | ---- | C] () -- C:\Users\XXX\Desktop\ElvenstarMod 6.0.lnk
[2012.09.09 13:10:31 | 000,002,236 | ---- | C] () -- C:\Users\XXX\Desktop\Elvenstar Mod 5.7.lnk
[2012.09.08 18:41:45 | 000,640,335 | ---- | C] (                                                            ) -- C:\Users\XXX\Desktop\Carn Dûm (MP for fast comps).exe
[2012.09.03 08:28:38 | 004,503,728 | ---- | C] () -- C:\ProgramData\nud0repor.pad
[2012.08.30 21:19:30 | 000,002,234 | ---- | C] () -- C:\Users\Public\Desktop\Die Schlacht um Mittelerde(tm).lnk
[2012.08.24 07:22:49 | 000,511,265 | ---- | C] () -- C:\Users\XXX\Desktop\adwcleaner.exe
[2012.08.22 07:54:05 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.16 03:27:17 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\cd.dat
[2012.08.13 19:54:10 | 000,001,785 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.08.13 19:48:16 | 000,001,847 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012.08.06 12:58:10 | 000,065,853 | ---- | C] () -- C:\Users\XXX\ESt2011_Seipp_XXX.elfo
[2011.09.19 08:53:03 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.09.19 08:50:07 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2011.08.25 21:10:31 | 000,066,861 | ---- | C] () -- C:\Users\XXX\ESt2010_Seipp_XXX_Jörg.elfo
[2011.07.19 08:52:06 | 000,000,600 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\winscp.rnd
[2011.03.19 18:37:35 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.03.11 13:05:42 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.03.07 20:45:01 | 000,160,936 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2010.10.30 20:44:53 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.10.30 20:44:53 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD7030.DAT
[2010.10.29 19:44:05 | 000,000,034 | -H-- | C] () -- C:\Windows\SysWow64\Converter_sysquict.dat
[2010.10.29 19:43:55 | 000,164,352 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010.10.29 19:43:53 | 003,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll
[2010.10.29 19:43:53 | 000,755,027 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.10.29 19:43:53 | 000,159,839 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.10.29 19:43:53 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.09.15 14:29:47 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\LogonStart.dll
[2010.09.15 14:04:19 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2009.04.08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll
[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg
 
========== LOP Check ==========
 
[2011.12.29 14:28:24 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Amazon
[2012.08.06 06:02:49 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\AnvsoftPdfTools
[2010.10.29 22:10:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Asus WebStorage
[2010.12.25 21:21:44 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Big Fish Games
[2012.08.11 10:46:07 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\BSW
[2012.08.24 22:52:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\calibre
[2012.02.18 16:36:20 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoft
[2012.02.18 16:35:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.08.06 12:43:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\elsterformular
[2012.05.01 15:54:23 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Fighters
[2012.07.02 08:24:55 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\FireShot
[2011.09.20 06:31:56 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Genieo
[2011.09.18 14:01:47 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\JAM Software
[2011.11.05 09:32:16 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Leadertech
[2012.09.02 14:34:34 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
[2012.09.09 14:21:47 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
[2012.09.08 18:42:45 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\My Battle for Middle-earth Files
[2012.05.03 20:52:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Sports Interactive
[2012.08.05 10:48:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Vyry
[2012.08.04 18:29:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Yqxoho
[2011.12.15 09:27:48 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.08.05 14:19:38 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Adobe
[2011.12.29 14:28:24 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Amazon
[2012.08.06 06:02:49 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\AnvsoftPdfTools
[2012.05.01 14:44:03 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Apple Computer
[2010.10.29 22:10:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Asus WebStorage
[2010.12.28 20:45:36 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Avira
[2010.12.25 21:21:44 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Big Fish Games
[2010.11.17 21:15:43 | 000,000,000 | R--D | M] -- C:\Users\XXX\AppData\Roaming\Brother
[2012.08.11 10:46:07 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\BSW
[2012.08.24 22:52:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\calibre
[2010.12.21 22:27:20 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\CyberLink
[2012.02.18 16:36:20 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoft
[2012.02.18 16:35:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.08.06 12:43:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\elsterformular
[2012.05.01 15:54:23 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Fighters
[2012.07.02 08:24:55 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\FireShot
[2011.09.20 06:31:56 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Genieo
[2012.08.25 14:04:35 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Google
[2010.12.08 21:04:59 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Hewlett-Packard
[2010.12.08 21:04:32 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\HP
[2010.10.29 18:31:13 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Identities
[2010.10.29 18:31:55 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Intel
[2011.09.18 14:01:47 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\JAM Software
[2011.11.05 09:32:16 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Leadertech
[2011.11.05 09:30:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Logishrd
[2011.11.05 09:33:08 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Logitech
[2010.10.29 18:33:22 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Macromedia
[2012.08.22 07:54:31 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Malwarebytes
[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Media Center Programs
[2010.11.27 15:56:30 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Media Player Classic
[2012.09.02 14:34:34 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
[2012.09.09 14:21:47 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
[2012.06.23 08:48:58 | 000,000,000 | --SD | M] -- C:\Users\XXX\AppData\Roaming\Microsoft
[2010.10.29 18:36:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Mozilla
[2012.09.08 18:42:45 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\My Battle for Middle-earth Files
[2010.10.30 18:50:36 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Nero
[2012.08.30 07:40:52 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Skype
[2011.11.13 13:21:02 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\skypePM
[2012.05.03 20:52:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Sports Interactive
[2012.05.05 13:32:25 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\vlc
[2012.08.05 10:48:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Vyry
[2010.10.29 19:18:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\WinRAR
[2012.08.04 18:29:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Yqxoho
 
< %APPDATA%\*.exe /s >
[2012.08.06 12:36:08 | 021,877,160 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\XXX\AppData\Roaming\elsterformular\update\ElsterFormular_update-12_3_2_6814p.exe
[2012.02.06 11:12:06 | 000,028,000 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Engine\bin\debugInfoCollector.exe
[2012.02.06 11:12:02 | 000,048,992 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Engine\bin\genieo.exe
[2012.02.06 11:12:04 | 000,045,920 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Engine\bin\genieo_console.exe
[2012.02.06 11:11:10 | 000,046,944 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Engine\lib\genieutils.exe
[2011.09.19 10:00:34 | 000,082,229 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Partner\avg2\bin\license.exe
[2011.09.19 10:00:36 | 000,051,792 | ---- | M] (Genieo Innovation LTD) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Partner\uninstall\avg2\partner_uninstall.exe
[2012.02.06 11:13:48 | 000,558,944 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe
[2012.02.07 07:37:14 | 000,038,058 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\uninstall\chrome_ext_uninstall.exe
[2012.02.07 07:37:14 | 000,036,091 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\uninstall\ff_ext_uninstall.exe
[2012.09.10 20:45:35 | 000,033,397 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Genieo\Application\uninstall\firsttime_uninstall.exe
[2012.02.07 07:38:00 | 000,034,521 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\uninstall\framework_uninstall.exe
[2012.02.07 07:37:09 | 000,034,439 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\uninstall\ieplugins_uninstall.exe
[2012.02.07 07:37:14 | 000,038,028 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\uninstall\opera_ext_uninstall.exe
[2011.09.20 06:32:19 | 000,033,568 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Genieo\Application\uninstall\prepenv_uninstall.exe
[2012.02.07 07:37:12 | 000,034,453 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\uninstall\trayapp_uninstall.exe
[2012.02.06 11:14:08 | 000,045,728 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Updater\bin\firsttime_setup.exe
[2012.02.06 11:14:06 | 000,277,344 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe
[2011.08.31 19:21:04 | 000,710,360 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Updater\genieo_temp\genieo_setup.exe
[2011.08.31 19:21:02 | 000,468,792 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Updater\genieo_temp\InstallAVGHomepage.exe
[2012.02.07 07:36:52 | 000,073,283 | ---- | M] (Genieo Innovation Ltd.) -- C:\Users\XXX\AppData\Roaming\Genieo\Application\Updater\uninstall\updater_uninstall.exe
[2011.11.05 09:32:15 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\XXX\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
[2012.08.30 21:14:10 | 000,060,824 | ---- | M] (getfireshot.com) -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\crashreporter.exe
[2012.08.30 21:14:08 | 000,145,816 | ---- | M] (getfireshot.com) -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fireshot-container.exe
[2012.08.30 21:13:42 | 000,074,648 | ---- | M] (getfireshot.com) -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fireshot-deploy.exe
 
< %SYSTEMDRIVE%\*.exe >
[2012.07.25 20:39:46 | 003,360,256 | ---- | M] (© by Turin Turumbar Productions) -- C:\edainmodstarter.exe
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2009.12.17 04:42:07 | 000,538,136 | ---- | M] (Intel Corporation) MD5=42E00996DFC13C46366689C0EA8ABC5E -- C:\eSupport\eDriver\Software\IRST\64\IASTOR.SYS
[2009.12.17 04:42:07 | 000,538,136 | ---- | M] (Intel Corporation) MD5=42E00996DFC13C46366689C0EA8ABC5E -- C:\Windows\SysNative\drivers\iaStor.sys
[2009.12.17 04:42:07 | 000,538,136 | ---- | M] (Intel Corporation) MD5=42E00996DFC13C46366689C0EA8ABC5E -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_f26ae7769ab43067\iaStor.sys
[2009.12.17 04:25:25 | 000,433,176 | ---- | M] (Intel Corporation) MD5=8CDACD4AD63D49834C6B59DB102E7CD7 -- C:\eSupport\eDriver\Software\IRST\32\IASTOR.SYS
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.09.15 14:04:24 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010.09.15 14:04:24 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >

cosinus 10.09.2012 22:03
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
FF - user.js - File not found
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.useDBForOrder: ""
O4 - HKU\S-1-5-21-1764841805-649058455-644050874-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O7 - HKU\S-1-5-21-1764841805-649058455-644050874-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.02.04 11:33:12 | 000,000,000 | R--D | M] - E:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2006.02.04 11:33:04 | 000,724,992 | R--- | M] (Electronic Arts Inc.) - E:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2006.01.31 04:56:47 | 000,942,080 | R--- | M] (Electronic Arts Inc.) - E:\AutoRunGUI.dll -- [ UDF ]
O32 - AutoRun File - [2006.02.04 12:03:19 | 000,000,161 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2009.12.14 11:00:22 | 000,008,192 | ---- | M] (Microsoft) - I:\AutoOff.exe -- [ NTFS ]
O32 - Unable to obtain root file information for disk I:\
O33 - MountPoints2\{ac64562a-c0c4-11df-a5de-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{ac64562a-c0c4-11df-a5de-806e6f6e6963}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2006.02.04 11:33:04 | 000,724,992 | R--- | M] (Electronic Arts Inc.)
:Files
C:\Users\XXX\AppData\Roaming\Yqxoho
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Charlene 11.09.2012 06:03
hier das Log-File dazu:

Code:
All processes killed
========== OTL ==========
Prefs.js: "" removed from browser.search.defaultenginename
Prefs.js: "" removed from browser.search.useDBForOrder
Registry value HKEY_USERS\S-1-5-21-1764841805-649058455-644050874-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1764841805-649058455-644050874-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File  not found.
File move failed. E:\AutoRun.exe scheduled to be moved on reboot.
File move failed. E:\AutoRunGUI.dll scheduled to be moved on reboot.
File move failed. E:\autorun.inf scheduled to be moved on reboot.
I:\AutoOff.exe moved successfully.
File  not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ac64562a-c0c4-11df-a5de-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ac64562a-c0c4-11df-a5de-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ac64562a-c0c4-11df-a5de-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ac64562a-c0c4-11df-a5de-806e6f6e6963}\ not found.
File move failed. E:\AutoRun.exe scheduled to be moved on reboot.
========== FILES ==========
C:\Users\XXX\AppData\Roaming\Yqxoho folder moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\XXX\Desktop\cmd.bat deleted successfully.
C:\Users\XXX\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: XXX
->Temp folder emptied: 1618838505 bytes
->Temporary Internet Files folder emptied: 51687264 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 672857036 bytes
->Flash cache emptied: 11493 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 371834 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 2.235,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.61.3 log created on 09112012_065022

Files\Folders moved on Reboot...
File move failed. E:\AutoRun.exe scheduled to be moved on reboot.
File move failed. E:\AutoRunGUI.dll scheduled to be moved on reboot.
File move failed. E:\autorun.inf scheduled to be moved on reboot.
C:\Users\XXX\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

cosinus 11.09.2012 15:56
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

Charlene 11.09.2012 20:02
so geschehen. Es wurden zwei threats gemeldet die ich mit skip behandelt habe. Hier das Log-File:

Code:
20:56:45.0297 7276  TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
20:56:47.0300 7276  ============================================================
20:56:47.0300 7276  Current date / time: 2012/09/11 20:56:47.0300
20:56:47.0300 7276  SystemInfo:
20:56:47.0300 7276 
20:56:47.0300 7276  OS Version: 6.1.7601 ServicePack: 1.0
20:56:47.0300 7276  Product type: Workstation
20:56:47.0300 7276  ComputerName: XXX-PC
20:56:47.0301 7276  UserName: XXX
20:56:47.0301 7276  Windows directory: C:\Windows
20:56:47.0301 7276  System windows directory: C:\Windows
20:56:47.0301 7276  Running under WOW64
20:56:47.0301 7276  Processor architecture: Intel x64
20:56:47.0301 7276  Number of processors: 4
20:56:47.0301 7276  Page size: 0x1000
20:56:47.0301 7276  Boot type: Normal boot
20:56:47.0301 7276  ============================================================
20:56:47.0948 7276  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:56:47.0955 7276  Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:56:48.0298 7276  Drive \Device\Harddisk2\DR2 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:56:48.0303 7276  ============================================================
20:56:48.0303 7276  \Device\Harddisk0\DR0:
20:56:48.0303 7276  MBR partitions:
20:56:48.0303 7276  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2711676, BlocksNum 0xE8E0168
20:56:48.0326 7276  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x10FF2000, BlocksNum 0x29393800
20:56:48.0326 7276  \Device\Harddisk1\DR1:
20:56:48.0426 7276  MBR partitions:
20:56:48.0426 7276  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02
20:56:48.0426 7276  \Device\Harddisk2\DR2:
20:56:48.0427 7276  MBR partitions:
20:56:48.0427 7276  \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800
20:56:48.0427 7276  ============================================================
20:56:48.0467 7276  C: <-> \Device\Harddisk0\DR0\Partition1
20:56:48.0497 7276  D: <-> \Device\Harddisk0\DR0\Partition2
20:56:48.0543 7276  G: <-> \Device\Harddisk1\DR1\Partition1
20:56:48.0881 7276  I: <-> \Device\Harddisk2\DR2\Partition1
20:56:48.0881 7276  ============================================================
20:56:48.0881 7276  Initialize success
20:56:48.0881 7276  ============================================================
20:58:26.0731 7228  ============================================================
20:58:26.0731 7228  Scan started
20:58:26.0731 7228  Mode: Manual; SigCheck; TDLFS;
20:58:26.0731 7228  ============================================================
20:58:29.0568 7228  ================ Scan system memory ========================
20:58:29.0568 7228  System memory - ok
20:58:29.0569 7228  ================ Scan services =============================
20:58:29.0763 7228  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
20:58:29.0865 7228  1394ohci - ok
20:58:29.0902 7228  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
20:58:29.0925 7228  ACPI - ok
20:58:29.0956 7228  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
20:58:30.0008 7228  AcpiPmi - ok
20:58:30.0181 7228  [ A9D3B95E8466BD58EEB8A1154654E162 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
20:58:30.0204 7228  AdobeFlashPlayerUpdateSvc - ok
20:58:30.0277 7228  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
20:58:30.0307 7228  adp94xx - ok
20:58:30.0349 7228  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
20:58:30.0376 7228  adpahci - ok
20:58:30.0413 7228  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
20:58:30.0439 7228  adpu320 - ok
20:58:30.0483 7228  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
20:58:30.0560 7228  AeLookupSvc - ok
20:58:30.0590 7228  [ FB2BE0BAE9B3F248080CDBF91EF16C7F ] AFBAgent        C:\Windows\system32\FBAgent.exe
20:58:30.0621 7228  AFBAgent - ok
20:58:30.0678 7228  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
20:58:30.0727 7228  AFD - ok
20:58:30.0773 7228  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
20:58:30.0792 7228  agp440 - ok
20:58:30.0825 7228  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
20:58:30.0861 7228  ALG - ok
20:58:30.0892 7228  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
20:58:30.0907 7228  aliide - ok
20:58:30.0919 7228  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
20:58:30.0932 7228  amdide - ok
20:58:30.0969 7228  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
20:58:31.0003 7228  AmdK8 - ok
20:58:31.0017 7228  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
20:58:31.0051 7228  AmdPPM - ok
20:58:31.0082 7228  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
20:58:31.0097 7228  amdsata - ok
20:58:31.0133 7228  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
20:58:31.0151 7228  amdsbs - ok
20:58:31.0164 7228  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
20:58:31.0177 7228  amdxata - ok
20:58:31.0218 7228  [ 9C7F164B49CADC658D1B3C575782F346 ] AmUStor        C:\Windows\system32\drivers\AmUStor.SYS
20:58:31.0255 7228  AmUStor - ok
20:58:31.0373 7228  [ C27D46B06D340293670450FCE9DFB166 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
20:58:31.0390 7228  AntiVirSchedulerService - ok
20:58:31.0435 7228  [ 72D90E56563165984224493069C69ED4 ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
20:58:31.0447 7228  AntiVirService - ok
20:58:31.0505 7228  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
20:58:31.0577 7228  AppID - ok
20:58:31.0615 7228  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
20:58:31.0693 7228  AppIDSvc - ok
20:58:31.0756 7228  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo        C:\Windows\System32\appinfo.dll
20:58:31.0816 7228  Appinfo - ok
20:58:31.0939 7228  [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:58:31.0956 7228  Apple Mobile Device - ok
20:58:31.0989 7228  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\DRIVERS\arc.sys
20:58:32.0010 7228  arc - ok
20:58:32.0026 7228  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
20:58:32.0040 7228  arcsas - ok
20:58:32.0100 7228  [ 18E5C2F937F9DEB8C282DF66A3761925 ] ASLDRService    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
20:58:32.0119 7228  ASLDRService - ok
20:58:32.0134 7228  [ 4C016FD76ED5C05E84CA8CAB77993961 ] ASMMAP64        C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys
20:58:32.0145 7228  ASMMAP64 - ok
20:58:32.0178 7228  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
20:58:32.0263 7228  AsyncMac - ok
20:58:32.0325 7228  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
20:58:32.0346 7228  atapi - ok
20:58:32.0401 7228  [ E857EEE6B92AAA473EBB3465ADD8F7E7 ] athr            C:\Windows\system32\DRIVERS\athrx.sys
20:58:32.0497 7228  athr - ok
20:58:32.0527 7228  [ 7910158929571214A959D5A6D16DD9C0 ] ATKGFNEXSrv    C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
20:58:32.0539 7228  ATKGFNEXSrv - ok
20:58:32.0600 7228  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:58:32.0678 7228  AudioEndpointBuilder - ok
20:58:32.0689 7228  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
20:58:32.0729 7228  AudioSrv - ok
20:58:32.0780 7228  [ B1224E6B086CD6548315B04AB575A23E ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
20:58:32.0793 7228  avgntflt - ok
20:58:32.0826 7228  [ ED45F12CFA62B83765C9C1496758CC87 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
20:58:32.0841 7228  avipbb - ok
20:58:32.0898 7228  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
20:58:32.0948 7228  AxInstSV - ok
20:58:33.0016 7228  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbda.sys
20:58:33.0060 7228  b06bdrv - ok
20:58:33.0097 7228  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
20:58:33.0137 7228  b57nd60a - ok
20:58:33.0203 7228  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
20:58:33.0242 7228  BDESVC - ok
20:58:33.0272 7228  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
20:58:33.0340 7228  Beep - ok
20:58:33.0434 7228  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
20:58:33.0528 7228  BFE - ok
20:58:33.0564 7228  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll
20:58:33.0647 7228  BITS - ok
20:58:33.0681 7228  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
20:58:33.0726 7228  blbdrive - ok
20:58:33.0817 7228  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
20:58:33.0844 7228  Bonjour Service - ok
20:58:33.0877 7228  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
20:58:33.0900 7228  bowser - ok
20:58:33.0934 7228  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
20:58:33.0971 7228  BrFiltLo - ok
20:58:33.0989 7228  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
20:58:34.0015 7228  BrFiltUp - ok
20:58:34.0053 7228  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
20:58:34.0082 7228  Browser - ok
20:58:34.0109 7228  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
20:58:34.0150 7228  Brserid - ok
20:58:34.0170 7228  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
20:58:34.0192 7228  BrSerWdm - ok
20:58:34.0212 7228  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
20:58:34.0241 7228  BrUsbMdm - ok
20:58:34.0254 7228  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
20:58:34.0273 7228  BrUsbSer - ok
20:58:34.0294 7228  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
20:58:34.0317 7228  BTHMODEM - ok
20:58:34.0367 7228  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
20:58:34.0428 7228  bthserv - ok
20:58:34.0460 7228  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
20:58:34.0497 7228  cdfs - ok
20:58:34.0542 7228  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\drivers\cdrom.sys
20:58:34.0579 7228  cdrom - ok
20:58:34.0636 7228  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
20:58:34.0708 7228  CertPropSvc - ok
20:58:34.0740 7228  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
20:58:34.0756 7228  circlass - ok
20:58:34.0802 7228  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
20:58:34.0832 7228  CLFS - ok
20:58:34.0907 7228  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:58:34.0923 7228  clr_optimization_v2.0.50727_32 - ok
20:58:34.0966 7228  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
20:58:34.0978 7228  clr_optimization_v2.0.50727_64 - ok
20:58:35.0038 7228  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:58:35.0071 7228  clr_optimization_v4.0.30319_32 - ok
20:58:35.0113 7228  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
20:58:35.0130 7228  clr_optimization_v4.0.30319_64 - ok
20:58:35.0160 7228  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
20:58:35.0195 7228  CmBatt - ok
20:58:35.0225 7228  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
20:58:35.0242 7228  cmdide - ok
20:58:35.0302 7228  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG            C:\Windows\system32\Drivers\cng.sys
20:58:35.0365 7228  CNG - ok
20:58:35.0409 7228  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
20:58:35.0430 7228  Compbatt - ok
20:58:35.0465 7228  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
20:58:35.0526 7228  CompositeBus - ok
20:58:35.0537 7228  COMSysApp - ok
20:58:35.0548 7228  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
20:58:35.0559 7228  crcdisk - ok
20:58:35.0607 7228  [ 4F5414602E2544A4554D95517948B705 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
20:58:35.0621 7228  CryptSvc - ok
20:58:35.0672 7228  [ 7AF9DAC504FBD047CBC3E64AE52C92BF ] dc3d            C:\Windows\system32\DRIVERS\dc3d.sys
20:58:35.0704 7228  dc3d - ok
20:58:35.0756 7228  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
20:58:35.0831 7228  DcomLaunch - ok
20:58:35.0861 7228  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
20:58:35.0915 7228  defragsvc - ok
20:58:35.0954 7228  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
20:58:36.0039 7228  DfsC - ok
20:58:36.0071 7228  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
20:58:36.0129 7228  Dhcp - ok
20:58:36.0153 7228  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
20:58:36.0205 7228  discache - ok
20:58:36.0233 7228  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys
20:58:36.0245 7228  Disk - ok
20:58:36.0274 7228  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
20:58:36.0300 7228  Dnscache - ok
20:58:36.0334 7228  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
20:58:36.0404 7228  dot3svc - ok
20:58:36.0441 7228  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
20:58:36.0492 7228  DPS - ok
20:58:36.0526 7228  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
20:58:36.0553 7228  drmkaud - ok
20:58:36.0619 7228  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
20:58:36.0692 7228  DXGKrnl - ok
20:58:36.0723 7228  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
20:58:36.0765 7228  EapHost - ok
20:58:36.0863 7228  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\DRIVERS\evbda.sys
20:58:36.0994 7228  ebdrv - ok
20:58:37.0024 7228  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
20:58:37.0045 7228  EFS - ok
20:58:37.0120 7228  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
20:58:37.0180 7228  ehRecvr - ok
20:58:37.0218 7228  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
20:58:37.0254 7228  ehSched - ok
20:58:37.0304 7228  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
20:58:37.0338 7228  elxstor - ok
20:58:37.0380 7228  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
20:58:37.0407 7228  ErrDev - ok
20:58:37.0432 7228  [ 3C38648375B7F3988691F53A7AAE10A9 ] ETD            C:\Windows\system32\DRIVERS\ETD.sys
20:58:37.0458 7228  ETD - ok
20:58:37.0497 7228  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
20:58:37.0572 7228  EventSystem - ok
20:58:37.0684 7228  [ B56D9602DB5FE1C116B1CA5EFD8E2E50 ] EvtEng          C:\Program Files\Intel\WiFi\bin\EvtEng.exe
20:58:37.0748 7228  EvtEng - ok
20:58:37.0773 7228  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
20:58:37.0823 7228  exfat - ok
20:58:37.0855 7228  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
20:58:37.0912 7228  fastfat - ok
20:58:37.0974 7228  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
20:58:38.0041 7228  Fax - ok
20:58:38.0066 7228  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
20:58:38.0108 7228  fdc - ok
20:58:38.0140 7228  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
20:58:38.0198 7228  fdPHost - ok
20:58:38.0208 7228  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
20:58:38.0247 7228  FDResPub - ok
20:58:38.0278 7228  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
20:58:38.0309 7228  FileInfo - ok
20:58:38.0309 7228  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
20:58:38.0372 7228  Filetrace - ok
20:58:38.0372 7228  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
20:58:38.0403 7228  flpydisk - ok
20:58:38.0434 7228  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
20:58:38.0460 7228  FltMgr - ok
20:58:38.0492 7228  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache      C:\Windows\system32\FntCache.dll
20:58:38.0574 7228  FontCache - ok
20:58:38.0622 7228  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
20:58:38.0637 7228  FontCache3.0.0.0 - ok
20:58:38.0655 7228  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
20:58:38.0671 7228  FsDepends - ok
20:58:38.0723 7228  [ 5814011B2F6E088E29D689B5FCD49B8F ] fssfltr        C:\Windows\system32\DRIVERS\fssfltr.sys
20:58:38.0733 7228  fssfltr - ok
20:58:38.0816 7228  [ F6717211C1EC2CDDAA81B97B0727C2E9 ] fsssvc          C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
20:58:38.0851 7228  fsssvc - ok
20:58:38.0883 7228  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
20:58:38.0904 7228  Fs_Rec - ok
20:58:38.0950 7228  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
20:58:38.0982 7228  fvevol - ok
20:58:39.0012 7228  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
20:58:39.0025 7228  gagp30kx - ok
20:58:39.0077 7228  [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM    C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
20:58:39.0087 7228  GEARAspiWDM - ok
20:58:39.0138 7228  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
20:58:39.0218 7228  gpsvc - ok
20:58:39.0311 7228  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
20:58:39.0329 7228  gupdate - ok
20:58:39.0377 7228  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
20:58:39.0393 7228  gupdatem - ok
20:58:39.0427 7228  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
20:58:39.0456 7228  hcw85cir - ok
20:58:39.0514 7228  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
20:58:39.0558 7228  HdAudAddService - ok
20:58:39.0585 7228  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
20:58:39.0626 7228  HDAudBus - ok
20:58:39.0671 7228  [ B6AC71AAA2B10848F57FC49D55A651AF ] HECIx64        C:\Windows\system32\DRIVERS\HECIx64.sys
20:58:39.0684 7228  HECIx64 - ok
20:58:39.0698 7228  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
20:58:39.0724 7228  HidBatt - ok
20:58:39.0735 7228  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
20:58:39.0762 7228  HidBth - ok
20:58:39.0795 7228  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
20:58:39.0825 7228  HidIr - ok
20:58:39.0847 7228  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
20:58:39.0916 7228  hidserv - ok
20:58:39.0963 7228  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\drivers\hidusb.sys
20:58:39.0985 7228  HidUsb - ok
20:58:40.0022 7228  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
20:58:40.0116 7228  hkmsvc - ok
20:58:40.0154 7228  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
20:58:40.0180 7228  HomeGroupListener - ok
20:58:40.0215 7228  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
20:58:40.0242 7228  HomeGroupProvider - ok
20:58:40.0295 7228  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
20:58:40.0317 7228  HpSAMD - ok
20:58:40.0405 7228  [ 575546EE9A39DD5CB3B4E34A146A8A3E ] hshld          C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
20:58:40.0437 7228  hshld - ok
20:58:40.0497 7228  [ 2CFEA9C337B699ACA38487E8A7438F35 ] HssSrv          C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
20:58:40.0524 7228  HssSrv - ok
20:58:40.0565 7228  [ 4EFB7FC2A11DB10AB6205206D60C432B ] HssTrayService  C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE
20:58:40.0583 7228  HssTrayService - ok
20:58:40.0603 7228  HssWd - ok
20:58:40.0665 7228  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
