20Tans onlinebanking Abfrage (Mainzer Volksbank), Trojaner los werden!!!

anemone · 06.09.2010, 20:01

Danke!
Ich hab`s hochgeladen

Gruß
Ulla

cosinus · 06.09.2010, 20:15

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

anemone · 07.09.2010, 14:59

Hallo,
ich hab combofix ausgeführt. Es hat sich beschwert der Virenscanner sei noch aktiv. Ich hatte ihn aber deaktiviert.

Hier bitte:

Combofix Logfile:

Code:

ATTFilter

ComboFix 10-09-06.04 - Ulla 07.09.2010  15:33:38.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.1259 [GMT 2:00]
ausgeführt von:: c:\users\Ulla\Desktop\Cofi.exe
SP: Avira AntiVir PersonalEdition *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Ulla\AppData\Roaming\.#
c:\users\Ulla\AppData\Roaming\.#\MBX@1024@17728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1024@1772928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1024@1772958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1024@17928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1024@1792928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1024@1792958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1030@1BA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1030@1BA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1030@1BA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1038@18528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1038@1852928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1038@1852958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1078@AF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1078@AF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1078@AF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1084@1CB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1084@1CB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1084@1CB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1088@3A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1088@3A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1088@3A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1090@7028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1090@702928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1090@702958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@109C@2828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@109C@282928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@109C@282958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10B0@18528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10B0@1852928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10B0@1852958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10B4@18128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10B4@1812928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10B4@1812958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10B8@17728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10B8@1772928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10B8@1772958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10C4@1C528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10C4@1C52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10C4@1C52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10D0@1AC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10D0@1AC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10D0@1AC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10D4@1B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10D4@1B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10D4@1B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10DC@3728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10DC@372928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10DC@372958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10E0@1CA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10E0@1CA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10E0@1CA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10E8@1DF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10E8@1DF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@10E8@1DF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1108@1628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1108@162928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1108@162958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1108@17328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1108@1732928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1108@1732958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@110C@1E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@110C@1E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@110C@1E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@110C@3628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@110C@362928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@110C@362958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1114@16F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1114@16F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1114@16F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1118@9E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1118@9E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1118@9E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@111C@1BF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@111C@1BF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@111C@1BF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@111C@1C428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@111C@1C42928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@111C@1C42958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@112C@18A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@112C@18A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@112C@18A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1134@18728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1134@1872928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1134@1872958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1138@1828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1138@182928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1138@182958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1138@7628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1138@762928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1138@762958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@113C@1BB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@113C@1BB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@113C@1BB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1144@1CA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1144@1CA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1144@1CA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1148@1B728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1148@1B72928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1148@1B72958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@114C@2D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@114C@2D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@114C@2D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1150@3B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1150@3B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1150@3B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1158@1B628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1158@1B62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1158@1B62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1158@1D828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1158@1D82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1158@1D82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1170@6328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1170@632928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1170@632958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1174@1B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1174@1B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1174@1B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1178@16C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1178@16C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1178@16C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1178@3E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1178@3E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1178@3E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1180@1CD28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1180@1CD2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1180@1CD2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1184@1D228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1184@1D22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1184@1D22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1190@1D728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1190@1D72928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1190@1D72958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1194@1828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1194@182928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1194@182958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1194@1B428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1194@1B42928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1194@1B42958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1198@17028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1198@1702928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1198@1702958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1198@9F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1198@9F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1198@9F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11A0@3D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11A0@3D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11A0@3D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11A4@18D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11A4@18D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11A4@18D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11A4@1D628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11A4@1D62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11A4@1D62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11B0@1D228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11B0@1D22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11B0@1D22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11B0@3B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11B0@3B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11B0@3B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11B4@7428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11B4@742928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11B4@742958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11BC@17C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11BC@17C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11BC@17C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11BC@19028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11BC@1902928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11BC@1902958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11BC@1BE28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11BC@1BE2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11BC@1BE2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11C0@1BA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11C0@1BA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11C0@1BA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11C0@1D328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11C0@1D32928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11C0@1D32958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11C4@1628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11C4@162928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11C4@162958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11CC@18228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11CC@1822928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11CC@1822958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11CC@1AD28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11CC@1AD2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11CC@1AD2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11D8@2628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11D8@262928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11D8@262958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11DC@3A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11DC@3A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11DC@3A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E0@A128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E0@A12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E0@A12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E4@1C728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E4@1C72928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E4@1C72958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E8@1D228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E8@1D22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E8@1D22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E8@3528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E8@352928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E8@352958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E8@3C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E8@3C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11E8@3C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11EC@17728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11EC@1772928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11EC@1772958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11EC@3A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11EC@3A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11EC@3A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11F4@1E228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11F4@1E22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@11F4@1E22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1200@17C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1200@17C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1200@17C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1200@6A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1200@6A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1200@6A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1208@19128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1208@1912928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1208@1912958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1208@1B428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1208@1B42928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1208@1B42958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@120C@1828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@120C@182928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@120C@182958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1214@1AE28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1214@1AE2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1214@1AE2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1218@1728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1218@172928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1218@172958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1218@18328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1218@1832928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1218@1832958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1218@7128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1218@712928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1218@712958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@121C@16C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@121C@16C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@121C@16C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@121C@1BF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@121C@1BF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@121C@1BF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1228@2328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1228@232928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1228@232958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@122C@17328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@122C@1732928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@122C@1732958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@122C@1AB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@122C@1AB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@122C@1AB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1230@1CF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1230@1CF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1230@1CF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1234@17328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1234@1732928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1234@1732958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@123C@18828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@123C@1882928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@123C@1882958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@123C@3928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@123C@392928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@123C@392958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@123C@6A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@123C@6A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@123C@6A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1244@17428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1244@1742928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1244@1742958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1248@18128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1248@1812928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1248@1812958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1248@1CB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1248@1CB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1248@1CB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1250@9D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1250@9D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1250@9D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1254@1C028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1254@1C02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1254@1C02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1254@1DB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1254@1DB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1254@1DB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1254@1E428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1254@1E42928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1254@1E42958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1258@1C928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1258@1C92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1258@1C92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1260@1B828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1260@1B82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1260@1B82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1260@2C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1260@2C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1260@2C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1268@18028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1268@1802928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1268@1802958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@126C@1C028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@126C@1C02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@126C@1C02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1270@1B928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1270@1B92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1270@1B92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1270@3B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1270@3B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1270@3B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1274@1BF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1274@1BF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1274@1BF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1278@1828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1278@182928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1278@182958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1278@1D828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1278@1D82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1278@1D82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@127C@1B528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@127C@1B52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@127C@1B52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1280@1E128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1280@1E12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1280@1E12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1284@1DB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1284@1DB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1284@1DB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1288@18028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1288@1802928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1288@1802958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@128C@3528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@128C@352928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@128C@352958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1294@1CB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1294@1CB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1294@1CB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1298@2628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1298@262928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1298@262958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@129C@1BD28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@129C@1BD2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@129C@1BD2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@129C@1C928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@129C@1C92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@129C@1C92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12A0@1CE28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12A0@1CE2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12A0@1CE2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12A4@2828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12A4@282928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12A4@282958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12A8@6D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12A8@6D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12A8@6D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12AC@1C928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12AC@1C92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12AC@1C92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B0@2A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B0@2A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B0@2A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B0@3728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B0@372928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B0@372958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B4@17F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B4@17F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B4@17F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B4@1B128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B4@1B12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B4@1B12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B8@16F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B8@16F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B8@16F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B8@1CF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B8@1CF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12B8@1CF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12BC@1C028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12BC@1C02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12BC@1C02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C4@1B328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C4@1B32928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C4@1B32958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C4@1B728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C4@1B72928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C4@1B72958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C4@7528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C4@752928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C4@752958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C8@1D328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C8@1D32928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12C8@1D32958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12CC@1BA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12CC@1BA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12CC@1BA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12CC@1DD28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12CC@1DD2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12CC@1DD2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D0@1CD28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D0@1CD2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D0@1CD2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D0@1DA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D0@1DA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D0@1DA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D0@3D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D0@3D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D0@3D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D4@1A328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D4@1A32928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D4@1A32958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D4@1B928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D4@1B92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D4@1B92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D4@2E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D4@2E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D4@2E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D8@1C028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D8@1C02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12D8@1C02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12DC@17428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12DC@1742928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12DC@1742958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12DC@9D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12DC@9D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12DC@9D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12E0@17628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12E0@1762928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12E0@1762958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12E4@1B928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12E4@1B92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12E4@1B92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F0@3628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F0@362928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F0@362958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F0@3828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F0@382928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F0@382958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F4@17228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F4@1722928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F4@1722958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F4@1B028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F4@1B02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F4@1B02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F8@18228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F8@1822928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F8@1822958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F8@2B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F8@2B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@12F8@2B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1300@7628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1300@762928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1300@762958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1308@3928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1308@392928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1308@392958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1310@1A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1310@1A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1310@1A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@131C@1BA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@131C@1BA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@131C@1BA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@131C@1BC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@131C@1BC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@131C@1BC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@131C@1C928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@131C@1C92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@131C@1C92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1320@1C528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1320@1C52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1320@1C52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1320@1C728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1320@1C72928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1320@1C72958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1324@1B028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1324@1B02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1324@1B02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1324@3E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1324@3E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1324@3E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1328@1BF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1328@1BF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1328@1BF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1328@1F128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1328@1F12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1328@1F12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@132C@3E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@132C@3E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@132C@3E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1334@17428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1334@1742928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1334@1742958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1338@17528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1338@1752928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1338@1752958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1340@16D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1340@16D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1340@16D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