Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows blockiert - 50€ Trojaner (https://www.trojaner-board.de/107742-windows-blockiert-50-trojaner.html)

Sunshine_Mel 07.01.2012 21:04
Windows blockiert - 50€ Trojaner
 
Hallöchen Zusammen,

auf der Suche nach der Lösung meines Problems, bin ich auf dieses klasse Forum gestoßen.

Auf dem Laptop einer Freundin ist der besagte: "50€-Trojaner". Dieser blockiert Windows. Man wird aufgefordert ein Upgrade für 50€ zu kaufen, um Windows weiter benutzen zu können.

Ich habe mich bereits um gesehen... Ich habe dazu vor ab eine Frage:

Im abgesicherten Modus mit Netzwerktreibern erkennt das System meinen Webstick nicht als Modem. Damit geh ich aber ins Internet und komme somit NICHT ins Internet. Ich kann mir die genannten Programme nicht runterladen und auf´m Desktop speichern.
Als Möglichkeit sehe ich die Programme durch einen Stick auf dem infizierten PC zu speichern bzw sie direkt vom Stick zu starten. Ginge das auch? Ich habe die Scanns noch nicht durchgeführt.

Vielen Dank vorab!

Gruß aus Berlin

cosinus 09.01.2012 11:57
Zitat:
Als Möglichkeit sehe ich die Programme durch einen Stick auf dem infizierten PC zu speichern bzw sie direkt vom Stick zu starten. Ginge das auch?
Notfalls ja. Ansonsten mit diesem Rechner anders ins Internet gehen (per Kabel oder WLAN mit einem Router bei einem Bekannen?)

Sunshine_Mel 10.01.2012 21:29
Danke für die Antwort.

Ich konnte mit dem infiniziertem Rechner ins Internet.
Jetzt erstellt mir OTL die "Extra"-Datei nicht mehr. Hatte es ja schon mal durchlaufen lassen. Da wurden zwei Datein erstellt, jetzt leider nur noch das Scanergebnis. Mach ich was falsch oder wo könnte das Problem liegen?

cosinus 10.01.2012 21:48
Die alte extras.txt genügt auch. Zur Not auch nur die OTL.txt

Sunshine_Mel 11.01.2012 17:56
Zitat:
Zitat von cosinus (Beitrag 752358)
Die alte extras.txt genügt auch. Zur Not auch nur die OTL.txt
Hi Arne,

ick Nase hatte die genannten Programme zwar runtergeladen, aber im normalen Modus nicht im abgesicherten mit Netzwerktreibern.
Im abgesichertem Modus waren die Programme nicht mehr auf´m Desktop. Daher hab ich alles vom Stick geladen.
Anbei die Datein, jedoch wie schon erwähnt ohne die '"Extra"-Datein von OTL, eine alte hab ich leider auch nicht mehr :-/

Ich scheine mich ziemlich glatt an zu stellen ... mit 7-Zip hat auch nicht so richtig gefunzt. Hoffe .rar-Datei ist auch ok.!?

:dankeschoen: im Voraus

cosinus 11.01.2012 18:36
Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Sunshine_Mel 11.01.2012 23:15
Nabend,

ich hab mal alles durch gearbeitet. Hoffe ich hab alles richtig gemacht. Zur Not hab ich die Anhängseln ran gemacht ...

:dankeschoen: vor ab

Code:
Datenbank Version: v2012.01.11.06

Windows Vista Service Pack 2 x86 FAT
Internet Explorer 9.0.8112.16421
Jenny :: JENNY-PC [Administrator]

Schutz: Aktiviert

11.01.2012 19:04:00
mbam-log-2012-01-11 (20-16-27).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 336920
Laufzeit: 1 Stunde(n), 9 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|iexploer.exe (Trojan.Agent) -> Daten: C:\Users\Jenny\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
Datenbank Version: v2012.01.11.06

Windows Vista Service Pack 2 x86 FAT
Internet Explorer 9.0.8112.16421
Jenny :: JENNY-PC [Administrator]

Schutz: Aktiviert

11.01.2012 19:04:00
mbam-log-2012-01-11 (19-04-00).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 336920
Laufzeit: 1 Stunde(n), 9 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|iexploer.exe (Trojan.Agent) -> Daten: C:\Users\Jenny\AppData\Roaming\Microsoft\Internet Explorer\iexploer.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
ESET

Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=d9ef1d72dcfe674f9e1aeb0196b23913
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-11 08:58:57
# local_time=2012-01-11 09:58:57 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1797 16775165 100 100 26711 101825879 79961 0
# compatibility_mode=5892 16776573 100 100 4409 163843300 0 0
# compatibility_mode=8192 67108863 100 0 3918 3918 0 0
# scanned=144022
# found=2
# cleaned=0
# scan_time=4965
C:\Users\Jenny\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\eBay.lnk        Win32/Adware.ADON Anwendung (Säubern nicht möglich)        00000000000000000000000000000000        I
C:\Users\Jenny\AppData\Roaming\Microsoft\Windows\Start Menu\eBay.lnk        Win32/Adware.ADON Anwendung (Säubern nicht möglich)        00000000000000000000000000000000        I

cosinus 12.01.2012 18:56
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Sunshine_Mel 12.01.2012 21:11
Nabend Arne,

hier die OTL.txt

Code:
OTL logfile created on: 12.01.2012 20:48:45 - Run 10
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Administrator\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,95 Gb Available Physical Memory | 65,07% Memory free
6,19 Gb Paging File | 4,92 Gb Available in Paging File | 79,49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 84,70 Gb Free Space | 56,83% Space Free | Partition Type: NTFS
Drive D: | 139,28 Gb Total Space | 139,16 Gb Free Space | 99,92% Space Free | Partition Type: NTFS
Drive F: | 978,73 Mb Total Space | 965,89 Mb Free Space | 98,69% Space Free | Partition Type: FAT
 
Computer Name: JENNY-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.10 19:22:03 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
PRC - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2009.07.21 13:34:28 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.05.13 15:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.07.10 02:09:26 | 000,191,032 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe
PRC - [2008.06.18 07:10:24 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
PRC - [2008.06.04 02:29:08 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe
PRC - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
PRC - [2008.02.02 00:17:26 | 000,233,472 | ---- | M] (ATK0100) -- C:\Program Files\ATK Hotkey\Hcontrol.exe
PRC - [2008.01.23 19:51:28 | 000,151,552 | ---- | M] () -- C:\Program Files\ATK Hotkey\WDC.exe
PRC - [2008.01.21 03:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2007.12.04 19:57:06 | 002,486,272 | ---- | M] () -- C:\Program Files\ATK Hotkey\ATKOSD.exe
PRC - [2007.11.05 04:48:06 | 000,106,496 | ---- | M] () -- C:\Program Files\ATK Hotkey\MsgTranAgt.exe
PRC - [2007.10.03 06:53:00 | 000,094,208 | ---- | M] () -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe
PRC - [2007.09.18 01:05:08 | 000,040,960 | ---- | M] ( ) -- C:\Program Files\ASUS\ATK Media\GPSWATCH.EXE
PRC - [2007.08.15 20:20:16 | 000,106,496 | ---- | M] () -- C:\Program Files\ATK Hotkey\KBFiltr.exe
PRC - [2007.08.08 09:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe
PRC - [2007.08.03 21:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
PRC - [2007.05.24 06:06:56 | 000,061,440 | ---- | M] (ASUSTeK Computer INC.) -- C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
PRC - [2005.07.07 00:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.10.23 17:01:58 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2009.07.21 13:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.05.13 15:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2007.10.03 06:53:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2007.08.08 09:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2007.08.03 21:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2009.12.07 18:24:11 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.06.22 19:38:22 | 000,102,912 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009.06.22 19:26:04 | 000,100,736 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV - [2009.05.11 09:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.03.30 09:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.07.25 09:30:59 | 007,547,552 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.07.22 03:21:07 | 000,015,872 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008.07.08 11:32:51 | 001,050,656 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008.06.25 06:05:05 | 000,044,064 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2008.06.03 07:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2008.04.07 07:00:45 | 000,006,656 | ---- | M] (Generic) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CRFILTER.sys -- (CRFILTER)
DRV - [2008.04.06 03:56:08 | 000,908,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.04.01 08:13:57 | 001,807,744 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.03.21 05:12:59 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2007.08.03 05:26:21 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)
DRV - [2007.07.24 20:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)
DRV - [2006.12.14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://alice.aol.de
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://alice.aol.de
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
 