20:58:40.0765 7228  HTTP - ok
20:58:40.0795 7228  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
20:58:40.0815 7228  hwpolicy - ok
20:58:40.0866 7228  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
20:58:40.0891 7228  i8042prt - ok
20:58:40.0955 7228  [ 42E00996DFC13C46366689C0EA8ABC5E ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
20:58:40.0985 7228  iaStor - ok
20:58:41.0029 7228  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
20:58:41.0050 7228  iaStorV - ok
20:58:41.0125 7228  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
20:58:41.0180 7228  idsvc - ok
20:58:41.0422 7228  [ 677AA5991026A65ADA128C4B59CF2BAD ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
20:58:41.0750 7228  igfx - ok
20:58:41.0796 7228  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
20:58:41.0820 7228  iirsp - ok
20:58:41.0862 7228  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
20:58:41.0935 7228  IKEEXT - ok
20:58:41.0970 7228  [ DD587A55390ED2295BCE6D36AD567DA9 ] Impcd          C:\Windows\system32\DRIVERS\Impcd.sys
20:58:41.0997 7228  Impcd - ok
20:58:42.0076 7228  [ 53019327813FF5AB2964B33B2C61307C ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
20:58:42.0201 7228  IntcAzAudAddService - ok
20:58:42.0247 7228  [ 58CF58DEE26C909BD6F977B61D246295 ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys
20:58:42.0279 7228  IntcDAud - ok
20:58:42.0325 7228  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
20:58:42.0341 7228  intelide - ok
20:58:42.0388 7228  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
20:58:42.0419 7228  intelppm - ok
20:58:42.0435 7228  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
20:58:42.0513 7228  IPBusEnum - ok
20:58:42.0567 7228  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:58:42.0618 7228  IpFilterDriver - ok
20:58:42.0705 7228  [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
20:58:42.0796 7228  iphlpsvc - ok
20:58:42.0828 7228  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
20:58:42.0861 7228  IPMIDRV - ok
20:58:42.0891 7228  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
20:58:42.0964 7228  IPNAT - ok
20:58:43.0046 7228  [ A9AB99EE7D39725EAFEC82732D2B3271 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
20:58:43.0100 7228  iPod Service - ok
20:58:43.0127 7228  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
20:58:43.0159 7228  IRENUM - ok
20:58:43.0196 7228  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
20:58:43.0217 7228  isapnp - ok
20:58:43.0256 7228  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
20:58:43.0287 7228  iScsiPrt - ok
20:58:43.0298 7228  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
20:58:43.0311 7228  kbdclass - ok
20:58:43.0323 7228  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
20:58:43.0344 7228  kbdhid - ok
20:58:43.0379 7228  [ E63EF8C3271D014F14E2469CE75FECB4 ] kbfiltr        C:\Windows\system32\DRIVERS\kbfiltr.sys
20:58:43.0394 7228  kbfiltr - ok
20:58:43.0418 7228  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
20:58:43.0433 7228  KeyIso - ok
20:58:43.0461 7228  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
20:58:43.0473 7228  KSecDD - ok
20:58:43.0506 7228  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
20:58:43.0522 7228  KSecPkg - ok
20:58:43.0550 7228  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
20:58:43.0602 7228  ksthunk - ok
20:58:43.0637 7228  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
20:58:43.0689 7228  KtmRm - ok
20:58:43.0730 7228  [ B4A3A05B0F9C81D098B96AB6AA915042 ] L1C            C:\Windows\system32\DRIVERS\L1C62x64.sys
20:58:43.0752 7228  L1C - ok
20:58:43.0807 7228  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
20:58:43.0874 7228  LanmanServer - ok
20:58:43.0919 7228  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:58:43.0991 7228  LanmanWorkstation - ok
20:58:44.0094 7228  [ 7772DFAB22611050B79504E671B06E6E ] LBTServ        C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
20:58:44.0128 7228  LBTServ - ok
20:58:44.0168 7228  [ ED7EC050CD6C20E1A93A4DAFB7EFD14D ] LEqdUsb        C:\Windows\system32\DRIVERS\LEqdUsb.Sys
20:58:44.0179 7228  LEqdUsb - ok
20:58:44.0223 7228  [ 3267BC698E29474A8381E68904EB0390 ] LHidEqd        C:\Windows\system32\DRIVERS\LHidEqd.Sys
20:58:44.0242 7228  LHidEqd - ok
20:58:44.0276 7228  [ 241F2648ADF090E2A10095BD6D6F5DCB ] LHidFilt        C:\Windows\system32\DRIVERS\LHidFilt.Sys
20:58:44.0295 7228  LHidFilt - ok
20:58:44.0316 7228  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
20:58:44.0360 7228  lltdio - ok
20:58:44.0395 7228  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
20:58:44.0471 7228  lltdsvc - ok
20:58:44.0495 7228  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
20:58:44.0541 7228  lmhosts - ok
20:58:44.0657 7228  [ A1C148801B4AF64847AEB9F3AD9594EF ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
20:58:44.0702 7228  LMS ( UnsignedFile.Multi.Generic ) - warning
20:58:44.0702 7228  LMS - detected UnsignedFile.Multi.Generic (1)
20:58:44.0766 7228  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
20:58:44.0788 7228  LSI_FC - ok
20:58:44.0797 7228  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
20:58:44.0812 7228  LSI_SAS - ok
20:58:44.0826 7228  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
20:58:44.0838 7228  LSI_SAS2 - ok
20:58:44.0858 7228  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
20:58:44.0870 7228  LSI_SCSI - ok
20:58:44.0875 7228  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
20:58:44.0918 7228  luafv - ok
20:58:44.0953 7228  [ 085435AE1A124361304044029B5CC644 ] lullaby        C:\Windows\system32\DRIVERS\lullaby.sys
20:58:44.0963 7228  lullaby - ok
20:58:44.0988 7228  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
20:58:45.0023 7228  Mcx2Svc - ok
20:58:45.0039 7228  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
20:58:45.0051 7228  megasas - ok
20:58:45.0067 7228  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
20:58:45.0085 7228  MegaSR - ok
20:58:45.0159 7228  [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe
20:58:45.0198 7228  Microsoft Office Groove Audit Service - ok
20:58:45.0236 7228  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
20:58:45.0311 7228  MMCSS - ok
20:58:45.0336 7228  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
20:58:45.0380 7228  Modem - ok
20:58:45.0403 7228  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
20:58:45.0419 7228  monitor - ok
20:58:45.0443 7228  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\drivers\mouclass.sys
20:58:45.0455 7228  mouclass - ok
20:58:45.0479 7228  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
20:58:45.0500 7228  mouhid - ok
20:58:45.0538 7228  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
20:58:45.0562 7228  mountmgr - ok
20:58:45.0635 7228  [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
20:58:45.0658 7228  MozillaMaintenance - ok
20:58:45.0697 7228  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
20:58:45.0723 7228  mpio - ok
20:58:45.0753 7228  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
20:58:45.0799 7228  mpsdrv - ok
20:58:45.0857 7228  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
20:58:45.0933 7228  MpsSvc - ok
20:58:45.0979 7228  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
20:58:46.0026 7228  MRxDAV - ok
20:58:46.0042 7228  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
20:58:46.0073 7228  mrxsmb - ok
20:58:46.0104 7228  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:58:46.0151 7228  mrxsmb10 - ok
20:58:46.0167 7228  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:58:46.0201 7228  mrxsmb20 - ok
20:58:46.0237 7228  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
20:58:46.0248 7228  msahci - ok
20:58:46.0264 7228  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
20:58:46.0277 7228  msdsm - ok
20:58:46.0286 7228  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
20:58:46.0322 7228  MSDTC - ok
20:58:46.0371 7228  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
20:58:46.0429 7228  Msfs - ok
20:58:46.0443 7228  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
20:58:46.0490 7228  mshidkmdf - ok
20:58:46.0521 7228  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
20:58:46.0532 7228  msisadrv - ok
20:58:46.0570 7228  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
20:58:46.0617 7228  MSiSCSI - ok
20:58:46.0621 7228  msiserver - ok
20:58:46.0652 7228  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
20:58:46.0696 7228  MSKSSRV - ok
20:58:46.0714 7228  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
20:58:46.0768 7228  MSPCLOCK - ok
20:58:46.0780 7228  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
20:58:46.0824 7228  MSPQM - ok
20:58:46.0870 7228  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
20:58:46.0903 7228  MsRPC - ok
20:58:46.0934 7228  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
20:58:46.0947 7228  mssmbios - ok
20:58:46.0971 7228  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
20:58:47.0026 7228  MSTEE - ok
20:58:47.0030 7228  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
20:58:47.0042 7228  MTConfig - ok
20:58:47.0081 7228  [ 032D35C996F21D19A205A7C8F0B76F3C ] MTsensor        C:\Windows\system32\DRIVERS\ATK64AMD.sys
20:58:47.0091 7228  MTsensor - ok
20:58:47.0108 7228  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
20:58:47.0121 7228  Mup - ok
20:58:47.0150 7228  [ A9BC2302FBDF52C8AF4E2FC966288D21 ] MyWiFiDHCPDNS  C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
20:58:47.0168 7228  MyWiFiDHCPDNS - ok
20:58:47.0216 7228  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
20:58:47.0287 7228  napagent - ok
20:58:47.0332 7228  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
20:58:47.0369 7228  NativeWifiP - ok
20:58:47.0486 7228  [ 9AE6509862DE96416CA9AD54440A861B ] NAUpdate        C:\Program Files (x86)\Nero\Update\NASvc.exe
20:58:47.0514 7228  NAUpdate - ok
20:58:47.0569 7228  [ 79B47FD40D9A817E932F9D26FAC0A81C ] NDIS            C:\Windows\system32\drivers\ndis.sys
20:58:47.0616 7228  NDIS - ok
20:58:47.0646 7228  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
20:58:47.0691 7228  NdisCap - ok
20:58:47.0720 7228  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
20:58:47.0766 7228  NdisTapi - ok
20:58:47.0814 7228  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
20:58:47.0886 7228  Ndisuio - ok
20:58:47.0927 7228  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
20:58:47.0991 7228  NdisWan - ok
20:58:48.0043 7228  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
20:58:48.0106 7228  NDProxy - ok
20:58:48.0153 7228  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
20:58:48.0227 7228  NetBIOS - ok
20:58:48.0264 7228  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
20:58:48.0337 7228  NetBT - ok
20:58:48.0359 7228  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
20:58:48.0370 7228  Netlogon - ok
20:58:48.0402 7228  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
20:58:48.0467 7228  Netman - ok
20:58:48.0494 7228  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
20:58:48.0552 7228  netprofm - ok
20:58:48.0582 7228  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:58:48.0593 7228  NetTcpPortSharing - ok
20:58:48.0785 7228  [ 24F64343F14A119308456E1CA7507B26 ] NETw5s64        C:\Windows\system32\DRIVERS\NETw5s64.sys
20:58:49.0009 7228  NETw5s64 - ok
20:58:49.0051 7228  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
20:58:49.0073 7228  nfrd960 - ok
20:58:49.0127 7228  [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc          C:\Windows\System32\nlasvc.dll
20:58:49.0210 7228  NlaSvc - ok
20:58:49.0226 7228  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
20:58:49.0265 7228  Npfs - ok
20:58:49.0279 7228  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
20:58:49.0324 7228  nsi - ok
20:58:49.0335 7228  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
20:58:49.0382 7228  nsiproxy - ok
20:58:49.0434 7228  [ A2F74975097F52A00745F9637451FDD8 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
20:58:49.0497 7228  Ntfs - ok
20:58:49.0529 7228  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
20:58:49.0574 7228  Null - ok
20:58:49.0824 7228  [ 70E89A21827B2669AF906B703C7C48B5 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:58:50.0262 7228  nvlddmkm - ok
20:58:50.0320 7228  [ 4B9C0C2BF78289513101EB0D44834701 ] nvpciflt        C:\Windows\system32\DRIVERS\nvpciflt.sys
20:58:50.0330 7228  nvpciflt - ok
20:58:50.0357 7228  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
20:58:50.0370 7228  nvraid - ok
20:58:50.0408 7228  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
20:58:50.0423 7228  nvstor - ok
20:58:50.0458 7228  [ E04FCE1D149CF05C3449E3171F9C3E41 ] nvsvc          C:\Windows\system32\nvvsvc.exe
20:58:50.0494 7228  nvsvc - ok
20:58:50.0580 7228  [ D96DDEA6C699A99832E0186057801971 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
20:58:50.0649 7228  nvUpdatusService - ok
20:58:50.0725 7228  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
20:58:50.0736 7228  nv_agp - ok
20:58:50.0940 7228  [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv          C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:58:50.0958 7228  odserv - ok
20:58:50.0997 7228  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
20:58:51.0022 7228  ohci1394 - ok
20:58:51.0051 7228  [ 5A432A042DAE460ABE7199B758E8606C ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:58:51.0065 7228  ose - ok
20:58:51.0112 7228  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
20:58:51.0135 7228  p2pimsvc - ok
20:58:51.0157 7228  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
20:58:51.0186 7228  p2psvc - ok
20:58:51.0217 7228  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\DRIVERS\parport.sys
20:58:51.0242 7228  Parport - ok
20:58:51.0283 7228  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
20:58:51.0307 7228  partmgr - ok
20:58:51.0342 7228  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
20:58:51.0387 7228  PcaSvc - ok
20:58:51.0432 7228  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
20:58:51.0458 7228  pci - ok
20:58:51.0482 7228  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
20:58:51.0503 7228  pciide - ok
20:58:51.0537 7228  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
20:58:51.0566 7228  pcmcia - ok
20:58:51.0598 7228  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
20:58:51.0619 7228  pcw - ok
20:58:51.0664 7228  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
20:58:51.0762 7228  PEAUTH - ok
20:58:51.0863 7228  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
20:58:51.0901 7228  PerfHost - ok
20:58:51.0974 7228  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
20:58:52.0092 7228  pla - ok
20:58:52.0136 7228  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
20:58:52.0167 7228  PlugPlay - ok
20:58:52.0195 7228  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
20:58:52.0226 7228  PNRPAutoReg - ok
20:58:52.0257 7228  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
20:58:52.0283 7228  PNRPsvc - ok
20:58:52.0324 7228  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
20:58:52.0376 7228  PolicyAgent - ok
20:58:52.0414 7228  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
20:58:52.0479 7228  Power - ok
20:58:52.0531 7228  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
20:58:52.0608 7228  PptpMiniport - ok
20:58:52.0631 7228  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\DRIVERS\processr.sys
20:58:52.0663 7228  Processor - ok
20:58:52.0709 7228  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
20:58:52.0740 7228  ProfSvc - ok
20:58:52.0761 7228  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
20:58:52.0772 7228  ProtectedStorage - ok
20:58:52.0816 7228  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
20:58:52.0872 7228  Psched - ok
20:58:52.0925 7228  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
20:58:52.0999 7228  ql2300 - ok
20:58:53.0030 7228  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
20:58:53.0044 7228  ql40xx - ok
20:58:53.0070 7228  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
20:58:53.0091 7228  QWAVE - ok
20:58:53.0107 7228  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
20:58:53.0130 7228  QWAVEdrv - ok
20:58:53.0139 7228  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
20:58:53.0188 7228  RasAcd - ok
20:58:53.0210 7228  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
20:58:53.0249 7228  RasAgileVpn - ok
20:58:53.0278 7228  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
20:58:53.0334 7228  RasAuto - ok
20:58:53.0372 7228  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
20:58:53.0441 7228  Rasl2tp - ok
20:58:53.0466 7228  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
20:58:53.0521 7228  RasMan - ok
20:58:53.0557 7228  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
20:58:53.0624 7228  RasPppoe - ok
20:58:53.0640 7228  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
20:58:53.0689 7228  RasSstp - ok
20:58:53.0726 7228  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
20:58:53.0774 7228  rdbss - ok
20:58:53.0803 7228  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
20:58:53.0825 7228  rdpbus - ok
20:58:53.0858 7228  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
20:58:53.0909 7228  RDPCDD - ok
20:58:53.0922 7228  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
20:58:53.0975 7228  RDPENCDD - ok
20:58:53.0996 7228  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
20:58:54.0043 7228  RDPREFMP - ok
20:58:54.0077 7228  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
20:58:54.0104 7228  RDPWD - ok
20:58:54.0163 7228  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
20:58:54.0190 7228  rdyboost - ok
20:58:54.0254 7228  [ 0AA473966357C4A41B5EB19649EB6E5E ] RegSrvc        C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
20:58:54.0305 7228  RegSrvc - ok
20:58:54.0321 7228  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
20:58:54.0375 7228  RemoteAccess - ok
20:58:54.0398 7228  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
20:58:54.0437 7228  RemoteRegistry - ok
20:58:54.0447 7228  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
20:58:54.0496 7228  RpcEptMapper - ok