1348@2328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1348@232928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1348@232958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1354@1D628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1354@1D62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1354@1D62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1360@1628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1360@162928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1360@162958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1360@17728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1360@1772928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1360@1772958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1360@1B328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1360@1B32928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1360@1B32958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1364@1BF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1364@1BF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1364@1BF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@136C@17728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@136C@1772928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@136C@1772958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@136C@1C228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@136C@1C22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@136C@1C22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@137C@1B228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@137C@1B22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@137C@1B22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@137C@1B428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@137C@1B42928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@137C@1B42958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@137C@2928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@137C@292928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@137C@292958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1380@1D428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1380@1D42928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1380@1D42958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1380@B128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1380@B12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1380@B12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@138C@1D528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@138C@1D52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@138C@1D52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1390@17328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1390@1732928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1390@1732958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1390@1D528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1390@1D52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1390@1D52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1398@1D428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1398@1D42928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1398@1D42958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1398@2528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1398@252928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1398@252958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@139C@18728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@139C@1872928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@139C@1872958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13C4@2528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13C4@252928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13C4@252958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13C8@1C028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13C8@1C02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13C8@1C02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13D0@1CB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13D0@1CB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13D0@1CB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13E0@2628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13E0@262928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13E0@262958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13E4@1D628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13E4@1D62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13E4@1D62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13E4@7828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13E4@782928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13E4@782958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13F4@1BC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13F4@1BC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13F4@1BC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13F8@1628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13F8@162928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@13F8@162958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1404@1A528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1404@1A52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1404@1A52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1404@1CF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1404@1CF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1404@1CF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1404@2728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1404@272928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1404@272958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1410@1D328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1410@1D32928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1410@1D32958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1414@1B828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1414@1B82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1414@1B82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1414@1BB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1414@1BB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1414@1BB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1440@1C728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1440@1C72928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1440@1C72958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@14A8@17E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@14A8@17E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@14A8@17E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@14E0@1AB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@14E0@1AB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@14E0@1AB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1560@17A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1560@17A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@1560@17A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@15A0@1C828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@15A0@1C82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@15A0@1C82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@15AC@1628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@15AC@162928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@15AC@162958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@16A4@3E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@16A4@3E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@16A4@3E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@16E4@1D028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@16E4@1D02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@16E4@1D02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@2FC@17128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@2FC@1712928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@2FC@1712958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@304@16F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@304@16F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@304@16F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@3D8@7328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@3D8@732928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@3D8@732958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@40C@17828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@40C@1782928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@40C@1782958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@420@2328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@420@232928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@420@232958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@440@27128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@440@2712928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@440@2712958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@46C@1C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@46C@1C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@46C@1C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@4E8@1CF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@4E8@1CF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@4E8@1CF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@524@2528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@524@252928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@524@252958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@54C@2528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@54C@252928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@54C@252958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@5AC@17428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@5AC@1742928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@5AC@1742958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@5BC@1B928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@5BC@1B92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@5BC@1B92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@62C@17328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@62C@1732928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@62C@1732958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@644@1628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@644@162928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@644@162958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@68C@1C128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@68C@1C12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@68C@1C12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@69C@1BD28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@69C@1BD2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@69C@1BD2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@6A0@1D928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@6A0@1D92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@6A0@1D92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@6EC@1C528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@6EC@1C52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@6EC@1C52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@6F0@17A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@6F0@17A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@6F0@17A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@700@1D628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@700@1D62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@700@1D62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@74C@16C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@74C@16C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@74C@16C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@794@3F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@794@3F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@794@3F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@830@17628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@830@1762928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@830@1762958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@854@3A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@854@3A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@854@3A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@854@9D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@854@9D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@854@9D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@874@1D628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@874@1D62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@874@1D62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@874@3E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@874@3E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@874@3E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@8A8@1DC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@8A8@1DC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@8A8@1DC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@968@18628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@968@1862928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@968@1862958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@974@17728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@974@1772928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@974@1772958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@974@1E528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@974@1E52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@974@1E52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@98C@1D628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@98C@1D62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@98C@1D62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@99C@18428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@99C@1842928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@99C@1842958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9A4@2428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9A4@242928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9A4@242958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9AC@1CF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9AC@1CF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9AC@1CF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9BC@A228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9BC@A22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9BC@A22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9C0@3528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9C0@352928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9C0@352958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9C0@3728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9C0@372928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9C0@372958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9CC@2728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9CC@272928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9CC@272958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9DC@1B228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9DC@1B22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9DC@1B22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9DC@3C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9DC@3C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9DC@3C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9E4@1AC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9E4@1AC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9E4@1AC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9E4@1D428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9E4@1D42928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9E4@1D42958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9E8@3C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9E8@3C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9E8@3C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9F8@2528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9F8@252928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@9F8@252958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A08@3828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A08@382928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A08@382958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A0C@17128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A0C@1712928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A0C@1712958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A0C@1C128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A0C@1C12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A0C@1C12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A14@1BF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A14@1BF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A14@1BF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A14@2328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A14@232928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A14@232958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A1C@18428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A1C@1842928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A1C@1842958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A24@18428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A24@1842928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A24@1842958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A24@3628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A24@362928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A24@362958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A28@18728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A28@1872928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A28@1872958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A2C@1BC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A2C@1BC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A2C@1BC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A38@AB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A38@AB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A38@AB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A4C@17428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A4C@1742928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A4C@1742958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A4C@1C628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A4C@1C62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A4C@1C62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A4C@3A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A4C@3A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A4C@3A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A50@1C028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A50@1C02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A50@1C02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A50@1CB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A50@1CB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A50@1CB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A54@17928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A54@1792928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A54@1792958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A54@17E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A54@17E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A54@17E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A58@16E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A58@16E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A58@16E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A58@1E228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A58@1E22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A58@1E22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A5C@3828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A5C@382928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A5C@382958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A60@1E028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A60@1E02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A60@1E02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A64@1AD28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A64@1AD2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A64@1AD2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A6C@1AB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A6C@1AB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A6C@1AB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A74@17428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A74@1742928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A74@1742958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A78@1C628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A78@1C62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A78@1C62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@18628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@1862928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@1862958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@1B228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@1B22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@1B22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@1C228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@1C22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@1C22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@1CD28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@1CD2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A7C@1CD2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A80@18428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A80@1842928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A80@1842958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A84@1BE28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A84@1BE2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A84@1BE2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A84@1BF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A84@1BF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A84@1BF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@1B828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@1B82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@1B82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@1BC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@1BC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@1BC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@1CA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@1CA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@1CA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@2228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@222928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@222958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@3A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@3A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A88@3A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A8C@1BA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A8C@1BA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A8C@1BA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A94@17728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A94@1772928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A94@1772958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A94@1B528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A94@1B52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A94@1B52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A94@1E128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A94@1E12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A94@1E12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A98@1B828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A98@1B82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A98@1B82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A98@6628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A98@662928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A98@662958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@1CC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@1CC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@1CC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@2D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@2D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@2D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@3E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@3E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@3E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@9D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@9D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@A9C@9D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA0@1BE28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA0@1BE2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA0@1BE2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA4@1C128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA4@1C12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA4@1C12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@17728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@1772928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@1772958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@1AA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@1AA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@1AA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@1C128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@1C12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@1C12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@1C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@1C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@1C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@2428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@242928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AA8@242958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AAC@1D528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AAC@1D52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AAC@1D52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AB8@1CB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AB8@1CB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AB8@1CB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AB8@1D828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AB8@1D82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AB8@1D82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC0@16F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC0@16F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC0@16F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC0@1D228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC0@1D22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC0@1D22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC4@17828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC4@1782928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC4@1782958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC8@17128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC8@1712928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC8@1712958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC8@17928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC8@1792928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC8@1792958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC8@6928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC8@692928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AC8@692958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ACC@3C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ACC@3C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ACC@3C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AD4@1C028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AD4@1C02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AD4@1C02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AD8@1D128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AD8@1D12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AD8@1D12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AD8@2528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AD8@252928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AD8@252958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE0@17C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE0@17C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE0@17C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE0@1C828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE0@1C82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE0@1C82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE0@1DA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE0@1DA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE0@1DA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE4@17228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE4@1722928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE4@1722958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE8@18128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE8@1812928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE8@1812958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE8@18428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE8@1842928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AE8@1842958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AEC@1628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AEC@162928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AEC@162958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AEC@1D928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AEC@1D92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AEC@1D92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AEC@3F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AEC@3F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AEC@3F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF0@17428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF0@1742928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF0@1742958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF0@1CE28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF0@1CE2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF0@1CE2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF0@6628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF0@662928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF0@662958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF8@2528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF8@252928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AF8@252958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@172928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@172958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@17828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1782928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1782958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1B128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1B12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1B12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1C828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1C82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1C82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1CC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1CC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@1CC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@2428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@242928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@AFC@242958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