| Herr Graf | 18.11.2012 11:45 |
okay, hab nix gefunden...mach es jetzt nochmal! letztes mal hat es ne stunde gebraucht, also kann sein, dass es etwas braucht, bis ich wieder antworte!
so jetzt ist die logfile da! Code:
ComboFix 12-11-16.02 - Timo 18.11.2012 11:55:29.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.2940.2104 [GMT 1:00]
ausgeführt von:: c:\users\Timo\Desktop\ComboFix.exe
AV: Panda Internet Security 2013 *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59}
FW: Panda Personal Firewall 2013 *Disabled* {BEAC95A5-D3E6-6608-9A7D-C12F7882CA22}
SP: Panda Internet Security 2013 *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\facemoods.com
c:\program files\facemoods.com\facemoods\1.4.17.7\bh\facemoods.dll
c:\program files\facemoods.com\facemoods\1.4.17.7\facemoods.crx
c:\program files\facemoods.com\facemoods\1.4.17.7\facemoods.png
c:\program files\facemoods.com\facemoods\1.4.17.7\facemoodsApp.dll
c:\program files\facemoods.com\facemoods\1.4.17.7\facemoodsEng.dll
c:\program files\facemoods.com\facemoods\1.4.17.7\facemoodsTlbr.dll
c:\program files\facemoods.com\facemoods\1.4.17.7\uninstall.exe
c:\program files\facemoods.com\sqlite3.dll
c:\program files\FunWebProducts
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\programdata\dsgsdgdsgdsgw.pad
c:\programdata\lsass.exe
c:\users\Timo\AppData\Local\Microsoft\Windows\Temporary Internet Files\{782FD180-2CBD-4E80-943A-142727937598}.xps
c:\users\Timo\AppData\Roaming\inst.exe
c:\users\Timo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
c:\windows\$NtUninstallKB42671$
c:\windows\IsUn0407.exe
c:\windows\system32\dds_log_ad13.cmd
c:\windows\system32\DEBUG.log
c:\windows\unin0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-10-18 bis 2012-11-18 ))))))))))))))))))))))))))))))
.
.
2012-11-18 11:28 . 2012-11-18 11:33 -------- d-----w- c:\users\Timo\AppData\Local\temp
2012-11-18 11:28 . 2012-11-18 11:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-11-18 11:28 . 2012-11-18 11:28 -------- d-----w- c:\users\Urlaub\AppData\Local\temp
2012-11-18 11:28 . 2012-11-18 11:28 -------- d-----w- c:\users\Toshiba\AppData\Local\temp
2012-11-18 11:28 . 2012-11-18 11:28 -------- d-----w- c:\users\Marie\AppData\Local\temp
2012-11-18 11:28 . 2012-11-18 11:28 -------- d-----w- c:\users\Gast\AppData\Local\temp
2012-11-17 19:08 . 2012-11-17 19:08 -------- d-----w- c:\programdata\Panda Software
2012-11-17 14:49 . 2012-11-17 14:49 -------- d-----w- C:\FRST
2012-11-16 16:40 . 2012-11-16 16:40 -------- d-----w- c:\users\Timo\AppData\Local\Panda Security
2012-11-16 16:40 . 2012-11-16 16:40 13880 ----a-w- c:\windows\system32\drivers\COMFiltr.sys
2012-11-16 16:39 . 2012-11-17 08:50 183180 ----a-w- c:\windows\system32\drivers\APPFCONT.DAT
2012-11-16 16:39 . 2010-09-09 15:23 193864 ----a-w- c:\windows\system32\drivers\idsflt.sys
2012-11-16 16:39 . 2009-09-25 13:54 46856 ----a-w- c:\windows\system32\drivers\wnmflt.sys
2012-11-16 16:39 . 2009-09-25 13:54 53256 ----a-w- c:\windows\system32\drivers\dsaflt.sys
2012-11-16 16:39 . 2011-01-31 15:41 83528 ----a-w- c:\windows\system32\drivers\APPFLT.SYS
2012-11-16 16:39 . 2009-09-25 13:54 159112 ----a-w- c:\windows\system32\drivers\NETFLTDI.SYS
2012-11-16 16:39 . 2009-09-25 13:54 22024 ----a-w- c:\windows\system32\drivers\fnetmon.sys
2012-11-16 16:39 . 2012-11-16 16:39 -------- d-----w- c:\programdata\Backup
2012-11-16 16:39 . 2010-06-22 17:13 26696 ----a-w- c:\windows\system32\drivers\pavboot.sys
2012-11-16 16:38 . 2012-11-16 16:38 -------- d-----w- c:\program files\Common Files\Panda Security
2012-11-16 16:38 . 2012-05-08 10:31 164488 ----a-w- c:\windows\system32\drivers\PavProc.sys
2012-11-16 16:38 . 2011-02-21 13:38 37448 ----a-w- c:\windows\system32\drivers\ShlDrv51.sys
2012-11-16 16:11 . 2012-07-26 03:39 526952 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-11-16 16:11 . 2012-07-26 03:39 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-11-16 16:11 . 2012-07-26 02:46 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-11-16 16:10 . 2012-07-26 02:33 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-11-16 16:10 . 2012-07-26 02:32 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-11-16 16:10 . 2012-07-26 03:20 73216 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-11-16 16:10 . 2012-07-26 03:20 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-11-16 16:10 . 2012-07-26 03:21 196608 ----a-w- c:\windows\system32\WUDFHost.exe
2012-11-16 16:10 . 2012-07-26 03:20 613888 ----a-w- c:\windows\system32\WUDFx.dll