20:58:54.0516 7228  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
20:58:54.0556 7228  RpcLocator - ok
20:58:54.0595 7228  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
20:58:54.0640 7228  RpcSs - ok
20:58:54.0695 7228  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
20:58:54.0764 7228  rspndr - ok
20:58:54.0815 7228  [ B3F36B4B3F192EA87DDC119F3A0B3E45 ] RTL8192su      C:\Windows\system32\DRIVERS\RTL8192su.sys
20:58:54.0865 7228  RTL8192su - ok
20:58:54.0885 7228  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
20:58:54.0897 7228  SamSs - ok
20:58:54.0932 7228  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
20:58:54.0957 7228  sbp2port - ok
20:58:54.0994 7228  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
20:58:55.0061 7228  SCardSvr - ok
20:58:55.0094 7228  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
20:58:55.0173 7228  scfilter - ok
20:58:55.0217 7228  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
20:58:55.0296 7228  Schedule - ok
20:58:55.0335 7228  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
20:58:55.0368 7228  SCPolicySvc - ok
20:58:55.0411 7228  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
20:58:55.0444 7228  SDRSVC - ok
20:58:55.0472 7228  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
20:58:55.0549 7228  secdrv - ok
20:58:55.0567 7228  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
20:58:55.0609 7228  seclogon - ok
20:58:55.0630 7228  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
20:58:55.0678 7228  SENS - ok
20:58:55.0692 7228  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
20:58:55.0717 7228  SensrSvc - ok
20:58:55.0759 7228  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
20:58:55.0793 7228  Serenum - ok
20:58:55.0822 7228  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
20:58:55.0850 7228  Serial - ok
20:58:55.0899 7228  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
20:58:55.0928 7228  sermouse - ok
20:58:55.0974 7228  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
20:58:56.0031 7228  SessionEnv - ok
20:58:56.0063 7228  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
20:58:56.0095 7228  sffdisk - ok
20:58:56.0101 7228  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
20:58:56.0127 7228  sffp_mmc - ok
20:58:56.0132 7228  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
20:58:56.0165 7228  sffp_sd - ok
20:58:56.0201 7228  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
20:58:56.0223 7228  sfloppy - ok
20:58:56.0267 7228  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
20:58:56.0338 7228  SharedAccess - ok
20:58:56.0387 7228  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:58:56.0447 7228  ShellHWDetection - ok
20:58:56.0474 7228  [ 1BC348CF6BAA90EC8E533EF6E6A69933 ] SiSGbeLH        C:\Windows\system32\DRIVERS\SiSG664.sys
20:58:56.0499 7228  SiSGbeLH - ok
20:58:56.0541 7228  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
20:58:56.0554 7228  SiSRaid2 - ok
20:58:56.0575 7228  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
20:58:56.0590 7228  SiSRaid4 - ok
20:58:56.0645 7228  [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
20:58:56.0667 7228  SkypeUpdate - ok
20:58:56.0696 7228  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
20:58:56.0738 7228  Smb - ok
20:58:56.0782 7228  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
20:58:56.0798 7228  SNMPTRAP - ok
20:58:56.0871 7228  [ 2114518E55B380A3ACC28B2C27FD499A ] SNP2UVC        C:\Windows\system32\DRIVERS\snp2uvc.sys
20:58:56.0971 7228  SNP2UVC - ok
20:58:57.0078 7228  [ D3865A0491AA66E595B6A276E4BDBE05 ] SPAMfighter Update Service C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe
20:58:57.0098 7228  SPAMfighter Update Service - ok
20:58:57.0115 7228  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
20:58:57.0129 7228  spldr - ok
20:58:57.0178 7228  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\Windows\System32\spoolsv.exe
20:58:57.0221 7228  Spooler - ok
20:58:57.0335 7228  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
20:58:57.0523 7228  sppsvc - ok
20:58:57.0548 7228  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
20:58:57.0598 7228  sppuinotify - ok
20:58:57.0636 7228  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
20:58:57.0685 7228  srv - ok
20:58:57.0705 7228  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
20:58:57.0741 7228  srv2 - ok
20:58:57.0755 7228  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
20:58:57.0789 7228  srvnet - ok
20:58:57.0832 7228  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
20:58:57.0899 7228  SSDPSRV - ok
20:58:57.0927 7228  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
20:58:57.0982 7228  SstpSvc - ok
20:58:58.0031 7228  Steam Client Service - ok
20:58:58.0054 7228  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
20:58:58.0073 7228  stexstor - ok
20:58:58.0121 7228  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
20:58:58.0150 7228  stisvc - ok
20:58:58.0210 7228  [ A7E21E907C39FAB021CED41296FC8019 ] Suite Service  C:\Program Files (x86)\Fighters\FighterSuiteService.exe
20:58:58.0265 7228  Suite Service - ok
20:58:58.0295 7228  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys
20:58:58.0306 7228  swenum - ok
20:58:58.0344 7228  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
20:58:58.0403 7228  swprv - ok
20:58:58.0470 7228  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
20:58:58.0561 7228  SysMain - ok
20:58:58.0596 7228  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:58:58.0617 7228  TabletInputService - ok
20:58:58.0639 7228  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
20:58:58.0688 7228  TapiSrv - ok
20:58:58.0718 7228  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
20:58:58.0754 7228  TBS - ok
20:58:58.0834 7228  [ ACB82BDA8F46C84F465C1AFA517DC4B9 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
20:58:58.0909 7228  Tcpip - ok
20:58:58.0956 7228  [ ACB82BDA8F46C84F465C1AFA517DC4B9 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
20:58:58.0996 7228  TCPIP6 - ok
20:58:59.0038 7228  [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
20:58:59.0089 7228  tcpipreg - ok
20:58:59.0119 7228  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
20:58:59.0141 7228  TDPIPE - ok
20:58:59.0173 7228  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
20:58:59.0187 7228  TDTCP - ok
20:58:59.0229 7228  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
20:58:59.0286 7228  tdx - ok
20:58:59.0354 7228  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys
20:58:59.0374 7228  TermDD - ok
20:58:59.0425 7228  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
20:58:59.0512 7228  TermService - ok
20:58:59.0530 7228  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
20:58:59.0559 7228  Themes - ok
20:58:59.0586 7228  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
20:58:59.0625 7228  THREADORDER - ok
20:58:59.0644 7228  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
20:58:59.0690 7228  TrkWks - ok
20:58:59.0754 7228  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:58:59.0815 7228  TrustedInstaller - ok
20:58:59.0851 7228  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
20:58:59.0922 7228  tssecsrv - ok
20:58:59.0954 7228  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
20:58:59.0980 7228  TsUsbFlt - ok
20:59:00.0035 7228  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
20:59:00.0101 7228  tunnel - ok
20:59:00.0127 7228  [ C45A3E051C65106A28982CAED125F855 ] TurboB          C:\Windows\system32\DRIVERS\TurboB.sys
20:59:00.0139 7228  TurboB - ok
20:59:00.0170 7228  [ BAEF86EBEAECE76573FA822DEA256F6C ] TurboBoost      C:\Program Files\Intel\TurboBoost\TurboBoost.exe
20:59:00.0183 7228  TurboBoost - ok
20:59:00.0206 7228  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
20:59:00.0221 7228  uagp35 - ok
20:59:00.0260 7228  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
20:59:00.0312 7228  udfs - ok
20:59:00.0336 7228  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
20:59:00.0358 7228  UI0Detect - ok
20:59:00.0399 7228  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
20:59:00.0414 7228  uliagpkx - ok
20:59:00.0460 7228  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\drivers\umbus.sys
20:59:00.0482 7228  umbus - ok
20:59:00.0516 7228  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
20:59:00.0545 7228  UmPass - ok
20:59:00.0675 7228  [ 41118D920B2B268C0ADC36421248CDCF ] UNS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
20:59:00.0766 7228  UNS ( UnsignedFile.Multi.Generic ) - warning
20:59:00.0766 7228  UNS - detected UnsignedFile.Multi.Generic (1)
20:59:00.0790 7228  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
20:59:00.0843 7228  upnphost - ok
20:59:00.0884 7228  [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64      C:\Windows\system32\Drivers\usbaapl64.sys
20:59:00.0895 7228  USBAAPL64 - ok
20:59:00.0936 7228  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
20:59:00.0959 7228  usbccgp - ok
20:59:00.0993 7228  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
20:59:01.0042 7228  usbcir - ok
20:59:01.0059 7228  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\drivers\usbehci.sys
20:59:01.0095 7228  usbehci - ok
20:59:01.0122 7228  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
20:59:01.0147 7228  usbhub - ok
20:59:01.0190 7228  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
20:59:01.0228 7228  usbohci - ok
20:59:01.0259 7228  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
20:59:01.0289 7228  usbprint - ok
20:59:01.0321 7228  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
20:59:01.0335 7228  usbscan - ok
20:59:01.0353 7228  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:59:01.0373 7228  USBSTOR - ok
20:59:01.0409 7228  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
20:59:01.0430 7228  usbuhci - ok
20:59:01.0486 7228  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
20:59:01.0531 7228  usbvideo - ok
20:59:01.0572 7228  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
20:59:01.0639 7228  UxSms - ok
20:59:01.0664 7228  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
20:59:01.0675 7228  VaultSvc - ok
20:59:01.0721 7228  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
20:59:01.0742 7228  vdrvroot - ok
20:59:01.0787 7228  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
20:59:01.0869 7228  vds - ok
20:59:01.0913 7228  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
20:59:01.0940 7228  vga - ok
20:59:01.0964 7228  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
20:59:02.0028 7228  VgaSave - ok
20:59:02.0069 7228  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
20:59:02.0097 7228  vhdmp - ok
20:59:02.0149 7228  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
20:59:02.0159 7228  viaide - ok
20:59:02.0176 7228  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
20:59:02.0188 7228  volmgr - ok
20:59:02.0228 7228  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
20:59:02.0258 7228  volmgrx - ok
20:59:02.0300 7228  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
20:59:02.0319 7228  volsnap - ok
20:59:02.0341 7228  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
20:59:02.0356 7228  vsmraid - ok
20:59:02.0420 7228  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
20:59:02.0517 7228  VSS - ok
20:59:02.0533 7228  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
20:59:02.0564 7228  vwifibus - ok
20:59:02.0576 7228  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
20:59:02.0610 7228  vwififlt - ok
20:59:02.0637 7228  [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp        C:\Windows\system32\DRIVERS\vwifimp.sys
20:59:02.0653 7228  vwifimp - ok
20:59:02.0685 7228  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
20:59:02.0727 7228  W32Time - ok
20:59:02.0741 7228  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
20:59:02.0764 7228  WacomPen - ok
20:59:02.0820 7228  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
20:59:02.0859 7228  WANARP - ok
20:59:02.0890 7228  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
20:59:02.0922 7228  Wanarpv6 - ok
20:59:02.0994 7228  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc    C:\Windows\system32\Wat\WatAdminSvc.exe
20:59:03.0060 7228  WatAdminSvc - ok
20:59:03.0123 7228  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
20:59:03.0189 7228  wbengine - ok
20:59:03.0218 7228  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
20:59:03.0238 7228  WbioSrvc - ok
20:59:03.0284 7228  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
20:59:03.0329 7228  wcncsvc - ok
20:59:03.0344 7228  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:59:03.0371 7228  WcsPlugInService - ok
20:59:03.0395 7228  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys
20:59:03.0406 7228  Wd - ok
20:59:03.0436 7228  [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
20:59:03.0459 7228  Wdf01000 - ok
20:59:03.0469 7228  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
20:59:03.0506 7228  WdiServiceHost - ok
20:59:03.0509 7228  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
20:59:03.0527 7228  WdiSystemHost - ok
20:59:03.0544 7228  [ 5B34E5938B9E76798977725E3F7847C4 ] wdkmd          C:\Windows\system32\DRIVERS\WDKMD.sys
20:59:03.0554 7228  wdkmd - ok
20:59:03.0595 7228  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
20:59:03.0620 7228  WebClient - ok
20:59:03.0637 7228  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
20:59:03.0692 7228  Wecsvc - ok
20:59:03.0706 7228  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
20:59:03.0741 7228  wercplsupport - ok
20:59:03.0756 7228  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
20:59:03.0807 7228  WerSvc - ok
20:59:03.0837 7228  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
20:59:03.0874 7228  WfpLwf - ok
20:59:03.0914 7228  [ 52DED146E4797E6CCF94799E8E22BB2A ] WimFltr        C:\Windows\system32\DRIVERS\wimfltr.sys
20:59:03.0929 7228  WimFltr - ok
20:59:03.0939 7228  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
20:59:03.0950 7228  WIMMount - ok
20:59:03.0974 7228  WinDefend - ok
20:59:03.0978 7228  WinHttpAutoProxySvc - ok
20:59:04.0031 7228  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
20:59:04.0099 7228  Winmgmt - ok
20:59:04.0180 7228  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
20:59:04.0301 7228  WinRM - ok
20:59:04.0351 7228  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
20:59:04.0384 7228  WinUsb - ok
20:59:04.0426 7228  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
20:59:04.0471 7228  Wlansvc - ok
20:59:04.0504 7228  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
20:59:04.0527 7228  WmiAcpi - ok
20:59:04.0553 7228  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
20:59:04.0590 7228  wmiApSrv - ok
20:59:04.0623 7228  WMPNetworkSvc - ok
20:59:04.0656 7228  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
20:59:04.0672 7228  WPCSvc - ok
20:59:04.0706 7228  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
20:59:04.0735 7228  WPDBusEnum - ok
20:59:04.0765 7228  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
20:59:04.0837 7228  ws2ifsl - ok
20:59:04.0857 7228  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
20:59:04.0875 7228  wscsvc - ok
20:59:04.0878 7228  WSearch - ok
20:59:04.0973 7228  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
20:59:05.0080 7228  wuauserv - ok
20:59:05.0090 7228  [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
20:59:05.0120 7228  WudfPf - ok
20:59:05.0167 7228  [ CF8D590BE3373029D57AF80914190682 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
20:59:05.0214 7228  WUDFRd - ok
20:59:05.0245 7228  [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
20:59:05.0292 7228  wudfsvc - ok
20:59:05.0308 7228  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc        C:\Windows\System32\wwansvc.dll
20:59:05.0339 7228  WwanSvc - ok
20:59:05.0401 7228  {B154377D-700F-42cc-9474-23858FBDF4BD} - ok
20:59:05.0427 7228  ================ Scan global ===============================
20:59:05.0453 7228  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
20:59:05.0483 7228  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
20:59:05.0504 7228  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
20:59:05.0528 7228  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
20:59:05.0543 7228  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
20:59:05.0549 7228  [Global] - ok
20:59:05.0550 7228  ================ Scan MBR ==================================
20:59:05.0563 7228  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
20:59:06.0035 7228  \Device\Harddisk0\DR0 - ok
20:59:06.0041 7228  [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
20:59:06.0603 7228  \Device\Harddisk1\DR1 - ok
20:59:06.0609 7228  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2
20:59:07.0086 7228  \Device\Harddisk2\DR2 - ok
20:59:07.0087 7228  ================ Scan VBR ==================================
20:59:07.0091 7228  [ 1D69DFD8F6D939D61C56AF33A9169B52 ] \Device\Harddisk0\DR0\Partition1
20:59:07.0093 7228  \Device\Harddisk0\DR0\Partition1 - ok
20:59:07.0164 7228  [ 4FF2F1FB760C960FE369EF7E34968D8B ] \Device\Harddisk0\DR0\Partition2
20:59:07.0168 7228  \Device\Harddisk0\DR0\Partition2 - ok
20:59:07.0173 7228  [ 49D3ADB4292C84FC1FDEBD41A36F0DCF ] \Device\Harddisk1\DR1\Partition1
20:59:07.0177 7228  \Device\Harddisk1\DR1\Partition1 - ok
20:59:07.0182 7228  [ B0C1D0CEEDC731A833117EC7643CA953 ] \Device\Harddisk2\DR2\Partition1
20:59:07.0186 7228  \Device\Harddisk2\DR2\Partition1 - ok
20:59:07.0186 7228  ============================================================
20:59:07.0186 7228  Scan finished
20:59:07.0186 7228  ============================================================
20:59:07.0201 6040  Detected object count: 2
20:59:07.0201 6040  Actual detected object count: 2
20:59:23.0439 6040  LMS ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:23.0439 6040  LMS ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:59:23.0439 6040  UNS ( UnsignedFile.Multi.Generic ) - skipped by user
20:59:23.0439 6040  UNS ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 11.09.2012 23:29
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Charlene 12.09.2012 20:05
hier kommt das Combofix-log:

Code:
ComboFix 12-09-12.03 - XXX 12.09.2012  20:34:51.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3886.2044 [GMT 2:00]
ausgeführt von:: c:\users\XXX\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\ASPG_icon.ico
c:\program files (x86)\Windows Live\Messenger\msacm32.dll
c:\programdata\FullRemove.exe
c:\programdata\nud0repor.pad
C:\readme.txt
c:\users\XXX\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll
c:\windows\IsUn0407.exe
c:\windows\msvcr71.dll
D:\uninstall.exe
G:\resycled
I:\Autorun.inf
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-08-12 bis 2012-09-12  ))))))))))))))))))))))))))))))
.
.
2012-09-09 11:40 . 2012-09-09 12:21        --------        d-----w-        c:\users\XXX\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
2012-09-09 11:25 . 2012-09-09 11:25        --------        d-----w-        c:\program files (x86)\Electronic Arts
2012-09-09 09:33 . 2012-09-09 09:32        916456        ----a-w-        c:\windows\system32\deployJava1.dll
2012-09-09 09:33 . 2012-09-09 09:32        289768        ----a-w-        c:\windows\system32\javaws.exe
2012-09-09 09:33 . 2012-09-09 09:32        1034216        ----a-w-        c:\windows\system32\npDeployJava1.dll
2012-09-09 09:33 . 2012-09-09 09:32        108008        ----a-w-        c:\windows\system32\WindowsAccessBridge-64.dll
2012-09-09 09:33 . 2012-09-09 09:32        189416        ----a-w-        c:\windows\system32\javaw.exe
2012-09-09 09:33 . 2012-09-09 09:32        188904        ----a-w-        c:\windows\system32\java.exe
2012-09-09 09:30 . 2012-09-09 09:32        --------        d-----w-        c:\program files\Java
2012-09-08 16:42 . 2012-09-08 16:42        --------        d-----w-        c:\users\XXX\AppData\Roaming\My Battle for Middle-earth Files
2012-09-02 08:59 . 2012-09-02 08:59        --------        d-----w-        c:\program files (x86)\ESET
2012-08-30 19:24 . 2012-09-02 12:34        --------        d-----w-        c:\users\XXX\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
2012-08-30 19:10 . 2012-08-30 19:10        --------        d-----w-        c:\program files (x86)\EA GAMES
2012-08-27 06:07 . 2012-08-27 06:07        --------        d-----w-        c:\program files (x86)\Common Files\Java
2012-08-27 06:06 . 2012-08-27 06:06        95208        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-08-25 00:21 . 2012-08-25 00:23        --------        d-----w-        c:\windows\rescache
2012-08-24 19:07 . 2012-08-26 01:19        --------        d-----w-        c:\program files (x86)\Emsisoft Anti-Malware
2012-08-24 17:44 . 2012-08-24 17:44        --------        d-----w-        c:\windows\system32\SPReview
2012-08-24 17:41 . 2012-08-24 17:41        --------        d-----w-        c:\windows\system32\EventProviders
2012-08-23 18:13 . 2012-08-27 06:06        821736        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll
2012-08-23 05:51 . 2012-08-23 05:51        --------        d-----w-        C:\_OTL
2012-08-22 05:54 . 2012-08-22 05:54        --------        d-----w-        c:\users\XXX\AppData\Roaming\Malwarebytes
2012-08-22 05:54 . 2012-08-22 05:54        --------        d-----w-        c:\programdata\Malwarebytes
2012-08-22 05:54 . 2012-08-22 05:54        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-08-22 05:54 . 2012-07-03 11:46        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-08-15 06:59 . 2012-06-27 04:53        1638912        ----a-w-        c:\windows\system32\mshtml.tlb
2012-08-15 06:59 . 2012-07-18 18:15        3148800        ----a-w-        c:\windows\system32\win32k.sys
2012-08-15 06:59 . 2012-05-14 05:26        956928        ----a-w-        c:\windows\system32\localspl.dll
2012-08-15 06:59 . 2010-11-20 13:27        39424        ----a-w-        c:\windows\system32\Spool\prtprocs\x64\winprint.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-10 17:14 . 2010-10-31 09:26        45056        ----a-w-        c:\windows\system32\acovcnt.exe
2012-08-27 06:06 . 2010-10-29 18:03        746984        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2012-08-24 18:00 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll
2012-08-24 18:00 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll
2012-08-16 01:00 . 2010-11-01 07:14        62134624        ----a-w-        c:\windows\system32\MRT.exe
2012-08-15 21:38 . 2012-04-27 05:33        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-15 21:38 . 2011-05-20 04:15        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-25 18:39 . 2012-07-25 18:39        3360256        ----a-w-        C:\edainmodstarter.exe
2012-06-25 14:04 . 2012-06-25 14:04        1394248        ----a-w-        c:\windows\SysWow64\msxml4.dll
2009-04-08 17:31 . 2009-04-08 17:31        106496        ----a-w-        c:\program files (x86)\Common Files\CPInstallAction.dll
2008-08-12 04:45 . 2008-08-12 04:45        155648        ----a-w-        c:\program files (x86)\Common Files\MSIactionall.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{0538CF1C-8419-4800-ADBB-0C00C799FDA2}]
2012-02-06 09:12        88416        ----a-w-        c:\users\XXX\AppData\Roaming\Genieo\Application\IEPlugins\bin\IEWrapper.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GenieoUpdaterService"="c:\users\XXX\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe" [2012-02-06 277344]
"GenieoSystemTray"="c:\users\XXX\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe" [2012-02-06 558944]
"MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-08-05 1353080]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UpdatePSTShortCut"="c:\program files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2010-06-24 210216]
"Boingo Wi-Fi"="c:\program files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk" [2010-09-15 2429]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-01-13 7109248]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-01-05 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"NBAgent"="c:\program files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2010-02-22 1226024]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"HPUsageTracking"="c:\program files (x86)\Hewlett-Packard\HP UT\bin\hppusg.exe" [2007-11-02 36864]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"sfagent"="c:\program files (x86)\Fighters\SPAMfighter\sfagent.exe" [2012-04-24 1197704]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"CommonToolkitTray"="c:\program files (x86)\Fighters\Tray\FightersTray.exe" [2012-02-02 1453704]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
.
c:\users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-11-22 113664]
FancyStart daemon.lnk - c:\windows\Installer\{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}\_A1DDD39913A1970387B7B3.exe [2010-9-15 12862]
SRS Premium Sound.lnk - c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe [2010-9-15 156952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
2;2 nvUpdatusService;NVIDIA Update Service Daemon [x]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/09/15 04:51];c:\program files (x86)\Cyberlink\PowerDVD9\000.fcl [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-15 135664]
R2 hshld;Hotspot Shield Service;c:\program files (x86)\Hotspot Shield\bin\openvpnas.exe [2012-03-26 542040]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-15 250056]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-08-21 44032]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-15 135664]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-08 114144]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-03-05 340240]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 694888]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-02-18 1255736]
S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys [2009-06-18 15928]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2011-06-05 25960]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2009-09-17 359552]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [2012-03-26 329544]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-02-18 462632]
S2 SPAMfighter Update Service;SPAMfighter Update Service;c:\program files (x86)\Fighters\SPAMfighter\sfus.exe [2012-04-24 215688]
S2 Suite Service;Suite Service;c:\program files (x86)\Fighters\FighterSuiteService.exe [2012-01-23 1324680]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-08-06 13784]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-10-01 2314240]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-05-18 47616]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2009-10-15 117760]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-02-03 271872]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [2009-09-04 62464]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [2011-09-02 76056]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [2011-09-02 15128]
S3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-03-18 7680512]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [2010-04-16 39832]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-27 21:38]
.
2012-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-15 12:03]
.
2012-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-15 12:03]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-03-05 1928976]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-01 323584]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-09-30 621440]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
"PrnStatusMX"="c:\program files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe" [2007-08-29 1238528]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-03 1580368]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to MP3 Converter - c:\users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-vProt - c:\program files (x86)\AVG Secure Search\vprot.exe
Wow6432Node-HKLM-Run-ROC_roc_dec12 - c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe
AddRemove-ASUS_N_Series_Screensaver - c:\windows\system32\ASUS_N_Series_Screensaver.scr
AddRemove-Axis & Allies - c:\windows\IsUn0407.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files (x86)\Cyberlink\PowerDVD9\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
c:\program files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-09-12  20:55:42 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-09-12 18:55
.
Vor Suchlauf: 13 Verzeichnis(se), 14.266.814.464 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 14.072.950.784 Bytes frei
.
- - End Of File - - DEB331E019E5E6A4FA074EA3C9A9F7A5