B00@17028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B00@1702928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B00@1702958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B00@6728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B00@672928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B00@672958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B04@1928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B04@192928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B04@192958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B04@6828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B04@682928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B04@682958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B08@1BF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B08@1BF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B08@1BF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B08@7128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B08@712928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B08@712958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B0C@9F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B0C@9F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B0C@9F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B18@17128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B18@1712928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B18@1712958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B18@1D428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B18@1D42928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B18@1D42958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B1C@17128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B1C@1712928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B1C@1712958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B1C@6B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B1C@6B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B1C@6B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B24@17628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B24@1762928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B24@1762958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B24@3828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B24@382928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B24@382958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B28@1C728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B28@1C72928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B28@1C72958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B2C@3A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B2C@3A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B2C@3A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B30@18528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B30@1852928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B30@1852958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B34@19428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B34@1942928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B34@1942958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B34@1C928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B34@1C92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B34@1C92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B34@3E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B34@3E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B34@3E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B38@1BA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B38@1BA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B38@1BA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B38@2728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B38@272928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B38@272958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B40@2428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B40@242928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B40@242958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B40@6928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B40@692928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B40@692958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B44@1E428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B44@1E42928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B44@1E42958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B48@1B728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B48@1B72928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B48@1B72958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B50@9D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B50@9D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B50@9D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B54@6728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B54@672928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B54@672958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B58@3828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B58@382928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B58@382958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B5C@1B228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B5C@1B22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B5C@1B22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B60@1BB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B60@1BB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B60@1BB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B64@1CD28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B64@1CD2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B64@1CD2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B64@6B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B64@6B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B64@6B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B64@9F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B64@9F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B64@9F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B68@1CB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B68@1CB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B68@1CB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B68@1D828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B68@1D82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B68@1D82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B6C@1D228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B6C@1D22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B6C@1D22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B6C@2428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B6C@242928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B6C@242958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B74@2728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B74@272928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B74@272958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B74@2928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B74@292928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B74@292958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B78@17A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B78@17A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B78@17A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B7C@17F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B7C@17F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B7C@17F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B84@18628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B84@1862928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B84@1862958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B84@19128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B84@1912928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B84@1912958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B84@3E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B84@3E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B84@3E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B94@1BB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B94@1BB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B94@1BB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B94@6228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B94@622928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B94@622958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B98@17C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B98@17C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B98@17C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B9C@3A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B9C@3A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B9C@3A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B9C@9C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B9C@9C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@B9C@9C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BA0@2628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BA0@262928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BA0@262958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BA4@1C128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BA4@1C12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BA4@1C12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BA4@1F628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BA4@1F62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BA4@1F62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BAC@3B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BAC@3B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BAC@3B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB0@18028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB0@1802928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB0@1802958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB4@1CF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB4@1CF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB4@1CF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB4@9C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB4@9C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB4@9C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB8@3B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB8@3B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB8@3B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB8@3D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB8@3D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BB8@3D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BC8@3928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BC8@392928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BC8@392958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BC8@AD28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BC8@AD2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BC8@AD2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BCC@1B928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BCC@1B92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BCC@1B92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BD4@18228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BD4@1822928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BD4@1822958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BD4@2328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BD4@232928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BD4@232958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BD8@18728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BD8@1872928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BD8@1872958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE0@1AE28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE0@1AE2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE0@1AE2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE0@1CD28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE0@1CD2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE0@1CD2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE4@1928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE4@192928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE4@192958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE8@6728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE8@672928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BE8@672958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF0@17628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF0@1762928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF0@1762958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF4@2628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF4@262928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF4@262958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF4@B128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF4@B12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF4@B12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF8@1B028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF8@1B02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@BF8@1B02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C08@1C228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C08@1C22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C08@1C22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C28@3F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C28@3F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C28@3F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C30@A028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C30@A02928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C30@A02958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C34@1A728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C34@1A72928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C34@1A72958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C3C@1828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C3C@182928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C3C@182958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C50@17128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C50@1712928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C50@1712958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C50@1D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C50@1D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C50@1D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C54@17028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C54@1702928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C54@1702958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C68@17B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C68@17B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C68@17B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C68@1B928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C68@1B92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C68@1B92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C74@1C928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C74@1C92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C74@1C92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C78@1D828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C78@1D82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C78@1D82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C7C@1D628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C7C@1D62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C7C@1D62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C80@1B528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C80@1B52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C80@1B52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C84@3528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C84@352928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C84@352958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C88@1B228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C88@1B22928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C88@1B22958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C98@1C828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C98@1C82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@C98@1C82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CA4@1D928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CA4@1D92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CA4@1D92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CAC@1AA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CAC@1AA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CAC@1AA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CB4@3A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CB4@3A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CB4@3A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CBC@2728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CBC@272928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CBC@272958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CC4@1728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CC4@172928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CC4@172958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CE8@1BC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CE8@1BC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CE8@1BC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CF0@1D828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CF0@1D82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@CF0@1D82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D00@16E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D00@16E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D00@16E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D08@1C328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D08@1C32928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D08@1C32958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D10@1728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D10@172928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D10@172958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D14@17028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D14@1702928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D14@1702958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D14@1BA28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D14@1BA2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D14@1BA2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D18@3428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D18@342928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D18@342958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D24@17C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D24@17C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D24@17C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D34@1BB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D34@1BB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D34@1BB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D38@17228F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D38@1722928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D38@1722958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D38@17A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D38@17A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D38@17A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D60@6E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D60@6E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D60@6E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D64@1DC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D64@1DC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D64@1DC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D68@1B428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D68@1B42928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D68@1B42958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D68@1D928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D68@1D92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D68@1D92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D74@1C128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D74@1C12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D74@1C12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D78@9E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D78@9E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D78@9E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D80@18028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D80@1802928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D80@1802958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D94@1B828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D94@1B82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@D94@1B82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DA8@1D128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DA8@1D12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DA8@1D12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DC0@1AC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DC0@1AC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DC0@1AC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DC8@B128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DC8@B12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DC8@B12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DCC@1E328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DCC@1E32928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DCC@1E32958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DCC@2428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DCC@242928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DCC@242958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DD4@6628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DD4@662928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DD4@662958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DD8@17E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DD8@17E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DD8@17E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DDC@17928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DDC@1792928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DDC@1792958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DFC@1828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DFC@182928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@DFC@182958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E1C@17728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E1C@1772928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E1C@1772958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E30@3B28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E30@3B2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E30@3B2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E40@1AF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E40@1AF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E40@1AF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E5C@1828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E5C@182928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E5C@182958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E68@3428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E68@342928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E68@342958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E88@1A828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E88@1A82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E88@1A82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E88@1B828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E88@1B82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E88@1B82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E94@6C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E94@6C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E94@6C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E9C@1B928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E9C@1B92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@E9C@1B92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ECC@2A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ECC@2A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ECC@2A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ED0@17628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ED0@1762928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ED0@1762958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ED4@3528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ED4@352928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@ED4@352958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@EEC@1AE28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@EEC@1AE2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@EEC@1AE2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@EFC@1728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@EFC@172928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@EFC@172958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F08@1CC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F08@1CC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F08@1CC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F18@6F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F18@6F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F18@6F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F20@3D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F20@3D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F20@3D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F24@3D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F24@3D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F24@3D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F28@1B828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F28@1B82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F28@1B82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F28@3E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F28@3E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F28@3E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F2C@1C528F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F2C@1C52928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F2C@1C52958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F38@3428F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F38@342928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F38@342958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F38@6A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F38@6A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F38@6A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F40@1B828F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F40@1B82928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F40@1B82958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F40@2D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F40@2D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F40@2D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F48@1CF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F48@1CF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F48@1CF2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F4C@2628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F4C@262928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F4C@262958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F4C@9D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F4C@9D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F4C@9D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F54@1BB28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F54@1BB2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F54@1BB2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F6C@6F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F6C@6F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F6C@6F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F74@2728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F74@272928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F74@272958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F74@3D28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F74@3D2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F74@3D2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F78@1C628F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F78@1C62928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F78@1C62958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F88@1C928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F88@1C92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F88@1C92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F94@17028F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F94@1702928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F94@1702958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F9C@1C128F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F9C@1C12928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@F9C@1C12958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FB0@1BC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FB0@1BC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FB0@1BC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FB4@2928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FB4@292928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FB4@292958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FC0@3F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FC0@3F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FC0@3F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FC8@2728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FC8@272928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FC8@272958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FC8@3E28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FC8@3E2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FC8@3E2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FCC@2C28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FCC@2C2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FCC@2C2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FD0@17728F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FD0@1772928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FD0@1772958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@16F28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@16F2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@16F2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@18A28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@18A2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@18A2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@1B328F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@1B32928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@1B32958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@1B928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@1B92928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FDC@1B92958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FE4@1BC28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FE4@1BC2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FE4@1BC2958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FF8@2928F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FF8@292928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FF8@292958.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FFC@1BF28F8.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FFC@1BF2928.###
c:\users\Ulla\AppData\Roaming\.#\MBX@FFC@1BF2958.###
c:\users\Ulla\AppData\Roaming\ACD Systems\ACDSee\ImageDB.ddf
c:\windows\system32\muzapp.exe