2012-11-16 16:10 . 2012-07-26 03:20 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-11-16 16:05 . 2012-11-17 08:50 -------- d-----w- c:\program files\Mamutu
2012-11-16 11:02 . 2012-09-25 21:55 78336 ----a-w- c:\windows\system32\synceng.dll
2012-11-16 11:02 . 2012-10-18 17:57 2344960 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-16 20:07 . 2011-06-20 09:09 0 ----a-w- c:\windows\system32\drivers\dfsc.sys
2012-11-09 12:07 . 2012-03-29 18:29 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-09 12:07 . 2011-06-05 11:34 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-09 12:41 . 2012-03-30 12:53 10220472 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2012-09-14 18:30 . 2012-10-10 14:19 2048 ----a-w- c:\windows\system32\tzres.dll
2012-08-31 17:21 . 2012-10-10 14:19 1210736 ----a-w- c:\windows\system32\drivers\ntfs.sys
2012-08-30 17:18 . 2012-10-10 14:17 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-30 17:18 . 2012-10-10 14:17 3902832 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-24 17:10 . 2012-10-10 14:19 172544 ----a-w- c:\windows\system32\wintrust.dll
2011-06-24 13:33 . 2011-03-23 16:27 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\tbFree.dll" [2010-10-18 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\Freecorder\tbFree.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6681EEB-E0FD-4DC2-8EBF-051F9986DA00}]
2012-03-15 16:26 181328 ----a-w- c:\program files\billigerde\Internet Explorer\billigerde.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\tbFree.dll" [2010-10-18 3908192]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-10-18 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{1392B8D2-5C05-419F-A8F6-B9F15A596612}"= "c:\program files\Freecorder\tbFree.dll" [2010-10-18 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-07 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"Media Finder"="c:\program files\Media Finder\MF.exe" [2012-03-30 8587776]
"Facebook Update"="c:\users\Timo\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096]
"ICQ"="c:\program files\ICQ7M\ICQ.exe" [2012-06-29 127040]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-07-13 17418928]
"Spotify Web Helper"="c:\users\Timo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-11-16 1199576]
"Spotify"="c:\users\Timo\AppData\Roaming\Spotify\spotify.exe" [2012-11-16 7880664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-20 1545512]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-08-03 611672]
"TosNC"="c:\program files\Toshiba\BulletinBoard\TosNcCore.exe" [2009-08-06 466792]
"TosReelTimeMonitor"="c:\program files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [2009-08-06 29528]
"Toshiba TEMPRO"="c:\program files\Toshiba TEMPRO\TemproTray.exe" [2009-08-06 1050000]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-28 7625248]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-02 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-02 151064]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2009-08-05 476512]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2009-03-09 55160]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2009-08-13 521528]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2009-08-05 738616]
"SmartFaceVWatcher"="c:\program files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe" [2009-07-29 163840]
"TWebCamera"="c:\program files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-08-11 2446648]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaReminder.exe" [2009-07-30 134032]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-05-01 645328]
"HostManager"="c:\program files\Common Files\AOL\1267025681\ee\AOLSoftware.exe" [2006-09-26 50736]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"Freecorder FLV Service"="c:\program files\Freecorder\FLVSrvc.exe" [2011-03-24 167936]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-11-12 421736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-09-30 252296]
"B2C_AGENT"="c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe" [2011-09-28 404568]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2011-12-09 74752]
"vspdfprsrv.exe"="c:\program files\Visagesoft\eXPert PDF\vspdfprsrv.exe" [2006-05-04 998912]
"APVXDWIN"="c:\program files\Panda Security\Panda Internet Security 2013\APVXDWIN.EXE" [2012-06-21 1053984]
"SCANINICIO"="c:\program files\Panda Security\Panda Internet Security 2013\Inicio.exe" [2012-06-08 70432]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-08-12 6203296]
.