cosinus 13.09.2012 12:55
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

cosinus 13.09.2012 13:02
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Charlene 13.09.2012 21:36
hier schon mal GMER. Rest folgt

Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-09-13 22:35:05
Windows 6.1.7601 Service Pack 1
Running: o9udp5bo.exe


---- Registry - GMER 1.0.15 ----

Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Electronic Arts\Die Schlacht um Mittelerde\x2122 II\Die Schlacht um Mittelerde\x2122 II - Weltenbauer.lnk  1
Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts\Die Schlacht um Mittelerde\x2122 II\Die Schlacht um Mittelerde\x2122 II - Weltenbauer.lnk                  1
Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Electronic Arts\Die Schlacht um Mittelerde\x2122 II\Elektronische Registrierung.lnk                        1
Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts\Die Schlacht um Mittelerde\x2122 II\Elektronische Registrierung.lnk                                        1
Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Electronic Arts\Die Schlacht um Mittelerde\x2122 II\Online nach Update suchen.lnk                          1
Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts\Die Schlacht um Mittelerde\x2122 II\Online nach Update suchen.lnk                                          1

---- EOF - GMER 1.0.15 ----
jetzt OSAM:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:21:18 on 14.09.2012

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 64-bit
Default Browser: Mozilla Corporation Firefox 15.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLCFG32.CPL
"Nero BurnRights 10" - "Nero AG" - C:\Program Files (x86)\Nero\Nero 10\Nero BurnRights\NeroBurnRights_10.cpl
"QuickTime" - "Apple Inc." - C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ASMMAP64" (ASMMAP64) - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\fssfltr.sys
"lullaby" (lullaby) - "Windows (R) Win 7 DDK provider" - C:\Windows\System32\DRIVERS\lullaby.sys
"Power Control [2010/09/15 04:51:26]" ({B154377D-700F-42cc-9474-23858FBDF4BD}) - ? - C:\Program Files (x86)\Cyberlink\PowerDVD9\000.fcl  (File not found)
"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\wimfltr.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{F764812A-132C-4013-9960-5CBBEB408A0E} "NeroShellExt Class" - "Nero AG" - C:\Program Files (x86)\Common Files\Nero\NeroShellExt\NeroShellExt.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\OLKFSTUB.DLL
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
ITBar7Height64 "ITBar7Height64" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout64" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA} "Java Plug-in 1.7.0_06" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.7.0_06" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\npjpi170_06.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 10.6.2" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} "FireShot" - ? - C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\rl45wb5x.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fsaddin-0.98.dll  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
{0538CF1C-8419-4800-ADBB-0C00C799FDA2} "My Personal Homepage" - ? - C:\Users\XXX\AppData\Roaming\Genieo\Application\IEPlugins\bin\IEWrapper.dll  (File found, but it contains no detailed information)
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Adobe Gamma Loader.lnk" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"FancyStart daemon.lnk" - "ASUSTeK Computer Inc." - C:\Program Files (x86)\ASUS\FancyStart\FancyStart.exe  (Shortcut exists | File exists)
"SRS Premium Sound.lnk" - "SRS Labs, Inc." - C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"GenieoSystemTray" - ? - "C:\Users\XXX\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe"  (File found, but it contains no detailed information)
"GenieoUpdaterService" - ? - "C:\Users\XXX\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe" -wait 5  (File found, but it contains no detailed information)
"MobileDocuments" - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
"Steam" - "Valve Corporation" - "C:\Program Files (x86)\Steam\Steam.exe" -silent
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"APSDaemon" - "Apple Inc." - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"ATKMEDIA" - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
"ATKOSD2" - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
"avgnt" - "Avira GmbH" - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"Boingo Wi-Fi" - ? - "C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk"
"CommonToolkitTray" - "SPAMfighter ApS" - C:\Program Files (x86)\Fighters\Tray\FightersTray.exe
"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
"HControlUser" - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
"HP Software Update" - "Hewlett-Packard Co." - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
"HPUsageTracking" - ? - "C:\Program Files (x86)\Hewlett-Packard\HP UT\bin\hppusg.exe" "C:\Program Files (x86)\Hewlett-Packard\HP UT\"
"iTunesHelper" - "Apple Inc." - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"NBAgent" - "Nero AG" - "C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart
"QuickTime Task" - "Apple Inc." - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
"sfagent" - "SPAMfighter ApS" - C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe
"UpdatePSTShortCut" - "CyberLink Corp." - "C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Cyberlink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"@C:\Program Files (x86)\Nero\Update\NASvc.exe,-200" (NAUpdate) - "Nero AG" - C:\Program Files (x86)\Nero\Update\NASvc.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
"AFBAgent" (AFBAgent) - "ASUSTeK Computer Inc." - C:\Windows\system32\FBAgent.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASLDR Service" (ASLDRService) - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
"ATKGFNEX Service" (ATKGFNEXSrv) - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Hotspot Shield Monitoring Service" (HssWd) - ? - C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe  (File found, but it contains no detailed information)
"Hotspot Shield Routing Service" (HssSrv) - ? - C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
"Hotspot Shield Service" (hshld) - ? - C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe  (File found, but it contains no detailed information)
"Hotspot Shield Tray Service" (HssTrayService) - ? - C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE  (File found, but it contains no detailed information)
"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
"iPod Service" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe
"SPAMfighter Update Service" (SPAMfighter Update Service) - "SPAMfighter ApS" - C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
"Suite Service" (Suite Service) - "SPAMfighter ApS" - C:\Program Files (x86)\Fighters\FighterSuiteService.exe
"TurboBoost" (TurboBoost) - "Intel(R) Corporation" - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
"Windows Live Family Safety" (fsssvc) - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
"Wireless PAN DHCP Server" (MyWiFiDHCPDNS) - ? - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Charlene 14.09.2012 22:08
und noch aswMBR:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-14 22:24:50
-----------------------------
22:24:50.215    OS Version: Windows x64 6.1.7601 Service Pack 1
22:24:50.215    Number of processors: 4 586 0x2505
22:24:50.215    ComputerName: XXX-PC  UserName: XXX
22:24:51.666    Initialize success
22:25:53.638    AVAST engine defs: 12091400
22:26:12.686    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
22:26:12.686    Disk 0 Vendor: ST950032 0003 Size: 476940MB BusType: 3
22:26:12.717    Disk 0 MBR read successfully
22:26:12.717    Disk 0 MBR scan
22:26:12.717    Disk 0 Windows 7 default MBR code
22:26:12.732    Disk 0 Partition 1 00    1C Hidd FAT32 LBA MSDOS5.0    20002 MB offset 63
22:26:12.748    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      119232 MB offset 40965750
22:26:12.748    Disk 0 Partition - 00    0F Extended LBA            337704 MB offset 285153280
22:26:12.764    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      337703 MB offset 285155328
22:26:12.810    Disk 0 scanning C:\Windows\system32\drivers
22:26:27.428    Service scanning
22:26:56.565    Modules scanning
22:26:56.565    Disk 0 trace - called modules:
22:26:56.596    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
22:26:56.596    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80048cb060]
22:26:56.612    3 CLASSPNP.SYS[fffff880015a543f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80045fb050]
22:26:57.376    AVAST engine scan C:\Windows
22:27:00.637    AVAST engine scan C:\Windows\system32
22:30:56.695    AVAST engine scan C:\Windows\system32\drivers
22:31:13.324    AVAST engine scan C:\Users\XXX
22:48:54.690    AVAST engine scan C:\ProgramData
22:50:02.940    Scan finished successfully
23:07:22.931    Disk 0 MBR has been saved successfully to "C:\Users\XXX\Desktop\MBR.dat"
23:07:22.947    The log file has been saved successfully to "C:\Users\XXX\Desktop\aswMBR.txt"

cosinus 15.09.2012 12:43
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Charlene 16.09.2012 08:28
Hier schon mal Malwarebytes:

Code:
Malwarebytes Anti-Malware (Test) 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.15.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
XXX :: XXX-PC [Administrator]

Schutz: Aktiviert

15.09.2012 21:46:56
mbam-log-2012-09-15 (21-46-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 541828
Laufzeit: 2 Stunde(n), 22 Minute(n),

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Superantiyspyware:

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/16/2012 at 04:29 PM

Application Version : 5.5.1016

Core Rules Database Version : 9236
Trace Rules Database Version: 7048

Scan type      : Complete Scan
Total Scan Time : 02:05:38

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 752
Memory threats detected  : 0
Registry items scanned    : 72647
Registry threats detected : 0
File items scanned        : 72192
File threats detected    : 637

Adware.Tracking Cookie
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\XXX@ad.yieldmanager[2].txt [ /ad.yieldmanager ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\XXX@adx.chip[2].txt [ /adx.chip ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\XXX@content.yieldmanager[1].txt [ /content.yieldmanager ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\XXX@smartadserver[2].txt [ /smartadserver ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\VLXYLB0S.txt [ /im.banner.t-online.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\08QF4GRH.txt [ /tradedoubler.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\QCUPO38G.txt [ /webmasterplan.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\T0Q9PR1N.txt [ /mediaplex.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\8JNZWTON.txt [ /revsci.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\59YVD7J4.txt [ /insightexpressai.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\0ZFOXLS9.txt [ /de.sitestat.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\BVD6NH82.txt [ /track.adform.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\M6DBO4VZ.txt [ /media6degrees.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\UG7MGMXE.txt [ /doubleclick.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\12UKEHAH.txt [ /serving-sys.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\FSNEFH72.txt [ /zanox-affiliate.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\U7JJ1YQX.txt [ /bs.serving-sys.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\271JBD4B.txt [ /de.sitestat.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\7CQ18W95.txt [ /c.atdmt.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\EQOMO0MB.txt [ /ad.360yield.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\V6NET14Y.txt [ /apmebf.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\VHRKW05W.txt [ /parship.122.2o7.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\6BEF4FMH.txt [ /atdmt.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\8KZCP852.txt [ /adfarm1.adition.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\EGB7Z8NY.txt [ /adtech.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\2ZCO0OC7.txt [ /ad3.adfarm1.adition.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\4YAQQJYD.txt [ /ad.ad-srv.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\5SRL62FG.txt [ /zanox.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\CZ00E0TB.txt [ /adviva.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\WTTMS3BZ.txt [ /webmasterplan.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\BS9ELK06.txt [ /questionmarket.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\NHU28RG2.txt [ /adfarm1.adition.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Q80AIOHK.txt [ /bs.serving-sys.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\CBLZULZR.txt [ /atdmt.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\33EWOE6F.txt [ /dyntracker.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\FYNV03HH.txt [ /nextag.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\R40GVL14.txt [ /counter2.sexmoney.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\2WLR4GWC.txt [ /de.sitestat.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\LLFAJRO2.txt [ /apmebf.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\PTNBOSEL.txt [ /ad.zanox.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\3IDK10ZT.txt [ /xiti.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\4IZUY5AI.txt [ /counter.sexsuche.tv ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\GHBNZP39.txt [ /avgtechnologies.112.2o7.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\CKCXI4SM.txt [ /smartadserver.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\TDVOKOSW.txt [ /ads.creative-serving.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\MWST3MG9.txt [ /de.sitestat.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\6QVNX139.txt [ /ad.zanox.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\1102HIVL.txt [ /ad1.adfarm1.adition.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\8H9US92R.txt [ /eas.apm.emediate.eu ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\3285K5KD.txt [ /amazon-adsystem.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\WT9EGZEV.txt [ /adbrite.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\1R6Q9RTY.txt [ /specificclick.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\8NO2CM55.txt [ /guj.122.2o7.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\I85YXGV8.txt [ /media6degrees.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\4KMXOEGS.txt [ /ad2.adfarm1.adition.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\GY2Q60C6.txt [ /fastclick.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\15WADYSW.txt [ /ad4.adfarm1.adition.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\COBWU0PU.txt [ /www.etracker.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\R5DDBNDX.txt [ /invitemedia.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\UT0OSKPY.txt [ /de.sitestat.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\3Q0RSBC5.txt [ /www.netdebit-counter.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\OCW2ONG3.txt [ /tracking.quisma.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\MIO5DGCN.txt [ /ad.yieldmanager.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\LFR04K2U.txt [ /ad.dyntracker.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\S3NGC7ET.txt [ /ww251.smartadserver.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\HR95TZ1L.txt [ /adform.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\LB9AA9NP.txt [ /imrworldwide.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Y3M1N1TU.txt [ /www.zanox-affiliate.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\ZWRZ0ZX6.txt [ /olympiaverlag.122.2o7.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\X2518WDI.txt [ /ad.movad.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\G8GK1YNO.txt [ /yieldmanager.net ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\CAP0D5SM.txt [ Cookie:XXX@serv1.sweetpacks.com/adServe/banners ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\FD1JJ98A.txt [ Cookie:XXX@serv1.sweetpacks.com/adServe ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\BGQ31PVI.txt [ Cookie:XXX@serv1.sweetpacks.com/adServe/static/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\9QR2SAS2.txt [ Cookie:XXX@tradedoubler.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\B2PB3QZJ.txt [ Cookie:XXX@revsci.net/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\9J3BO6DU.txt [ Cookie:XXX@track.webtrekk.net/523478367474333/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\OOS60QZX.txt [ Cookie:XXX@doubleclick.net/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\SU2822TN.txt [ Cookie:XXX@ckz.rajce.idnes.cz/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\4A4ETU1X.txt [ Cookie:XXX@serving-sys.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\BRBWFOA8.txt [ Cookie:XXX@zanox-affiliate.de/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\8FBKWSGP.txt [ Cookie:XXX@ubesttorrent2011.com/tracking/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\D4M515YX.txt [ Cookie:XXX@c.atdmt.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\K42BWSHG.txt [ Cookie:XXX@in.getclicky.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\0IO3XFON.txt [ Cookie:XXX@atdmt.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\6GXADOLD.txt [ Cookie:XXX@adultfriendfinder.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\XCMPTK38.txt [ Cookie:XXX@zanox.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\3BU89BWN.txt [ Cookie:XXX@webmasterplan.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\NTQEY0CF.txt [ Cookie:XXX@idnes.cz/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\XXX@msnportal.112.2o7[1].txt [ Cookie:XXX@msnportal.112.2o7.net/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\N8BZIRGV.txt [ Cookie:XXX@bs.serving-sys.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\HBY1MRRP.txt [ Cookie:XXX@youporngay.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\3V3XP3EI.txt [ Cookie:XXX@eas4.emediate.eu/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\I8I9B9T1.txt [ Cookie:XXX@advertising.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\MFKZZSFL.txt [ Cookie:XXX@ckz.rajce.idnes.cz/_www_root_/ajax/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\M7OU5E0M.txt [ Cookie:XXX@112.2o7.net/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\BV0T6B8E.txt [ Cookie:XXX@ru4.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\TOO8QN1D.txt [ Cookie:XXX@apmebf.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\XXX@studivz.adfarm1.adition[2].txt [ Cookie:XXX@studivz.adfarm1.adition.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\RV3A7CVO.txt [ Cookie:XXX@traffictrack.de/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\ABUIEVWI.txt [ Cookie:XXX@rajce.idnes.cz/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\D11UWQ6E.txt [ Cookie:XXX@xiti.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\HL7XU0W7.txt [ Cookie:XXX@exoclick.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\0UVW4K8Y.txt [ Cookie:XXX@www.rajce.idnes.cz/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\APRMJFUA.txt [ Cookie:XXX@www.youporngay.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\XGYL9S7I.txt [ Cookie:XXX@de.youporngay.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\YAHWXVKQ.txt [ Cookie:XXX@specificclick.net/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\UTDGUWEW.txt [ Cookie:XXX@media6degrees.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\821FFTFT.txt [ Cookie:XXX@guj.122.2o7.net/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\QB0OKUEO.txt [ Cookie:XXX@triptosex.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\S7EEVNUT.txt [ Cookie:XXX@ad4.adfarm1.adition.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\3F6LEI9E.txt [ Cookie:XXX@invitemedia.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\HDFVVOW8.txt [ Cookie:XXX@linksynergy.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\75MHS3XX.txt [ Cookie:XXX@yieldmanager.net/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\DJVI8BD9.txt [ Cookie:XXX@ad.yieldmanager.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\GT65RV4Z.txt [ Cookie:XXX@ad.dyntracker.de/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\UFGM1GZ3.txt [ Cookie:XXX@tracking.quisma.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\WXUUFRKT.txt [ Cookie:XXX@ww251.smartadserver.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\P4VTWS2K.txt [ Cookie:XXX@www.triptosex.com/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\K8A6TH90.txt [ Cookie:XXX@adform.net/ ]
        C:\USERS\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y26BEWMD.txt [ Cookie:XXX@imrworldwide.com/cgi-bin ]
        C:\USERS\XXX\Cookies\VLXYLB0S.txt [ Cookie:XXX@im.banner.t-online.de/ ]
        C:\USERS\XXX\Cookies\08QF4GRH.txt [ Cookie:XXX@tradedoubler.com/ ]
        C:\USERS\XXX\Cookies\8JNZWTON.txt [ Cookie:XXX@revsci.net/ ]
        C:\USERS\XXX\Cookies\59YVD7J4.txt [ Cookie:XXX@insightexpressai.com/ ]
        C:\USERS\XXX\Cookies\0ZFOXLS9.txt [ Cookie:XXX@de.sitestat.com/ndr/tagesschau/ ]
        C:\USERS\XXX\Cookies\M6DBO4VZ.txt [ Cookie:XXX@media6degrees.com/ ]
        C:\USERS\XXX\Cookies\UG7MGMXE.txt [ Cookie:XXX@doubleclick.net/ ]
        C:\USERS\XXX\Cookies\12UKEHAH.txt [ Cookie:XXX@serving-sys.com/ ]
        C:\USERS\XXX\Cookies\FSNEFH72.txt [ Cookie:XXX@zanox-affiliate.de/ ]
        C:\USERS\XXX\Cookies\U7JJ1YQX.txt [ Cookie:XXX@bs.serving-sys.com/ ]
        C:\USERS\XXX\Cookies\7CQ18W95.txt [ Cookie:XXX@c.atdmt.com/ ]
        C:\USERS\XXX\Cookies\V6NET14Y.txt [ Cookie:XXX@apmebf.com/ ]
        C:\USERS\XXX\Cookies\VHRKW05W.txt [ Cookie:XXX@parship.122.2o7.net/ ]
        C:\USERS\XXX\Cookies\6BEF4FMH.txt [ Cookie:XXX@atdmt.com/ ]
        C:\USERS\XXX\Cookies\8KZCP852.txt [ Cookie:XXX@adfarm1.adition.com/ ]
        C:\USERS\XXX\Cookies\2ZCO0OC7.txt [ Cookie:XXX@ad3.adfarm1.adition.com/ ]
        C:\USERS\XXX\Cookies\5SRL62FG.txt [ Cookie:XXX@zanox.com/ ]
        C:\USERS\XXX\Cookies\WTTMS3BZ.txt [ Cookie:XXX@webmasterplan.com/ ]
        C:\USERS\XXX\Cookies\Q80AIOHK.txt [ Cookie:XXX@bs.serving-sys.com/ ]
        C:\USERS\XXX\Cookies\CBLZULZR.txt [ Cookie:XXX@atdmt.com/ ]
        C:\USERS\XXX\Cookies\FYNV03HH.txt [ Cookie:XXX@nextag.de/ ]
        C:\USERS\XXX\Cookies\R40GVL14.txt [ Cookie:XXX@counter2.sexmoney.com/ ]
        C:\USERS\XXX\Cookies\2WLR4GWC.txt [ Cookie:XXX@de.sitestat.com/ndr/ts/ ]
        C:\USERS\XXX\Cookies\LLFAJRO2.txt [ Cookie:XXX@apmebf.com/ ]
        C:\USERS\XXX\Cookies\PTNBOSEL.txt [ Cookie:XXX@ad.zanox.com/ ]
        C:\USERS\XXX\Cookies\3IDK10ZT.txt [ Cookie:XXX@xiti.com/ ]
        C:\USERS\XXX\Cookies\4IZUY5AI.txt [ Cookie:XXX@counter.sexsuche.tv/ ]
        C:\USERS\XXX\Cookies\CAP0D5SM.txt [ Cookie:XXX@serv1.sweetpacks.com/adServe/banners ]
        C:\USERS\XXX\Cookies\MWST3MG9.txt [ Cookie:XXX@de.sitestat.com/ndr/tagesschau/ ]
        C:\USERS\XXX\Cookies\6QVNX139.txt [ Cookie:XXX@ad.zanox.com/ ]
        C:\USERS\XXX\Cookies\1102HIVL.txt [ Cookie:XXX@ad1.adfarm1.adition.com/ ]
        C:\USERS\XXX\Cookies\1R6Q9RTY.txt [ Cookie:XXX@specificclick.net/ ]
        C:\USERS\XXX\Cookies\8NO2CM55.txt [ Cookie:XXX@guj.122.2o7.net/ ]
        C:\USERS\XXX\Cookies\I85YXGV8.txt [ Cookie:XXX@media6degrees.com/ ]
        C:\USERS\XXX\Cookies\GY2Q60C6.txt [ Cookie:XXX@fastclick.net/ ]
        C:\USERS\XXX\Cookies\15WADYSW.txt [ Cookie:XXX@ad4.adfarm1.adition.com/ ]
        C:\USERS\XXX\Cookies\R5DDBNDX.txt [ Cookie:XXX@invitemedia.com/ ]
        C:\USERS\XXX\Cookies\UT0OSKPY.txt [ Cookie:XXX@de.sitestat.com/sueddeutsche/sueddeutsche/ ]
        C:\USERS\XXX\Cookies\3Q0RSBC5.txt [ Cookie:XXX@www.netdebit-counter.de/ ]
        C:\USERS\XXX\Cookies\OCW2ONG3.txt [ Cookie:XXX@tracking.quisma.com/ ]
        C:\USERS\XXX\Cookies\MIO5DGCN.txt [ Cookie:XXX@ad.yieldmanager.com/ ]
        C:\USERS\XXX\Cookies\LFR04K2U.txt [ Cookie:XXX@ad.dyntracker.de/ ]
        C:\USERS\XXX\Cookies\S3NGC7ET.txt [ Cookie:XXX@ww251.smartadserver.com/ ]
        C:\USERS\XXX\Cookies\HR95TZ1L.txt [ Cookie:XXX@adform.net/ ]
        C:\USERS\XXX\Cookies\LB9AA9NP.txt [ Cookie:XXX@imrworldwide.com/cgi-bin ]
        C:\USERS\XXX\Cookies\FD1JJ98A.txt [ Cookie:XXX@serv1.sweetpacks.com/adServe ]
        C:\USERS\XXX\Cookies\ZWRZ0ZX6.txt [ Cookie:XXX@olympiaverlag.122.2o7.net/ ]
        C:\USERS\XXX\Cookies\BGQ31PVI.txt [ Cookie:XXX@serv1.sweetpacks.com/adServe/static/ ]
        C:\USERS\XXX\Cookies\G8GK1YNO.txt [ Cookie:XXX@yieldmanager.net/ ]
        adserv.quality-channel.de [ C:\USERS\XXX\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SXXTNPJM ]
        ia.media-imdb.com [ C:\USERS\XXX\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SXXTNPJM ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adserv.quality-channel.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ad.de.doubleclick.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .112.2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .elitepartner.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .youporngay.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .youporngay.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.youporngay.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        7.rotator.wigetmedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .www4.smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .aka-cdn-ns.adtech.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .aka-cdn-ns.adtech.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        mediathek.daserste.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        tracker.bmtsystem.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        wstat.wibiya.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adserv.quality-channel.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adserve.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.youporngay.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .youporngay.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .youporngay.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .hitbox.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .phg.hitbox.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        aimfar.solution.weborama.fr [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .weborama.fr [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .weborama.fr [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .weboramapublishertrackinguk2.solution.weborama.fr [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .weboramapublishertrackinguk2.solution.weborama.fr [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .pathfinder.wikia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .pathfinder.wikia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        pathfinder.wikia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .game-advertising-online.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        pathfinder.wikia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .media.fastclick.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aelyooc5agp.stats.esomniture.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www7.addfreestats.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webstatsdomain.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webstatsdomain.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.webstatsdomain.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .advertisingenhanced.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .advertisingenhanced.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .advertstream.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        adprudence.rotator.hadj7.adjuggler.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .track.right-ads.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .srv.resultsmedia.biz [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.universal-traffic.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        trackstatsnow.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.visit-tracker.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.universal-traffic.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .technoratimedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .technoratimedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.track-visits.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.track-visits.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.openisbn.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.openisbn.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .bwincom.122.2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.openisbn.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.openisbn.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.openisbn.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.openisbn.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.openisbn.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.openisbn.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.openisbn.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.openisbn.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .pathfinderwiki.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .pathfinderwiki.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .pro-market.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .pathfinderdb.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .pathfinderdb.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webstats4u.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .advertstream.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www2.adserverpub.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.universal-traffic.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adnetwork.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        tracking.hostgator.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .mediafire.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.mediafire.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.mediafire.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tto2.traffictrack.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        counter.hitslink.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        targeting.revenuemax.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .quartermedia.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tns-counter.ru [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .openstat.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .c1.atdmt.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        server.adform.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        partners.webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .flagcounter.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        banner.electronic-arts.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        in.getclicky.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .unister-adservices.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .unister-adservices.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        adserver.sevenload.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .oms.122.2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revenuemax.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .unrulymedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tracking.mindshare.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .eaeacom.112.2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        s2.netxmedia.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        farm1.netxmedia.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .parship.122.2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .dailymotionpoc.112.2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revenuemax.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        7.rotator.wigetmedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        gotacha.rotator.hadj7.adjuggler.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        server.adformdsp.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adformdsp.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradetracker.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        stat.gruene-bundestag.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        traffic.brand-wall.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .burstnet.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        zbox.zanox.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        adx2.chip.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tracker.vinsight.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .gs-media.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.usenext.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .guj.122.2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .olympiaverlag.122.2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        tomtailor.dyntracker.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .myroitracking.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        aa.adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        handpickedmedia.co.uk [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]