.
(((((((((((((((((((((((   Dateien erstellt von 2010-08-07 bis 2010-09-07  ))))))))))))))))))))))))))))))
.

2010-09-07 13:45 . 2010-09-07 13:46	--------	d-----w-	c:\users\Ulla\AppData\Local\temp
2010-09-07 13:45 . 2010-09-07 13:45	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-09-04 16:15 . 2010-09-04 16:18	--------	d-----w-	c:\program files\ERUNT
2010-09-04 15:42 . 2010-09-04 15:42	--------	d-----w-	c:\users\Ulla\AppData\Roaming\Malwarebytes
2010-09-04 15:42 . 2010-04-29 13:39	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-04 15:42 . 2010-09-04 15:42	--------	d-----w-	c:\programdata\Malwarebytes
2010-09-04 15:42 . 2010-09-04 15:42	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-09-04 15:42 . 2010-04-29 13:39	20952	----a-w-	c:\windows\system32\drivers\mbam.sys

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-07 09:03 . 2008-07-12 12:01	--------	d-----w-	c:\programdata\Google Updater
2010-09-04 15:43 . 2008-03-08 18:07	--------	d-----w-	c:\programdata\PC Suite
2010-09-02 06:02 . 2006-11-02 15:33	638510	----a-w-	c:\windows\system32\perfh007.dat
2010-09-02 06:02 . 2006-11-02 15:33	130462	----a-w-	c:\windows\system32\perfc007.dat
2010-08-11 19:54 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-08-10 16:39 . 2009-07-20 14:35	--------	d-----w-	c:\users\Ulla\AppData\Roaming\Babylonia
2010-08-02 17:41 . 2009-02-19 15:18	--------	d-----w-	c:\program files\SSC Service Utility
2010-07-31 18:20 . 2010-07-31 18:20	--------	d-----w-	c:\users\Ulla\AppData\Roaming\Mozilla-Cache
2010-07-28 11:56 . 2010-07-28 11:56	265528	----a-w-	c:\users\Ulla\AppData\Roaming\SAMSUNG\Kies\UpdateTemp\MCS.Thunder.Update.exe
2010-07-28 11:55 . 2010-07-28 11:55	6144	----a-w-	c:\users\Ulla\AppData\Roaming\SAMSUNG\Kies\UpdateTemp\de-De\MCS.Thunder.Update.resources.dll
2010-07-28 11:55 . 2010-07-28 11:55	9728	----a-w-	c:\users\Ulla\AppData\Roaming\SAMSUNG\Kies\UpdateTemp\Interop.CmdAgentLib.dll
2010-07-28 11:49 . 2010-07-28 11:49	48128	----a-w-	c:\users\Ulla\AppData\Roaming\SAMSUNG\Kies\UpdateTemp\MSC.Thunder.Update.Util.dll
2010-07-28 11:49 . 2010-07-28 11:49	204288	----a-w-	c:\users\Ulla\AppData\Roaming\SAMSUNG\Kies\UpdateTemp\CabLib.dll
2010-07-28 11:49 . 2010-07-28 11:49	6656	----a-w-	c:\users\Ulla\AppData\Roaming\SAMSUNG\Kies\UpdateTemp\MSC.Thunder.UAC.dll
2010-07-28 11:49 . 2010-07-28 11:49	12288	----a-w-	c:\users\Ulla\AppData\Roaming\SAMSUNG\Kies\UpdateTemp\AdminCmdAgent.dll
2010-07-23 13:37 . 2007-02-09 13:24	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-07-23 13:36 . 2009-12-03 13:57	--------	d-----w-	c:\program files\PC Connectivity Solution
2010-07-23 13:35 . 2010-07-21 15:45	--------	d-----w-	c:\users\Ulla\AppData\Roaming\SAMSUNG
2010-07-23 13:35 . 2010-07-21 17:05	--------	d-----w-	c:\programdata\Samsung
2010-07-23 13:35 . 2010-07-21 17:05	--------	d-----w-	c:\program files\Common Files\Samsung
2010-07-21 17:08 . 2010-07-21 15:45	--------	d-----w-	c:\program files\Samsung
2010-07-21 17:05 . 2010-07-21 17:05	--------	d-----w-	c:\program files\MarkAny
2010-06-29 13:25 . 2010-06-29 13:25	7168	----a-w-	c:\programdata\Lexware\bueroeasy\DataVersion.dll
2010-06-26 06:05 . 2010-08-11 18:37	916480	----a-w-	c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-08-11 18:37	71680	----a-w-	c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-08-11 18:37	109056	----a-w-	c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-08-11 18:37	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2010-06-23 04:11 . 2010-06-23 04:11	501936	----a-w-	c:\programdata\Google\Google Toolbar\Update\gtb3E40.tmp.exe
2010-06-21 13:37 . 2010-08-11 18:37	2037760	----a-w-	c:\windows\system32\win32k.sys
2010-06-18 17:31 . 2010-08-11 18:37	36864	----a-w-	c:\windows\system32\rtutils.dll
2010-06-18 15:04 . 2010-08-11 18:37	302080	----a-w-	c:\windows\system32\drivers\srv.sys
2010-06-18 15:04 . 2010-08-11 18:37	144896	----a-w-	c:\windows\system32\drivers\srv2.sys
2010-06-16 16:04 . 2010-08-11 18:37	905088	----a-w-	c:\windows\system32\drivers\tcpip.sys
2010-06-11 16:16 . 2010-08-11 18:37	274944	----a-w-	c:\windows\system32\schannel.dll
2010-06-11 16:15 . 2010-08-11 18:37	1248768	----a-w-	c:\windows\system32\msxml3.dll
2007-04-18 13:09 . 2007-04-18 13:08	560	----a-w-	c:\program files\Global.sw
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9CB65206-89C4-402c-BA80-02D8C59F9B1D}"= "c:\program files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL" [2009-11-17 57344]

[HKEY_CLASSES_ROOT\clsid\{9cb65206-89c4-402c-ba80-02d8c59f9b1d}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-12 68856]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 4186112]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Ulla^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Wallpapers.lnk]
path=c:\users\Ulla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wallpapers.lnk
backup=c:\windows\pss\Wallpapers.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Device Detector]
DevDetect.exe -autorun [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04	39792	----a-w-	c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-12-23 17:05	143360	----a-w-	c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40	687560	----a-w-	c:\users\Ulla\Desktop\Nikki\deamon\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantOn]
2007-02-13 15:31	94212	------w-	c:\program files\CyberLink\PowerCinema Linux\ion_install.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-04-02 14:11	342312	----a-w-	c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2006-12-05 21:55	54832	----a-w-	c:\program files\Home Cinema\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LexwareInfoService]
2008-11-03 12:21	339240	----a-w-	c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaBarFileManager]
2007-06-25 09:55	30024	----a-w-	c:\program files\On Demand Distribution\OD2 Music Manager\OD2MediaBar_VistaFileManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 14:40	155648	----a-w-	c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2009-10-27 14:10	401728	----a-w-	c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-11-11 09:57	1451520	----a-w-	c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-17 19:53	421888	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2006-11-23 14:10	56928	----a-w-	c:\program files\Home Cinema\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2006-12-01 12:37	4186112	----a-w-	c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC Service Utility]
2007-10-09 10:55	665600	----a-w-	c:\program files\SSC Service Utility\ssc_serv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-05-20 14:24	98304	----a-w-	c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-07-25 03:23	149280	----a-w-	c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-07-12 12:01	68856	----a-w-	c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVBroadcast]
2007-02-23 13:44	779776	----a-w-	c:\program files\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVEService]
2007-02-08 18:13	155648	----a-w-	c:\program files\Home Cinema\TV Enhance\TVEService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):b2,03,c2,26,7a,fe,c9,01

R0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-31 135664]
R3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-01-08 1136600]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-10-06 136704]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-10-06 8320]
R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [2010-04-27 98560]
R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [2010-04-27 14848]
R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [2010-04-27 123648]
R3 uxddrv;Dynamically loaded UxdDrv;e:\pc test\uxddrv.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-07-22 717296]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-06-10 108289]
S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-05-25 95568]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-05-28 233472]
S2 srvcPVR;Sceneo PVR Service;c:\program files\Sceneo\Bonavista\Services\PVR\PVRService.exe [2007-02-23 1509888]
S2 TVECapSvc;TVEnhance Background Capture Service (TBCS);c:\program files\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe [2007-02-08 299093]
S2 TVESched;TVEnhance Task Scheduler (TTS));c:\program files\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe [2007-02-08 127059]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-05-25 18136]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-05-28 36608]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2007-05-11 329728]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-11-17 13976]


--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - FSUSBEXDISK

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners

2010-09-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-22 16:39]

2010-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-31 15:18]

2010-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-31 15:18]

2010-09-07 c:\windows\Tasks\User_Feed_Synchronization-{CD62EADB-3433-4A67-8E2E-3A746481A8C1}.job
- c:\windows\system32\msfeedssync.exe [2010-08-11 04:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - eBay: Neue und gebrauchte Elektronikartikel, Autos, Kleidung, Sammlerstücke, Sportartikel und mehr ? alles zu günstigen Preisen
IE: {{B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - c:\nickigames\PartyGaming\PartyCasino\RunApp.exe
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-Run-KiesTrayAgent - (no file)
MSConfigStartUp-avast! - c:\progra~1\ALWILS~1\Avast4\ashDisp.exe
MSConfigStartUp-ICQ Lite - c:\program files\ICQLite\ICQLite.exe
MSConfigStartUp-SearchSettings - c:\program files\pdfforge Toolbar\SearchSettings.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
MSConfigStartUp-Steam - c:\program files\Steam\Steam.exe
MSConfigStartUp-toolbar_eula_launcher - c:\program files\GoogleEULA\EULALauncher.exe
AddRemove-GSview 4.8 - c:\program files\Ghostgum\gsview\uninstgs.exe
AddRemove-Strategic Command 2 Blitzkrieg Demo_is1 - c:\nikki\Battlefront\Strategic Command 2 Blitzkrieg Demo\unins000.exe
AddRemove-{A04C0520-4B34-4A58-ADC6-EFF04BB0C4D6} - c:\nikki\stalingrad\Uninstall.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\Samsung\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\SAMSUNG\USB Drivers\21_Searsburg\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-09-07 15:46
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.032"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.abr"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ani"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.arw"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.bay"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.bmp"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.bw"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.cr2"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.crw"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.cs1"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.cur"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.dcr"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.dcx"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.dib"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.djv"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.djvu"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.dng"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.emf"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.eps"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.erf"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.fff"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.fpx"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3160691577-3524135423-2623167788-1001)
"Progid"="ACDSee Pro 2.5.gif"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.hdr"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.icl"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.icn"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.iff"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ilbm"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.int"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.inta"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.iw4"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.j2c"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.j2k"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jbr"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jfif"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jif"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jp2"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jpc"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jpe"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jpeg"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-3160691577-3524135423-2623167788-1001)
@Denied: (2) (LocalSystem)
"Progid"="jpegfile"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jpk"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jpx"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.kdc"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.lbm"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.mef"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.mos"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.mrw"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.nef"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.orf"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pbm"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pbr"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pcd"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pct"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pcx"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pef"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pgm"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pic"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pict"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pix"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.png"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ppm"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.psd"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.psp"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pspbrush"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pspimage"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.raf"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ras"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.raw"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.rgb"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.rgba"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.rle"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.rsb"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.sgi"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.sr2"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.srf"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.tga"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.THM\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.thm"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.tif"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.tiff"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ttc"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ttf"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v25po\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.v25po"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v25pp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.v25pp"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v25ppf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.v25ppf"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.wbm"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.wbmp"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.wmf"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.xbm"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.xif"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.xmp"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.xpm"