c:\users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\Toshiba\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
c:\users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\Toshiba\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
c:\users\Timo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
debug.log [2012-7-25 7878]
Facebook Messenger.lnk - c:\users\Timo\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe [2012-9-25 247728]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-3-3 110592]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\Toshiba\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2010-03-24 11:55 55552 ----a-w- c:\windows\System32\avldr.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer4"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]
@="Service"
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus.sys [x]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag.sys [x]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps.sys [x]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem.sys [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\lgandadb.sys [x]
R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R3 HRService;Haufe iDesk-Service in c:\program files\Haufe\iDesk\iDeskService\Zope;c:\program files\Haufe\iDesk\iDeskService\iDeskService.exe [x]
R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [x]
R3 PavSRK.sys;PavSRK.sys;c:\windows\system32\PavSRK.sys [x]
R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [x]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [x]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [x]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [x]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [x]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [x]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
R3 TMachInfo;TMachInfo;c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
R3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [x]
S0 pavboot;Panda boot driver;c:\windows\system32\Drivers\pavboot.sys [x]
S1 a2injectiondriver;a2injectiondriver;c:\program files\Mamutu\a2dix86.sys [x]
S1 a2util;a-squared Malware-IDS utility driver;c:\program files\Mamutu\a2util32.sys [x]
S1 ShldDrv;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShlDrv51.sys [x]
S2 AmFSM;AmFSM;c:\windows\system32\DRIVERS\amm8660.sys [x]
S2 APPFLT;App Filter Plugin;c:\windows\system32\Drivers\APPFLT.SYS [x]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [x]
S2 ComFiltr;Panda Anti-Dialer;c:\windows\system32\DRIVERS\COMFiltr.sys [x]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [x]
S2 DSAFLT;DSA Filter Plugin;c:\windows\system32\Drivers\DSAFLT.SYS [x]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
S2 FNETMON;NetMon Filter Plugin;c:\windows\system32\Drivers\fnetmon.SYS [x]
S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [x]
S2 IDSFLT;Ids Filter Plugin;c:\windows\system32\Drivers\IDSFLT.SYS [x]
S2 Mamutu;Mamutu Service;c:\program files\Mamutu\a2service.exe [x]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [x]
S2 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\Drivers\NETFLTDI.SYS [x]
S2 PavProc;Panda Process Protection Driver;c:\windows\system32\DRIVERS\PavProc.sys [x]
S2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Internet Security 2013\PskSvc.exe [x]
S2 RSELSVC;TOSHIBA Modem region select service;c:\program files\TOSHIBA\RSelect\RSelSvc.exe [x]
S2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files\Toshiba TEMPRO\TemproSvc.exe [x]
S2 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\Drivers\WNMFLT.SYS [x]
S3 a2acc;a2acc;c:\program files\MAMUTU\a2accx86.sys [x]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [x]
S3 NETIMFLT01060044;PANDA NDIS IM Filter Miniport v1.6.0.44;c:\windows\system32\DRIVERS\neti1644.sys [x]
S3 PavTPK.sys;PavTPK.sys;c:\windows\system32\PavTPK.sys [x]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11bg 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [x]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [x]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HsfXAudioService REG_MULTI_SZ HsfXAudioService
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
VC4CB104
.