cosinus 16.09.2012 18:25
Code:
UAC On - Limited User
Wie hast du sasw gestartet? Einfach per Doppelklick?

Charlene 17.09.2012 07:43
gute Frage. Dachte ich hätte es als Administrator gestartet. Sicher bin ich mir aber nicht

cosinus 17.09.2012 12:08
Dann bitte wiederholen und richtig vorher starten

Charlene 18.09.2012 18:51
hier also nochmal:

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/18/2012 at 11:09 AM

Application Version : 5.5.1016

Core Rules Database Version : 9244
Trace Rules Database Version: 7056

Scan type      : Complete Scan
Total Scan Time : 02:00:55

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 771
Memory threats detected  : 0
Registry items scanned    : 72645
Registry threats detected : 0
File items scanned        : 75960
File threats detected    : 121

Adware.Tracking Cookie
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\58IHB6T4.txt [ /im.banner.t-online.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\TCWBYENE.txt [ /tradedoubler.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\V1AX2KCD.txt [ /mediaplex.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\14O1D3OT.txt [ /revsci.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\D6V37B7X.txt [ /track.adform.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\VH6HX5ZI.txt [ /serving-sys.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\JLS4IRGR.txt [ /zanox-affiliate.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\8385ZJL4.txt [ /atdmt.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\ZIJ0UU3A.txt [ /adtech.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\MMGVD41W.txt [ /ad3.adfarm1.adition.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\H7HJH3KA.txt [ /zanox.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\TZ8GKYEX.txt [ /webmasterplan.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\009VLLJS.txt [ /bs.serving-sys.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\287A474R.txt [ /adfarm1.adition.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\7MOG24N0.txt [ /statcounter.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\XAA1ESDL.txt [ /apmebf.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\L421YDPN.txt [ /traffictrack.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\WV63DB9U.txt [ /tracking.mlsat02.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\2JDA72WZ.txt [ /eaeacom.112.2o7.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\1YJOBEZW.txt [ /ads.creative-serving.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\O7MM9AYW.txt [ /specificclick.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\Q49UZPMC.txt [ /invitemedia.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\GEF74549.txt [ /yieldmanager.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\UQSHI4W1.txt [ /ad.yieldmanager.com ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\HJ3MRUAU.txt [ /adform.net ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\D1PYI66L.txt [ /banner.electronic-arts.de ]
        C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Cookies\N3L7BO7H.txt [ /doubleclick.net ]
        C:\USERS\XXX\Cookies\58IHB6T4.txt [ Cookie:XXX@im.banner.t-online.de/ ]
        C:\USERS\XXX\Cookies\TCWBYENE.txt [ Cookie:XXX@tradedoubler.com/ ]
        C:\USERS\XXX\Cookies\14O1D3OT.txt [ Cookie:XXX@revsci.net/ ]
        C:\USERS\XXX\Cookies\VH6HX5ZI.txt [ Cookie:XXX@serving-sys.com/ ]
        C:\USERS\XXX\Cookies\JLS4IRGR.txt [ Cookie:XXX@zanox-affiliate.de/ ]
        C:\USERS\XXX\Cookies\8385ZJL4.txt [ Cookie:XXX@atdmt.com/ ]
        C:\USERS\XXX\Cookies\MMGVD41W.txt [ Cookie:XXX@ad3.adfarm1.adition.com/ ]
        C:\USERS\XXX\Cookies\H7HJH3KA.txt [ Cookie:XXX@zanox.com/ ]
        C:\USERS\XXX\Cookies\TZ8GKYEX.txt [ Cookie:XXX@webmasterplan.com/ ]
        C:\USERS\XXX\Cookies\009VLLJS.txt [ Cookie:XXX@bs.serving-sys.com/ ]
        C:\USERS\XXX\Cookies\7MOG24N0.txt [ Cookie:XXX@statcounter.com/ ]
        C:\USERS\XXX\Cookies\XAA1ESDL.txt [ Cookie:XXX@apmebf.com/ ]
        C:\USERS\XXX\Cookies\L421YDPN.txt [ Cookie:XXX@traffictrack.de/ ]
        C:\USERS\XXX\Cookies\WV63DB9U.txt [ Cookie:XXX@tracking.mlsat02.de/tmobile/ ]
        C:\USERS\XXX\Cookies\2JDA72WZ.txt [ Cookie:XXX@eaeacom.112.2o7.net/ ]
        C:\USERS\XXX\Cookies\O7MM9AYW.txt [ Cookie:XXX@specificclick.net/ ]
        C:\USERS\XXX\Cookies\Q49UZPMC.txt [ Cookie:XXX@invitemedia.com/ ]
        C:\USERS\XXX\Cookies\GEF74549.txt [ Cookie:XXX@yieldmanager.net/ ]
        C:\USERS\XXX\Cookies\UQSHI4W1.txt [ Cookie:XXX@ad.yieldmanager.com/ ]
        C:\USERS\XXX\Cookies\HJ3MRUAU.txt [ Cookie:XXX@adform.net/ ]
        C:\USERS\XXX\Cookies\D1PYI66L.txt [ Cookie:XXX@banner.electronic-arts.de/ ]
        C:\USERS\XXX\Cookies\N3L7BO7H.txt [ Cookie:XXX@doubleclick.net/ ]
        .im.banner.t-online.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .olympiaverlag.122.2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        banner.electronic-arts.de [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]
        .eaeacom.112.2o7.net [ C:\USERS\XXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RL45WB5X.DEFAULT\COOKIES.SQLITE ]

cosinus 19.09.2012 14:57
Er zeigt immer noch limited an, das scheint ein Bug von SASW zu sein...

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Charlene 20.09.2012 06:41
Danke für die Hinweise. Ich benutze Firefox und werde den CookieCuller mal ausprobieren :)

Also momentan läuft der PC wieder ganz normal. Ich kann keine Probleme mehr feststellen.

cosinus 20.09.2012 14:50
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Charlene 20.09.2012 21:24
Na super. Dann hoffen wir mal das es so bleibt. Habe auch schon mal den Cookie Culler und Secunia PSI ausprobiert. Klappt auch gut. Java ist auch aktualisiert und die alten Versionen gelöscht.

Dann danke ich die vielmals für deine Zeit und Geduld. :applaus: Allein wäre ich da hilflos gewesen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:11 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131