[HKEY_USERS\S-1-5-21-3160691577-3524135423-2623167788-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:63,dc,2c,1b,98,6f,01,10,93,b7,d8,0b,e0,2b,1d,c1,42,bf,f3,b4,96,5e,df,
   4e,f3,67,b9,90,63,cb,54,5f,7b,78,67,15,b5,fd,2d,10,2f,5e,52,f9,25,1e,d6,47,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2010-09-07  15:49:38
ComboFix-quarantined-files.txt  2010-09-07 13:49

Vor Suchlauf: 12 Verzeichnis(se), 43.300.532.224 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 43.288.559.616 Bytes frei

- - End Of File - - 39778B65AA180D566EDCE2377A7282C5

--- --- ---

cosinus · 07.09.2010, 15:12

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus.

Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen

Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen.
Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.

anemone · 08.09.2010, 14:57

Hallo,
hier das GMER log:

GMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15281 - GMER - Rootkit Detector and Remover
Rootkit scan 2010-09-07 18:01:18
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Ulla\AppData\Local\Temp\pwldapow.sys


---- System - GMER 1.0.15 ----

SSDT            97F211DC                                                                                                                            ZwCreateThread
SSDT            97F211C8                                                                                                                            ZwOpenProcess
SSDT            97F211CD                                                                                                                            ZwOpenThread
SSDT            97F211D7                                                                                                                            ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!KeSetEvent + 221                                                                                                       820C8984 4 Bytes  [DC, 11, F2, 97]
.text           ntkrnlpa.exe!KeSetEvent + 3F1                                                                                                       820C8B54 4 Bytes  [C8, 11, F2, 97] {ENTER 0xf211, 0x97}
.text           ntkrnlpa.exe!KeSetEvent + 40D                                                                                                       820C8B70 4 Bytes  [CD, 11, F2, 97]
.text           ntkrnlpa.exe!KeSetEvent + 621                                                                                                       820C8D84 4 Bytes  [D7, 11, F2, 97] {XLATB ; ADC EDX, ESI; XCHG EDI, EAX}
pnidata         C:\Windows\system32\drivers\SECDRV.SYS                                                                                              unknown last section [0xA42EDF00, 0x24000, 0x48000000]
?               C:\Users\Ulla\AppData\Local\Temp\catchme.sys                                                                                        Das System kann die angegebene Datei nicht finden. !
?               C:\Windows\system32\Drivers\PROCEXP113.SYS                                                                                          Das System kann die angegebene Datei nicht finden. !
?               C:\Users\Ulla\AppData\Local\Temp\mbr.sys                                                                                            Das System kann die angegebene Datei nicht finden. !

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdiplusShutdown]                                               [746E7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCloneImage]                                                [7473A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipDrawImageRectI]                                            [746EBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipSetInterpolationMode]                                      [746DF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdiplusStartup]                                                [746E75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCreateFromHDC]                                             [746DE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCreateBitmapFromStreamICM]                                 [74718395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCreateBitmapFromStream]                                    [746EDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipGetImageHeight]                                            [746DFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipGetImageWidth]                                             [746DFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipDisposeImage]                                              [746D71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipLoadImageFromFileICM]                                      [7476CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipLoadImageFromFile]                                         [7470C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipDeleteGraphics]                                            [746DD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipFree]                                                      [746D6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipAlloc]                                                     [746D687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\explorer.exe[2416] @ C:\Windows\explorer.exe [gdiplus.dll!GdipSetCompositingMode]                                        [746E2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\fastfat \Fat                                                                                                            fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                                    
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                                 C:\Users\Ulla\Desktop\Nikki\deamon\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                                 0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                              0xAB 0xF5 0x00 0x41 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                                           
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                                        0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                                     0x1A 0xBB 0x89 0x3A ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                                     
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                               0x6D 0x0C 0x99 0x91 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                                
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                                     C:\Users\Ulla\Desktop\Nikki\deamon\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                                     0
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                                  0xAB 0xF5 0x00 0x41 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)                       
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                                            0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                                         0x1A 0xBB 0x89 0x3A ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)                 
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                                   0x6D 0x0C 0x99 0x91 ...
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\EC365207C615FC046BC94A2E8ACFF841\Usage@Product  1025979362
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Media Center\Service\Scheduler@Heartbeat                                             0xC4 0x11 0xA8 0x46 ...
Reg             HKLM\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@c!s!\22!i!y!`!c!i!{!f!t!e!t!i!s!m!                               19583823

---- EOF - GMER 1.0.15 ----

--- --- ---

Jetzt das OSAM log:

OSAM Logfile:

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
Online Solutions. Complex Protection for Information Systems
Saved at 14:37:25 on 08.09.2010

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DDBACCPL.CPL" - "DataDesign AG" - C:\Windows\system32\DDBACCPL.CPL
"DDBACCTM.CPL" - "DataDesign AG" - C:\Windows\system32\DDBACCTM.CPL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\Ulla\AppData\Local\Temp\catchme.sys  (File not found)
"cpuz132" (cpuz132) - "Windows (R) Codename Longhorn DDK provider" - C:\Windows\system32\drivers\cpuz132_x32.sys
"dgderdrv" (dgderdrv) - "Devguru Co., Ltd" - C:\Windows\System32\drivers\dgderdrv.sys
"Dynamically loaded UxdDrv" (uxddrv) - ? - E:\PC Test\uxddrv.sys  (File not found)
"ENTECH" (ENTECH) - "EnTech Taiwan" - C:\Windows\system32\DRIVERS\ENTECH.sys
"FsUsbExDisk" (FsUsbExDisk) - ? - C:\Windows\system32\FsUsbExDisk.SYS  (File found, but it contains no detailed information)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"Lbd" (Lbd) - ? - C:\Windows\System32\DRIVERS\Lbd.sys  (File not found)
"Nokia USB Flashing Generic" (nmwcdnsuc) - ? - C:\Windows\System32\drivers\nmwcdnsuc.sys  (File not found)
"Nokia USB Flashing Phone Parent" (nmwcdnsu) - ? - C:\Windows\System32\drivers\nmwcdnsu.sys  (File not found)
"pwldapow" (pwldapow) - ? - C:\Users\Ulla\AppData\Local\Temp\pwldapow.sys  (Hidden registry entry, rootkit activity | File not found)
"SecDrv" (SecDrv) - "Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K." - C:\Windows\system32\drivers\SECDRV.SYS
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? -   (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office10\msohev.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{00020d75-0000-0000-c000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office10\MLSHEXT.DLL
{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll
{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"eBay - Der weltweite Online-Marktplatz" - ? - eBay: Neue und gebrauchte Elektronikartikel, Autos, Kleidung, Sammlerstücke, Sportartikel und mehr ? alles zu günstigen Preisen  (HTTP value)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Ask Toolbar" - "Ask.com" - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
<binary data> "{855F3B16-6D32-4FE6-8A56-BBB695989046}" - ? -   (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{9CB65206-89C4-402c-BA80-02D8C59F9B1D} "{9CB65206-89C4-402c-BA80-02D8C59F9B1D}" - "Ask.com" - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\Windows\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"eBay - Der weltweite Online-Marktplatz" - ? - eBay: Neue und gebrauchte Elektronikartikel, Autos, Kleidung, Sammlerstücke, Sportartikel und mehr ? alles zu günstigen Preisen  (HTTP value)
"PartyCasino" - ? - C:\Nickigames\PartyGaming\PartyCasino\RunApp.exe
"PartyPoker.com" - ? - C:\Nickigames\PartyGaming\PartyPoker\RunApp.exe
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{FE063DB9-4EC0-403e-8DD8-394C54984B2C} "Ask Toolbar" - "Ask.com" - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
<binary data> "MSN Toolbar" - "Microsoft Corp." - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{9CB65201-89C4-402c-BA80-02D8C59F9B1D} "Ask Search Assistant BHO" - "Ask.com" - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
{FE063DB1-4EC0-403e-8DD8-394C54984B2C} "Ask Toolbar BHO" - "Ask.com" - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{d2ce3e00-f94a-4740-988e-03dc2f38c34f} "MSN Toolbar Helper" - "Microsoft Corp." - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office10\OSA.EXE  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"EPSON V6 2KMonitor" - "SEIKO EPSON CORPORATION" - C:\Windows\system32\EBPMON24.DLL

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
"Device Error Recovery Service" (dgdersvc) - "Devguru Co., Ltd." - C:\Windows\system32\dgdersvc.exe
"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe
"FsUsbExService" (FsUsbExService) - "Teruten" - C:\Windows\system32\FsUsbExService.Exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"NBService" (NBService) - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
"PLFlash DeviceIoControl Service" (PLFlash DeviceIoControl Service) - ? - C:\Windows\system32\IoctlSvc.exe  (File not found)
"Sceneo PVR Service" (srvcPVR) - "Buhl Data Service GmbH" - C:\Program Files\Sceneo\Bonavista\Services\PVR\PVRService.exe
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files\Common Files\Steam\SteamService.exe
"TVEnhance Background Capture Service (TBCS)" (TVECapSvc) - ? - C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe
"TVEnhance Task Scheduler (TTS))" (TVESched) - ? - C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit Online Solutions :: Index

Vom bootkit remover hab ich einen screenshot gemacht und ihn auf euerm uploadchannel hochgeladen.