Inhalt des "geplante Tasks" Ordners
.
2012-11-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 12:07]
.
2012-11-17 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2501585131-3938103745-153319493-1003Core.job
- c:\users\Timo\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-12 11:30]
.
2012-11-17 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2501585131-3938103745-153319493-1003UA.job
- c:\users\Timo\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-12 11:30]
.
2012-11-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 16:06]
.
2012-11-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 16:06]
.
2010-09-08 c:\windows\Tasks\Install_NSS.job
- c:\program files\DivX\Symantec\scstubinstaller.exe [2010-03-08 18:00]
.
2012-11-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-07 06:57]
.
2012-11-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-07 06:57]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.facemoods.com/?a=ddrnw
uInternet Settings,ProxyOverride = *.local;<local>
IE: &AOL Toolbar-Suche - c:\program files\aol\aol toolbar 4.0\resources\de-DE\local\search.html
IE: An OneNote s&enden - /105
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: Free YouTube Download - c:\users\Timo\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\users\Timo\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files\ICQ7M\ICQ.exe
FF - ProfilePath - c:\users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\348968xw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.de/
FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZCfox000&ptnrS=ZCfox000&ptb=7j.t4k1I98YCpyiYIbPo4w&ind=2010051609&n=77cef419&psa=&st=kwd&searchfor=
FF - prefs.js: network.proxy.type - 4
FF - ExtSQL: 2012-10-16 20:43; unplug@compunach; c:\users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\348968xw.default\extensions\unplug@compunach.xpi
FF - ExtSQL: 2012-10-16 21:01; {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}; c:\users\Timo\AppData\Roaming\Mozilla\Firefox\Profiles\348968xw.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
FF - user.js: browser.sessionstore.resume_from_crash - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{1CFFA392-0898-4b1c-89D1-6E98F9D8EF78} - (no file)
HKCU-Run-AnyDVD - g:\anydvd\AnyDVD.exe
HKCU-Run-LG LinkAir - (no file)
HKCU-Run-Akamai NetSession Interface - c:\users\Timo\AppData\Local\Akamai\netsession_win.exe
HKCU-Run-Questler Bonusfinder - c:\users\Timo\Downloads\Bonusfinder2.exe
HKCU-Run-Regedit32 - c:\windows\system32\regedit.exe
HKLM-Run-LCWB - c:\program files\LernenUndCo\LCWB.exe
HKLM-Run-lxcrmon.exe - c:\program files\Lexmark 2400 Series\lxcrmon.exe
HKLM-Run-EzPrint - c:\program files\Lexmark 2400 Series\ezprint.exe
HKLM-Run-Adobe Acrobat Speed Launcher - h:\acrobat\Acrobat_sl.exe
HKLM-Run-Acrobat Assistant 8.0 - h:\acrobat\Acrotray.exe
AddRemove-Adobe Photoshop 7.0 - c:\windows\ISUN0407.EXE
AddRemove-AOL Toolbar 4.0 - c:\program files\AOL\AOL Toolbar 4.0\uninstall.exe
AddRemove-facemoods - c:\program files\facemoods.com\facemoods\1.4.17.7\uninstall.exe
AddRemove-FRITZ! 2.0 - c:\windows\IsUn0407.exe
AddRemove-LEGOLANDDeInstKey - c:\windows\unin0407.exe
AddRemove-S4Uninst - c:\windows\IsUn0407.exe