[2012.01.06 15:06:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2011.10.14 21:10:45 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{519FCBD7-0111-42B0-836E-4CC3EE2C5515}: DhcpNameServer = 192.168.2.1 213.191.92.86 62.109.123.7
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{75546297-CFB9-400E-AA66-A02D5961D71A}: DhcpNameServer = 192.168.2.1 213.191.74.18 62.109.123.196
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) -C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\Shell - "" = AutoRun
O33 - MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: ASUS Camera ScreenSaver - hkey= - key= - C:\Windows\AsScrProlog.exe ()
MsConfig - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)
MsConfig - StartUpReg: ATKOSD2 - hkey= - key= - C:\Program Files\ATKOSD2\ATKOSD2.exe ()
MsConfig - StartUpReg: avgnt - hkey= - key= - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
MsConfig - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MsConfig - StartUpReg: ehTray.exe - hkey= - key= - C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
MsConfig - StartUpReg: EPSON Stylus SX200 Series - hkey= - key= -  File not found
MsConfig - StartUpReg: Google Desktop Search - hkey= - key= - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
MsConfig - StartUpReg: HControlUser - hkey= - key= - C:\Program Files\ATK Hotkey\HcontrolUser.exe ()
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: LightScribe Control Panel - hkey= - key= - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig - StartUpReg: NSSInstallation - hkey= - key= - C:\Program Files\DivX\Symantec\scstubinstaller.exe (Symantec Corporation)
MsConfig - StartUpReg: NvCplDaemon - hkey= - key= -  File not found
MsConfig - StartUpReg: NvMediaCenter - hkey= - key= -  File not found
MsConfig - StartUpReg: P2Go_Menu - hkey= - key= - C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: RtHDVCpl - hkey= - key= - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
MsConfig - StartUpReg: Sidebar - hkey= - key= - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
MsConfig - StartUpReg: Skytel - hkey= - key= - C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: swg - hkey= - key= -  File not found
MsConfig - StartUpReg: SynTPStart - hkey= - key= - C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
MsConfig - StartUpReg: WindowsWelcomeCenter - hkey= - key= -  File not found
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: wave2 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.11 21:15:08 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Apple
[2012.01.11 20:45:30 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Documents\ASUS
[2012.01.11 20:45:17 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\ASUS
[2012.01.11 20:30:54 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.01.10 19:21:57 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2012.01.10 17:55:38 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Macromedia
[2012.01.10 17:55:27 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Adobe
[2012.01.10 17:52:13 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes
[2012.01.09 21:40:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.01.09 21:40:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.01.09 21:40:57 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.01.09 21:40:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.01.09 21:15:57 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Apple Computer
[2012.01.09 21:14:26 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.01.09 21:14:26 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Searches
[2012.01.09 21:14:26 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.01.09 21:14:07 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Identities
[2012.01.09 21:14:05 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Contacts
[2012.01.09 21:12:36 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\Verlauf
[2012.01.09 21:12:36 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\Temporary Internet Files
[2012.01.09 21:12:36 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Lokale Einstellungen
[2012.01.09 21:12:36 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\Anwendungsdaten
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Vorlagen
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Startmenü
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\SendTo
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Recent
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Netzwerkumgebung
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\Eigene Videos
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\Eigene Musik
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Eigene Dateien
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Documents\Eigene Bilder
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Druckumgebung
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Cookies
[2012.01.09 21:12:35 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\Anwendungsdaten
[2012.01.09 21:12:34 | 000,000,000 | --SD | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft
[2012.01.09 21:12:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Videos
[2012.01.09 21:12:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Saved Games
[2012.01.09 21:12:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Pictures
[2012.01.09 21:12:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Music
[2012.01.09 21:12:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.01.09 21:12:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Links
[2012.01.09 21:12:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Favorites
[2012.01.09 21:12:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Downloads
[2012.01.09 21:12:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Documents
[2012.01.09 21:12:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\Desktop
[2012.01.09 21:12:34 | 000,000,000 | R--D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.01.09 21:12:34 | 000,000,000 | -H-D | C] -- C:\Users\Administrator\AppData
[2012.01.09 21:12:34 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Temp
[2012.01.09 21:12:34 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Microsoft Help
[2012.01.09 21:12:34 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Microsoft
[2012.01.09 21:12:34 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Media Center Programs
[2012.01.09 21:12:34 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
[2012.01.07 20:37:27 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.01.06 14:11:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Partner