Gruß
Ulla

cosinus · 08.09.2010, 15:16

Screenshots bitte nicht in den Upchannel!

Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur eine Sekunde.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

anemone · 08.09.2010, 16:40

Ok, ich werds mir merken.
Hier das log des MBR Checks:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: MICRO-STAR INTERNATIONAL CO., LTD
BIOS Manufacturer: Phoenix Technologies, LTD
System Manufacturer: MEDIONPC
System Product Name: MS-7318
Logical Drives Mask: 0x000003bc

Kernel Drivers (total 157):
0x8203E000 \SystemRoot\system32\ntkrnlpa.exe
0x8200B000 \SystemRoot\system32\hal.dll
0x80402000 \SystemRoot\system32\kdcom.dll
0x80409000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80479000 \SystemRoot\system32\PSHED.dll
0x8048A000 \SystemRoot\system32\BOOTVID.dll
0x80492000 \SystemRoot\system32\CLFS.SYS
0x804D3000 \SystemRoot\system32\CI.dll
0x80606000 \SystemRoot\system32\drivers\Wdf01000.sys
0x80682000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8068F000 \SystemRoot\system32\drivers\acpi.sys
0x806D5000 \SystemRoot\system32\drivers\WMILIB.SYS
0x806DE000 \SystemRoot\system32\drivers\msisadrv.sys
0x806E6000 \SystemRoot\system32\drivers\pci.sys
0x8070D000 \SystemRoot\System32\drivers\partmgr.sys
0x8071C000 \SystemRoot\system32\drivers\volmgr.sys
0x8072B000 \SystemRoot\System32\drivers\volmgrx.sys
0x80775000 \SystemRoot\system32\DRIVERS\videX32.sys
0x8077D000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x8078B000 \SystemRoot\System32\drivers\mountmgr.sys
0x8079B000 \SystemRoot\system32\drivers\atapi.sys
0x807A3000 \SystemRoot\system32\drivers\ataport.SYS
0x807C1000 \SystemRoot\system32\drivers\fltmgr.sys
0x805B3000 \SystemRoot\system32\drivers\fileinfo.sys
0x807F3000 \SystemRoot\system32\DRIVERS\xfilt.sys
0x82604000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82675000 \SystemRoot\system32\drivers\ndis.sys
0x82780000 \SystemRoot\system32\drivers\msrpc.sys
0x827AB000 \SystemRoot\system32\drivers\NETIO.SYS
0x82C0B000 \SystemRoot\System32\drivers\tcpip.sys
0x82CF5000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x82E0D000 \SystemRoot\System32\Drivers\Ntfs.sys
0x82F1D000 \SystemRoot\system32\drivers\volsnap.sys
0x82F56000 \SystemRoot\system32\DRIVERS\uagp35.sys
0x82F67000 \SystemRoot\System32\Drivers\spldr.sys
0x82F6F000 \SystemRoot\System32\Drivers\mup.sys
0x82F7E000 \SystemRoot\System32\drivers\ecache.sys
0x82FA5000 \SystemRoot\system32\drivers\disk.sys
0x82FB6000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x82FD7000 \SystemRoot\system32\drivers\crcdisk.sys
0x82E00000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x82D10000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x82D19000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8C408000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x82D28000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8CB69000 \SystemRoot\System32\drivers\watchdog.sys
0x8BE09000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8BE96000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8BEAE000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8BEB1000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8BEBC000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8BEFA000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8BF09000 \SystemRoot\system32\DRIVERS\fetnd5.sys
0x8CC0B000 \SystemRoot\system32\DRIVERS\Ph3xIB32.sys
0x8CD20000 \SystemRoot\system32\DRIVERS\ks.sys
0x8CD4A000 \SystemRoot\system32\DRIVERS\BdaSup.SYS
0x8CD4D000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8CD5D000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8CD6B000 \SystemRoot\system32\DRIVERS\serial.sys
0x8CD85000 \SystemRoot\system32\DRIVERS\serenum.sys
0x8CD8F000 \SystemRoot\system32\DRIVERS\parport.sys
0x8CDA7000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8CDBA000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8CDC5000 \SystemRoot\System32\Drivers\x10hid.sys
0x8CDC7000 \SystemRoot\System32\Drivers\HIDCLASS.SYS
0x8CDD7000 \SystemRoot\System32\Drivers\HIDPARSE.SYS
0x8BF15000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8BF44000 \SystemRoot\system32\DRIVERS\storport.sys
0x8CDDE000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8CDE9000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8CC00000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8BF85000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8BFA8000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8BFB7000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8BFCB000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8BFE0000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8BFF0000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8BFFB000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8CB75000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8CB7F000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8CB8C000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8BE00000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8CBC1000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8D00D000 \SystemRoot\system32\drivers\HdAudio.sys
0x8D04C000 \SystemRoot\system32\drivers\portcls.sys
0x8D079000 \SystemRoot\system32\drivers\drmk.sys
0x8D20B000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8D39E000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8D3A7000 \SystemRoot\System32\Drivers\Null.SYS
0x8D3AE000 \SystemRoot\System32\Drivers\Beep.SYS
0x8D3B5000 \SystemRoot\System32\drivers\vga.sys
0x8D3C1000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8D3E2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8D3EA000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8D3F2000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8D09E000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8D200000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8D0AC000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8D0C2000 \SystemRoot\system32\DRIVERS\smb.sys
0x8D0D6000 \SystemRoot\system32\drivers\afd.sys
0x8D11E000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8D150000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8D166000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8D174000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8D187000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8D1C3000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8D1CD000 \SystemRoot\System32\Drivers\dfsc.sys
0x8D1E4000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8D209000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x8CBD2000 \SystemRoot\System32\Drivers\fastfat.SYS
0x8D000000 \SystemRoot\System32\Drivers\crashdmp.sys
0x82FE0000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x8C400000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x82FEB000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8D3FD000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x82FF4000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x95840000 \SystemRoot\System32\win32k.sys
0x82DC9000 \SystemRoot\System32\drivers\Dxapi.sys
0x82DD3000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x96601000 \SystemRoot\system32\DRIVERS\netr73.sys
0x96657000 \SystemRoot\System32\Drivers\x10ufx2.sys
0x96661000 \SystemRoot\system32\DRIVERS\monitor.sys
0x95A60000 \SystemRoot\System32\TSDDD.dll
0x95A80000 \SystemRoot\System32\cdd.dll
0x96670000 \SystemRoot\system32\drivers\luafv.sys
0x9668B000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x966A7000 \SystemRoot\system32\drivers\spsys.sys
0x96757000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x96767000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x96791000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9679B000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9A603000 \SystemRoot\system32\drivers\HTTP.sys
0x9A670000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9A68D000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9A6A6000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9A6BB000 \SystemRoot\system32\drivers\mrxdav.sys
0x9A6DC000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9A6FB000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9A734000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9A74C000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9A773000 \SystemRoot\System32\DRIVERS\srv.sys
0x9A7C1000 \SystemRoot\system32\DRIVERS\parvdm.sys
0xA2C05000 \SystemRoot\system32\drivers\peauth.sys
0xA2CE3000 \??\C:\Windows\system32\drivers\SECDRV.SYS
0xA2D0B000 \SystemRoot\System32\drivers\tcpipreg.sys
0xA2D17000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0xA2D2C000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0xA2D3E000 \SystemRoot\system32\drivers\MSPQM.sys
0xA2D40000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xA2D66000 \SystemRoot\system32\drivers\tdtcp.sys
0xA2D71000 \SystemRoot\System32\DRIVERS\tssecsrv.sys
0xA2D7D000 \SystemRoot\System32\Drivers\RDPWD.SYS
0xA2DB0000 \SystemRoot\System32\drivers\dgderdrv.sys
0xA2DB3000 \SystemRoot\system32\DRIVERS\cdfs.sys
0xA2DC9000 \??\C:\Windows\system32\FsUsbExDisk.SYS
0xA2DD2000 \??\C:\Users\Ulla\AppData\Local\Temp\pwldapow.sys
0x774C0000 \Windows\System32\ntdll.dll