AddRemove-Siedler3Deinstall - c:\windows\IsUn0407.exe
AddRemove-New LEGO Digital Designer - c:\program files\LEGO Company\LEGO Digital Designer\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064}"=hex:51,66,7a,6c,4c,1d,38,12,26,bd,a8,
0a,e6,f4,22,0e,f1,4c,12,2a,bb,94,a4,70
"{DE9C389F-3316-41A7-809B-AA305ED9D922}"=hex:51,66,7a,6c,4c,1d,38,12,f1,3b,8f,
da,24,7d,c9,04,ff,8d,e9,70,5b,87,9d,36
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"=hex:51,66,7a,6c,4c,1d,38,12,c7,8d,a2,
03,11,eb,0f,0c,c9,ad,54,4d,e1,19,18,de
"{1392B8D2-5C05-419F-A8F6-B9F15A596612}"=hex:51,66,7a,6c,4c,1d,38,12,bc,bb,81,
17,37,12,f1,04,d7,e0,fa,b1,5f,07,22,06
"{30F9B915-B755-4826-820B-08FBA6BD249D}"=hex:51,66,7a,6c,4c,1d,38,12,7b,ba,ea,
34,67,f9,48,0d,fd,1d,4b,bb,a3,e3,60,89
"{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}"=hex:51,66,7a,6c,4c,1d,38,12,4a,94,5d,
df,2a,bb,93,08,e3,6a,3b,f5,24,5d,8e,ad
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b,
27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"=hex:51,66,7a,6c,4c,1d,38,12,57,36,90,
43,f7,9e,4b,04,e0,be,4b,59,e7,b4,e8,87
"{00A6FAF1-072E-44CF-8957-5838F569A31D}"=hex:51,66,7a,6c,4c,1d,38,12,9f,f9,b5,
04,1c,49,a1,01,f6,41,1b,78,f0,37,e7,09
"{07B18EA1-A523-4961-B6BB-170DE4475CCA}"=hex:51,66,7a,6c,4c,1d,38,12,cf,8d,a2,
03,11,eb,0f,0c,c9,ad,54,4d,e1,19,18,de
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{21A88CB9-84D2-4020-A2D1-B25A21034884}"=hex:51,66,7a,6c,4c,1d,38,12,d7,8f,bb,
25,e0,ca,4e,05,dd,c7,f1,1a,24,5d,0c,90
"{27B4851A-3207-45A2-B947-BE8AFE6163AB}"=hex:51,66,7a,6c,4c,1d,38,12,74,86,a7,
23,35,7c,cc,00,c6,51,fd,ca,fb,3f,27,bf
"{64182481-4F71-486B-A045-B233BD0DA8FC}"=hex:51,66,7a,6c,4c,1d,38,12,ef,27,0b,
60,43,01,05,0d,df,53,f1,73,b8,53,ec,e8
"{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}"=hex:51,66,7a,6c,4c,1d,38,12,0c,42,46,
78,85,c2,ca,00,c7,e2,cd,e1,c2,06,c1,ed
"{7DB2D5A0-7241-4E79-B68D-6309F01C5231}"=hex:51,66,7a,6c,4c,1d,38,12,ce,d6,a1,
79,73,3c,17,0b,c9,9b,20,49,f5,42,16,25
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b,
ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3
"{AD4DF010-E2FD-43CE-864A-6BD1EDC59AC2}"=hex:51,66,7a,6c,4c,1d,38,12,7e,f3,5e,
a9,cf,ac,a0,06,f9,5c,28,91,e8,9b,de,d6
"{AE7CD045-E861-484F-8273-0445EE161910}"=hex:51,66,7a,6c,4c,1d,38,12,2b,d3,6f,
aa,53,a6,21,0d,fd,65,47,05,eb,48,5d,04
"{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93,
aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83
"{B164E929-A1B6-4A06-B104-2CD0E90A88FF}"=hex:51,66,7a,6c,4c,1d,38,12,47,ea,77,
b5,84,ef,68,0f,ce,12,6f,90,ec,54,cc,eb
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{CA4520F3-AE13-4FB1-A513-58E23991C86D}"=hex:51,66,7a,6c,4c,1d,38,12,9d,23,56,
ce,21,e0,df,0a,da,05,1b,a2,3c,cf,8c,79
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{F4971EE7-DAA0-4053-9964-665D8EE6A077}"=hex:51,66,7a,6c,4c,1d,38,12,89,1d,84,
f0,92,94,3d,05,e6,72,25,1d,8b,b8,e4,63
"{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}"=hex:51,66,7a,6c,4c,1d,38,12,49,e1,1e,
1a,d6,12,cd,0b,d4,1a,c8,43,e4,f4,32,a8
"{929801A8-4AEF-4D12-BE31-D85BF666452B}"=hex:51,66,7a,6c,4c,1d,38,12,c6,02,8b,
96,dd,04,7c,08,c1,27,9b,1b,f3,38,01,3f
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:40,f2,aa,4e,38,2d,cd,01
.