[2012.01.06 14:11:34 | 000,112,128 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbnet.sys
[2012.01.06 14:11:34 | 000,102,912 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbmdm.sys
[2012.01.06 14:11:34 | 000,100,736 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbdev.sys
[2012.01.06 14:11:34 | 000,023,424 | ---- | C] (Huawei Tech. Co., Ltd.) -- C:\Windows\System32\drivers\ewdcsc.sys
[2012.01.06 14:11:09 | 000,000,000 | ---D | C] -- C:\Program Files\Mobile Partner
[2008.06.03 07:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.12 20:37:22 | 000,084,229 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.01.12 20:37:22 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2012.01.12 20:37:14 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.01.12 20:37:14 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.01.12 20:37:14 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.12 20:37:13 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.01.12 20:31:15 | 000,005,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.12 20:31:15 | 000,005,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.12 20:31:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.12 20:30:36 | 3220,353,024 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.11 23:29:54 | 278,969,814 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.01.11 14:20:58 | 000,000,680 | ---- | M] () -- C:\Users\Administrator\AppData\Local\d3d9caps.dat
[2012.01.10 21:30:23 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2012.01.10 19:24:06 | 000,000,000 | ---- | M] () -- C:\Users\Administrator\defogger_reenable
[2012.01.10 19:22:27 | 000,302,592 | ---- | M] () -- C:\Users\Administrator\Desktop\gmer.exe
[2012.01.10 19:22:03 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2012.01.10 19:21:43 | 000,050,477 | ---- | M] () -- C:\Users\Administrator\Desktop\Defogger.exe
[2012.01.10 19:16:16 | 000,084,229 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.01.09 21:40:59 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.06 19:06:50 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012.01.06 19:06:50 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2012.01.06 14:11:38 | 000,000,883 | ---- | M] () -- C:\Users\Public\Desktop\Mobile Partner.lnk
[2011.12.16 13:25:04 | 000,371,416 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.01.11 20:22:05 | 3220,353,024 | -HS- | C] () -- C:\hiberfil.sys
[2012.01.11 14:20:57 | 000,000,680 | ---- | C] () -- C:\Users\Administrator\AppData\Local\d3d9caps.dat
[2012.01.10 21:30:23 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012.01.10 19:24:06 | 000,000,000 | ---- | C] () -- C:\Users\Administrator\defogger_reenable
[2012.01.10 19:22:26 | 000,302,592 | ---- | C] () -- C:\Users\Administrator\Desktop\gmer.exe
[2012.01.10 19:21:43 | 000,050,477 | ---- | C] () -- C:\Users\Administrator\Desktop\Defogger.exe
[2012.01.09 21:40:59 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.09 21:14:34 | 000,000,956 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.01.09 21:14:25 | 000,000,951 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012.01.09 21:14:04 | 000,000,922 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2012.01.07 20:37:22 | 278,969,814 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.01.06 19:06:50 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2012.01.06 19:06:50 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2012.01.06 14:11:38 | 000,000,883 | ---- | C] () -- C:\Users\Public\Desktop\Mobile Partner.lnk
[2011.05.19 21:39:02 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.02.06 00:51:53 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2009.10.24 15:21:08 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat
[2009.10.24 15:21:08 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat
[2009.10.24 15:21:08 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat
[2009.10.24 15:21:08 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat
[2009.10.24 15:21:08 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat
[2009.10.24 15:21:08 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat
[2009.10.24 15:21:08 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat
[2009.10.24 15:21:08 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat
[2009.10.24 15:21:08 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat
[2009.10.24 15:21:08 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat
[2009.10.24 15:21:08 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2009.10.24 15:21:07 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat
[2009.10.24 15:21:07 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat
[2009.10.24 15:21:07 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat
[2009.10.24 15:21:07 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat
[2009.10.24 15:21:07 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat
[2009.10.24 15:21:07 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat
[2009.10.24 15:21:07 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat
[2009.10.24 15:21:07 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat
[2009.10.24 15:15:31 | 000,000,025 | ---- | C] () -- C:\Windows\CDE SX200DEFGIPS.ini
[2009.08.22 16:03:48 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.22 16:03:48 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.07.23 00:21:22 | 000,084,229 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.07.23 00:16:28 | 000,084,229 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2008.11.11 00:58:11 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe
[2008.11.11 00:53:57 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe
[2008.11.11 00:39:22 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2008.11.10 23:39:50 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.04.16 12:11:34 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.04.16 12:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.04.16 12:11:34 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.04.16 12:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2008.04.16 11:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini
[2008.04.07 07:00:45 | 000,005,120 | ---- | C] () -- C:\Windows\System32\CRFILTER.dll
[2008.04.01 08:13:57 | 001,807,744 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2007.05.09 08:16:39 | 000,028,160 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,371,416 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.03.09 03:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
 