Processes (total 72):
0 System Idle Process
4 SYSTEM
428 C:\Windows\System32\smss.exe
560 csrss.exe
616 C:\Windows\System32\wininit.exe
628 csrss.exe
660 C:\Windows\System32\services.exe
672 C:\Windows\System32\lsass.exe
684 C:\Windows\System32\lsm.exe
824 C:\Windows\System32\svchost.exe
856 C:\Windows\System32\winlogon.exe
944 C:\Windows\System32\svchost.exe
996 C:\Windows\System32\svchost.exe
1036 C:\Windows\System32\Ati2evxx.exe
1056 C:\Windows\System32\svchost.exe
1084 C:\Windows\System32\svchost.exe
1100 C:\Windows\System32\svchost.exe
1240 C:\Windows\System32\audiodg.exe
1260 C:\Windows\System32\svchost.exe
1276 C:\Windows\System32\SLsvc.exe
1304 C:\Windows\System32\svchost.exe
1488 C:\Windows\System32\svchost.exe
1516 C:\Windows\System32\Ati2evxx.exe
1804 C:\Windows\System32\spoolsv.exe
1848 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1872 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1892 C:\Windows\System32\svchost.exe
2008 C:\Windows\System32\taskeng.exe
2020 C:\Windows\System32\dwm.exe
316 C:\Windows\explorer.exe
1608 C:\Windows\System32\taskeng.exe
2196 C:\Program Files\Windows Defender\MSASCui.exe
2204 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
2232 C:\Windows\RtHDVCpl.exe
2240 C:\Program Files\Windows Sidebar\sidebar.exe
2264 C:\Windows\ehome\ehtray.exe
2276 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
2284 C:\Program Files\Windows Media Player\wmpnscfg.exe
2424 C:\Windows\ehome\ehmsas.exe
2664 C:\Program Files\Windows Sidebar\sidebar.exe
2892 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
2904 C:\Program Files\Bonjour\mDNSResponder.exe
2924 C:\Windows\System32\dgdersvc.exe
2968 C:\Windows\System32\FsUsbExService.Exe
3088 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
3184 C:\Windows\System32\svchost.exe
3204 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
3244 C:\Program Files\Sceneo\Bonavista\Services\PVR\pvrservice.exe
3308 C:\Windows\System32\svchost.exe
3380 C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe
3412 C:\Windows\System32\svchost.exe
3428 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
3468 C:\Windows\System32\SearchIndexer.exe
3504 C:\PROGRA~1\COMMON~1\X10\Common\X10nets.exe
3800 WUDFHost.exe
3912 C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe
4064 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
2648 C:\Windows\System32\mobsync.exe
2348 C:\Program Files\Windows Media Player\wmpnetwk.exe
2916 C:\Windows\ehome\ehsched.exe
3616 C:\Windows\System32\alg.exe
4280 C:\Windows\ehome\ehrecvr.exe
1752 C:\Windows\System32\conime.exe
5484 C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe
5576 C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
3972 C:\Windows\System32\SearchProtocolHost.exe
4884 C:\Windows\System32\SearchFilterHost.exe
3116 C:\Program Files\Internet Explorer\iexplore.exe
3984 C:\Program Files\Internet Explorer\iexplore.exe
3720 C:\Program Files\Internet Explorer\iexplore.exe
2316 C:\Windows\System32\SearchProtocolHost.exe
5256 C:\Users\Ulla\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000043`5a20c000 (FAT32)

PhysicalDrive0 Model Number: ST3320820AS, Rev: 3.AAC

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 2DCB3981C346223CC4D5ED002BE2284A9EB2A78B

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Gruß
Ulla

cosinus · 08.09.2010, 19:45

Zitat:

298 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 2DCB3981C346223CC4D5ED002BE2284A9EB2A78B

Der MBR ist unbekannt. Hast Du rein zufällig noch andere Betriebssysteme (Linux) parallel installiert?

Wenn nicht, also wenn Du nur Vista drauf hast bitte Folgendes beachten:

Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten). Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen.

anemone · 08.09.2010, 20:11

Hallo,
hab nur Vista installiert, also werd ich mich morgen an die CD machen und berichte dann.

Jetzt hab ich noch eine Frage. Meine Tochter kommt morgen Abend wieder heim. Sie hat ein notebook und geht über unseren router ins Internet. Sie hat mir berichtet, daß sie bis jetzt problemlos bei ihrem Freund auf ihrem notebook onlinebanking machen konnte.
Soll sie das jetzt zu Hause lassen bis unser Rechner wieder OK ist?
Und was schlagt ihr vor, mit welchem Programm, außer dem Virenschutz, soll sie ihr notebook checken?

Vielen Dank für eine Antwort.

Gruß
Ulla

cosinus · 08.09.2010, 20:20

Zitat:

Soll sie das jetzt zu Hause lassen bis unser Rechner wieder OK ist?

Nein, sie kann das problemlos auch bei Euch zu Hause machen. Onlinebanking ist immer verschlüsselt, ein evtl aktiver Schädling auf einem anderen PC hat da keine relle Chance den verschlüsselten Datenverkehr abzuhören oder gar zu manipulieren.
Anders sieht das aber aus, wenn ihr Rechner auch infiziert ist, wovon ich jetzt allerdings nicht ausgehe.

anemone · 09.09.2010, 10:13

Hallo Arne,

ich habe alles so gemacht, wie Du gestern Abend geschrieben hast.
Hat auch super geklappt. Jetzt bin ich mal gespannt, ob alles sauber ist.

Gruß
Ulla

cosinus · 09.09.2010, 13:10

Dann zur Überprüfung MBRCheck nochmal ausführen und das neue Log posten.

anemone · 09.09.2010, 14:54

Hallo,

Hier das log:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: MICRO-STAR INTERNATIONAL CO., LTD
BIOS Manufacturer: Phoenix Technologies, LTD
System Manufacturer: MEDIONPC
System Product Name: MS-7318
Logical Drives Mask: 0x000003bc

Kernel Drivers (total 156):
0x82004000 \SystemRoot\system32\ntkrnlpa.exe
0x823BD000 \SystemRoot\system32\hal.dll
0x80405000 \SystemRoot\system32\kdcom.dll
0x8040C000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8047C000 \SystemRoot\system32\PSHED.dll
0x8048D000 \SystemRoot\system32\BOOTVID.dll
0x80495000 \SystemRoot\system32\CLFS.SYS
0x804D6000 \SystemRoot\system32\CI.dll
0x80602000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8067E000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8068B000 \SystemRoot\system32\drivers\acpi.sys
0x806D1000 \SystemRoot\system32\drivers\WMILIB.SYS
0x806DA000 \SystemRoot\system32\drivers\msisadrv.sys
0x806E2000 \SystemRoot\system32\drivers\pci.sys
0x80709000 \SystemRoot\System32\drivers\partmgr.sys
0x80718000 \SystemRoot\system32\drivers\volmgr.sys
0x80727000 \SystemRoot\System32\drivers\volmgrx.sys
0x80771000 \SystemRoot\system32\DRIVERS\videX32.sys
0x80779000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x80787000 \SystemRoot\System32\drivers\mountmgr.sys
0x80797000 \SystemRoot\system32\drivers\atapi.sys
0x8079F000 \SystemRoot\system32\drivers\ataport.SYS
0x807BD000 \SystemRoot\system32\drivers\fltmgr.sys
0x807EF000 \SystemRoot\system32\drivers\fileinfo.sys
0x805B6000 \SystemRoot\system32\DRIVERS\xfilt.sys
0x8260F000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82680000 \SystemRoot\system32\drivers\ndis.sys
0x8278B000 \SystemRoot\system32\drivers\msrpc.sys
0x827B6000 \SystemRoot\system32\drivers\NETIO.SYS
0x82C04000 \SystemRoot\System32\drivers\tcpip.sys
0x82CEE000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x82E02000 \SystemRoot\System32\Drivers\Ntfs.sys
0x82F12000 \SystemRoot\system32\drivers\volsnap.sys
0x82F4B000 \SystemRoot\system32\DRIVERS\uagp35.sys
0x82F5C000 \SystemRoot\System32\Drivers\spldr.sys
0x82F64000 \SystemRoot\System32\Drivers\mup.sys
0x82F73000 \SystemRoot\System32\drivers\ecache.sys
0x82F9A000 \SystemRoot\system32\drivers\disk.sys
0x82FAB000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x82FCC000 \SystemRoot\system32\drivers\crcdisk.sys
0x82FF5000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x82D09000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x82D12000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8B40A000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x82D21000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8BB6B000 \SystemRoot\System32\drivers\watchdog.sys
0x8BC0D000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8BC9A000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8BCB2000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8BCB5000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8BCC0000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8BCFE000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8BD0D000 \SystemRoot\system32\DRIVERS\fetnd5.sys
0x8C00A000 \SystemRoot\system32\DRIVERS\Ph3xIB32.sys
0x8C11F000 \SystemRoot\system32\DRIVERS\ks.sys
0x8C149000 \SystemRoot\system32\DRIVERS\BdaSup.SYS
0x8C14C000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8C15C000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8C16A000 \SystemRoot\system32\DRIVERS\serial.sys
0x8C184000 \SystemRoot\system32\DRIVERS\serenum.sys
0x8C18E000 \SystemRoot\system32\DRIVERS\parport.sys
0x8C1A6000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8C1B9000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8C1C4000 \SystemRoot\System32\Drivers\x10hid.sys
0x8C1C6000 \SystemRoot\System32\Drivers\HIDCLASS.SYS
0x8C1D6000 \SystemRoot\System32\Drivers\HIDPARSE.SYS
0x8BD19000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8BD48000 \SystemRoot\system32\DRIVERS\storport.sys
0x8C1DD000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C1E8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8BD89000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8BD94000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8BDB7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8BDC6000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8BDDA000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8BDEF000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8BC00000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8C000000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8BB77000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8BB81000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8BB8E000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8BBC3000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8BBCC000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x805BF000 \SystemRoot\system32\drivers\HdAudio.sys
0x82DC2000 \SystemRoot\system32\drivers\portcls.sys
0x8C406000 \SystemRoot\system32\drivers\drmk.sys
0x8C42B000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8C5BE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8C5C7000 \SystemRoot\System32\Drivers\Null.SYS
0x8C5CE000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C5D5000 \SystemRoot\System32\drivers\vga.sys
0x8BBDD000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C5E1000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C5E9000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C5F1000 \SystemRoot\System32\Drivers\Msfs.SYS
0x82DEF000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8B400000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8C609000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8C61F000 \SystemRoot\system32\DRIVERS\smb.sys
0x8C633000 \SystemRoot\system32\drivers\afd.sys
0x8C67B000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8C6AD000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8C6C3000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8C6D1000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8C6E4000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8C720000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8C72A000 \SystemRoot\System32\Drivers\dfsc.sys
0x8C741000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8C75D000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x8C75F000 \SystemRoot\System32\Drivers\fastfat.SYS
0x8C787000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x8C79C000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8C79E000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8C7A7000 \SystemRoot\system32\DRIVERS\netr73.sys
0x82FD5000 \SystemRoot\System32\Drivers\x10ufx2.sys
0x8C600000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x82FDF000 \SystemRoot\System32\Drivers\crashdmp.sys
0x827F1000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x8C002000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x94AD0000 \SystemRoot\System32\win32k.sys
0x82600000 \SystemRoot\System32\drivers\Dxapi.sys
0x81200000 \SystemRoot\system32\DRIVERS\monitor.sys
0x94CF0000 \SystemRoot\System32\TSDDD.dll
0x94D10000 \SystemRoot\System32\cdd.dll
0x8120F000 \SystemRoot\system32\drivers\luafv.sys
0x8122A000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x81246000 \SystemRoot\system32\drivers\spsys.sys
0x812F6000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x81306000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x81330000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8133A000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x8134D000 \SystemRoot\system32\drivers\HTTP.sys
0x813BA000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x813D7000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9B40A000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9B41F000 \SystemRoot\system32\drivers\mrxdav.sys
0x9B440000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9B45F000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9B498000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9B4B0000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9B4D7000 \SystemRoot\System32\DRIVERS\srv.sys
0x9B525000 \SystemRoot\system32\DRIVERS\parvdm.sys
0xA2A09000 \SystemRoot\system32\drivers\peauth.sys
0xA2AE7000 \??\C:\Windows\system32\drivers\SECDRV.SYS
0xA2B0F000 \SystemRoot\System32\drivers\tcpipreg.sys
0xA2B1B000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0xA2B30000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0xA2B42000 \SystemRoot\system32\drivers\MSPQM.sys
0xA2B44000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xA2B6A000 \SystemRoot\system32\drivers\tdtcp.sys
0xA2B75000 \SystemRoot\System32\DRIVERS\tssecsrv.sys
0xA2B81000 \SystemRoot\System32\Drivers\RDPWD.SYS
0xA2BB4000 \SystemRoot\System32\drivers\dgderdrv.sys
0xA2BB7000 \??\C:\Windows\system32\FsUsbExDisk.SYS
0xA2BC0000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x77040000 \Windows\System32\ntdll.dll