[HKEY_USERS\S-1-5-21-2501585131-3938103745-153319493-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{37A69A0C-9B56-3B33-A92C-31004BCCB324}*]
"hapooehbknglknmm"=hex:6b,61,6d,65,6e,6a,62,6c,65,67,68,6f,67,6e,63,6c,67,62,
68,6c,61,66,00,76
"iafpilhmnlgpebkdjf"=hex:6b,61,6d,65,6e,6a,62,6c,65,67,68,6f,67,6e,63,6c,67,62,
68,6c,61,66,00,76
.
[HKEY_USERS\S-1-5-21-2501585131-3938103745-153319493-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8B4120FE-6112-9DEE-D437-5861B5642BF6}*]
"oagmbmpngddgalhgngeaaelffaogmo"=hex:64,61,70,66,65,63,6f,6e,00,fc
"oacdbkoeedobenommgjhdgkkmejpna"=hex:6b,61,70,66,69,61,70,6c,64,65,69,64,67,6b,
6d,6c,65,66,62,6f,6b,67,00,00
"naemppkfjdbgfbnlmeijekfemgml"=hex:6b,61,70,66,69,61,70,6c,64,65,69,64,67,6b,
6d,6c,65,66,62,6f,6b,67,00,00
.
[HKEY_USERS\S-1-5-21-2501585131-3938103745-153319493-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:d4,a2,7e,ef,77,07,3d,7e,95,70,0a,33,de,9c,a8,2b,c6,4e,5d,3d,1d,29,8b,
99,2d,8b,e6,26,48,51,13,3f,c2,1f,18,86,1d,54,f9,18,13,2c,6d,32,83,06,24,67,\
"??"=hex:fe,c7,7b,27,fc,5b,58,08,33,6c,42,33,39,0b,95,e2
.
[HKEY_USERS\S-1-5-21-2501585131-3938103745-153319493-1003\Software\SecuROM\License information*]
"datasecu"=hex:17,38,a5,7a,9d,10,9d,41,05,ed,04,e1,39,ac,4c,78,e1,a3,a2,4a,bd,
b3,7e,60,52,80,ac,9b,e9,59,8e,62,b6,50,a7,8f,b1,da,15,1b,b4,6b,4b,0f,5b,1c,\
"rkeysecu"=hex:7c,de,46,58,6e,b9,e2,37,fb,dc,5d,59,16,3c,68,fd
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(2956)
c:\users\Timo\AppData\Local\FLVService\lib\FLVSrvLib.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Panda Security\Panda Internet Security 2013\TPSrv.exe
c:\program files\PANDA SECURITY\PANDA INTERNET SECURITY 2013\WebProxy.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\windows\system32\rundll32.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\McAfee\MPF\MPFSrv.exe
c:\program files\McAfee\MSK\MskSrver.exe
c:\program files\Panda Security\Panda Internet Security 2013\PsCtrls.exe
c:\program files\Panda Security\Panda Internet Security 2013\PavFnSvr.exe
c:\program files\Common Files\Panda Security\PavShld\pavprsrv.exe
c:\program files\Panda Security\Panda Internet Security 2013\pavsrvx86.exe
c:\program files\Panda Security\Panda Internet Security 2013\AVENGINE.EXE
c:\program files\panda security\panda internet security 2013\firewall\PSHOST.EXE
c:\program files\Panda Security\Panda Internet Security 2013\PsImSvc.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\TODDSrv.exe
c:\program files\Toshiba\Power Saver\TosCoSrv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\windows\System32\rundll32.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\windows\system32\igfxext.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
c:\windows\system32\taskhost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-11-18 13:03:25 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-11-18 12:03
.
Vor Suchlauf: 2.132.402.176 Bytes frei
Nach Suchlauf: 2.898.972.672 Bytes frei
.
- - End Of File - - EAF3BF4B584CE54DE4B6735C01681944
|