Processes (total 71):
0 System Idle Process
4 SYSTEM
408 C:\Windows\System32\smss.exe
480 csrss.exe
536 C:\Windows\System32\wininit.exe
548 csrss.exe
580 C:\Windows\System32\services.exe
596 C:\Windows\System32\lsass.exe
608 C:\Windows\System32\lsm.exe
652 C:\Windows\System32\winlogon.exe
780 C:\Windows\System32\svchost.exe
868 C:\Windows\System32\svchost.exe
904 C:\Windows\System32\svchost.exe
1012 C:\Windows\System32\Ati2evxx.exe
1056 C:\Windows\System32\svchost.exe
1108 C:\Windows\System32\svchost.exe
1140 C:\Windows\System32\svchost.exe
1208 C:\Windows\System32\audiodg.exe
1232 C:\Windows\System32\svchost.exe
1252 C:\Windows\System32\SLsvc.exe
1300 C:\Windows\System32\svchost.exe
1464 C:\Windows\System32\Ati2evxx.exe
1508 C:\Windows\System32\svchost.exe
1740 C:\Windows\System32\dwm.exe
1776 C:\Windows\explorer.exe
1960 C:\Windows\System32\spoolsv.exe
1980 C:\Windows\System32\taskeng.exe
1992 C:\Program Files\Avira\AntiVir Desktop\sched.exe
2004 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
2016 C:\Windows\System32\svchost.exe
12 C:\Program Files\Windows Defender\MSASCui.exe
468 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
532 C:\Windows\RtHDVCpl.exe
572 C:\Program Files\Windows Sidebar\sidebar.exe
936 C:\Windows\System32\taskeng.exe
2116 C:\Windows\ehome\ehtray.exe
2136 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
2156 C:\Program Files\Windows Media Player\wmpnscfg.exe
2484 C:\Program Files\Windows Sidebar\sidebar.exe
2588 C:\Windows\ehome\ehmsas.exe
2892 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
2904 C:\Program Files\Bonjour\mDNSResponder.exe
2940 C:\Windows\System32\dgdersvc.exe
2980 C:\Windows\System32\FsUsbExService.Exe
3100 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
3156 C:\Windows\System32\svchost.exe
3184 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
3216 C:\Program Files\Sceneo\Bonavista\Services\PVR\pvrservice.exe
3320 C:\Windows\System32\svchost.exe
3368 C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe
3412 C:\Windows\System32\svchost.exe
3432 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
3504 C:\Windows\System32\SearchIndexer.exe
3540 C:\PROGRA~1\COMMON~1\X10\Common\X10nets.exe
3788 WUDFHost.exe
3896 C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe
2080 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
2440 C:\Program Files\Windows Media Player\wmpnetwk.exe
436 C:\Windows\System32\mobsync.exe
740 C:\Windows\ehome\ehsched.exe
700 C:\Windows\System32\alg.exe
4288 C:\Windows\ehome\ehrecvr.exe
576 C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
6128 C:\Program Files\Internet Explorer\iexplore.exe
4940 C:\Program Files\Internet Explorer\iexplore.exe
2960 C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe
4168 C:\Program Files\Internet Explorer\iexplore.exe
5264 C:\Windows\System32\conime.exe
2464 C:\Windows\System32\SearchProtocolHost.exe
2460 C:\Windows\System32\SearchFilterHost.exe
3384 C:\Users\Ulla\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000043`5a20c000 (FAT32)

PhysicalDrive0 Model Number: ST3320820AS, Rev: 3.AAC

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979

Done!

Gruß
Ulla

cosinus · 09.09.2010, 17:46

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

anemone · 10.09.2010, 14:24

Hallo,
Hier die beiden Protokolle.
Hat das aber lang gedauert. Ich bin jetzt so was von motiviert den Rechner aufzuräumen!

Malwarebytes:

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Datenbank Version: 4586

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

10.09.2010 08:53:00
mbam-log-2010-09-10 (08-53-00).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 139842
Laufzeit: 7 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Und jetzt Superantispyware:

SUPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generated 09/10/2010 at 01:51 PM

Application Version : 4.42.1000

Core Rules Database Version : 5483
Trace Rules Database Version: 3295

Scan type : Complete Scan
Total Scan Time : 04:36:09

Memory items scanned : 809
Memory threats detected : 0
Registry items scanned : 10949
Registry threats detected : 0
File items scanned : 394939
File threats detected : 62

Adware.Tracking Cookie
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@im.banner.t-online[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@tribalfusion[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@ad.ad-srv[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@traffictrack[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@questionmarket[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@www.etracker[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@ads.quartermedia[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@ad.yieldmanager[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@stat.blogorama[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@e-2dj6wnkiamd5igp.stats.esomniture[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@e-2dj6wmlouhdzakp.stats.esomniture[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@tracking.quisma[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@ad.adserver01[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@advertising[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@e-2dj6wdmiqkd5ico.stats.esomniture[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@e-2dj6wbkiwgcpccp.stats.esomniture[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@atdmt[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@ad.zanox[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@ad3.adfarm1.adition[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@content.yieldmanager[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@zanox-affiliate[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@adtech[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@tacoda[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@de.sitestat[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@fastclick[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@zanox[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@himedia.individuad[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@mediaplex[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@de.sitestat[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@doubleclick[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@e-2dj6wdk4cjazgeo.stats.esomniture[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@invitemedia[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@apmebf[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@guj.122.2o7[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@bs.serving-sys[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@content.yieldmanager[3].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@ad2.adfarm1.adition[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@eas.apm.emediate[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@tradedoubler[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@revsci[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@e-2dj6wmmysgcjebo.stats.esomniture[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@adfarm1.adition[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@e-2dj6wnkiohajikp.stats.esomniture[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@www.googleadservices[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@tracking.mindshare[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@rotator.adjuggler[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@tracking.mlsat02[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@webmasterplan[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@www.traffictrack[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@e-2dj6wfl4kidzsfp.stats.esomniture[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@www.zanox-affiliate[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@ads.sportwerk[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@imrworldwide[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@e-2dj6wnkoekc5slq.stats.esomniture[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@ad.adnet[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@collective-media[2].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@3pagen.112.2o7[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@ads.eteleon[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@serving-sys[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@ads2.vrm[1].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@de.sitestat[3].txt
C:\Users\Ulla\AppData\Roaming\Microsoft\Windows\Cookies\ulla@track.adform[2].txt

Gruß
Ulla

09.09.2010, 13:10	#27
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	20Tans onlinebanking Abfrage (Mainzer Volksbank), Trojaner los werden!!! Dann zur Überprüfung MBRCheck nochmal ausführen und das neue Log posten. __________________ Logfiles bitte immer in CODE-Tags posten

09.09.2010, 17:46	#29
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	20Tans onlinebanking Abfrage (Mainzer Volksbank), Trojaner los werden!!! Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! __________________ Logfiles bitte immer in CODE-Tags posten

20Tans onlinebanking Abfrage (Mainzer Volksbank), Trojaner los werden!!!

Plagegeister aller Art und deren Bekämpfung: 20Tans onlinebanking Abfrage (Mainzer Volksbank), Trojaner los werden!!!