========== LOP Check ==========
 
[2011.02.08 00:22:56 | 000,000,364 | ---- | M] () -- C:\Windows\Tasks\Install_NSS.job
[2012.01.11 23:42:19 | 000,032,588 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.01.10 17:55:27 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Adobe
[2012.01.09 21:15:57 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Apple Computer
[2012.01.09 21:14:07 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Identities
[2012.01.10 17:55:38 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Macromedia
[2012.01.10 17:52:13 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes
[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Media Center Programs
[2012.01.11 14:22:18 | 000,000,000 | --SD | M] -- C:\Users\Administrator\AppData\Roaming\Microsoft
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
:dankeschoen: im Voraus

cosinus 12.01.2012 21:25
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\Shell - "" = AutoRun
O33 - MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\Shell\AutoRun\command - "" = G:\AutoRun.exe
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Sunshine_Mel 12.01.2012 21:57
Zitat:
Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
Getan, wie gesagt.

Code:
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\ not found.
File G:\AutoRun.exe :Commands not found.
File ptytemp] not found.
File sethosts] not found.
 
OTL by OldTimer - Version 3.2.31.0 log created on 01122012_214921

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
Das mit dem Script auf der Partition war nur ein Hinweis, oder?

:dankeschoen:

cosinus 12.01.2012 22:17
Zitat:
Das mit dem Script auf der Partition war nur ein Hinweis, oder?
Nein viele fragen was das für ein Ordner _OTL auf C: ist und wo die Dateien landen, die ich mit OTL "lösche"
Damit ist eigentlich beides beantwortet wenn ich vorher schon poste Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Sunshine_Mel 12.01.2012 22:26
TDSS-Killer hab ich bereits gefunden

Sunshine_Mel 12.01.2012 23:08
Zitat:
Zitat:
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-a...entfernen.html
Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet
Ich kann im Tool nichts einstellen.
Change Parameters ist nicht da zum auswählen von additional options.
Ich kann nichts auswählen ausser Scan, Report und Close.
Objects to scan ist vorhanden wie auf deinem Screen.
Soll ich den Scan trotzdem durchführen?

Beim öffnen vom Internet kam auch immer noch der "komische Browser" und nicht meine Startseite. Habe den Download daher wieder auf Stick gezogen von meinem Rechner.
Ich hab es jetzt nochmal wo anders runtergeladen, da funktioniert es einwandfrei und es sieht so aus wie bei Dir.

cosinus 12.01.2012 23:28
Zitat:
wo anders runtergeladen,
Ich hoffe NICHT bei softonic :balla: :stirn:
Die Downloadlinks sind alle sauber in der Anleitung zu sehen

Sunshine_Mel 12.01.2012 23:35
Zitat:
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-a...entfernen.html

Ich kann auf dieser Seite nichts posten. Daher unten als CODE.

Zitat:
Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!
Es kam kein Fund/Meldung.

Zitat:
Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Klappt alles einwandfrei.

TDSS-LOG

Code:
23:11:20.0326 5740        TDSS rootkit removing tool 2.7.0.0 Jan 10 2012 09:14:26
23:11:20.0404 5740        ============================================================
23:11:20.0404 5740        Current date / time: 2012/01/12 23:11:20.0404
23:11:20.0404 5740        SystemInfo:
23:11:20.0404 5740       
23:11:20.0404 5740        OS Version: 6.0.6002 ServicePack: 2.0
23:11:20.0404 5740        Product type: Workstation
23:11:20.0404 5740        ComputerName: JENNY-PC
23:11:20.0404 5740        UserName: Jenny
23:11:20.0404 5740        Windows directory: C:\Windows
23:11:20.0404 5740        System windows directory: C:\Windows
23:11:20.0404 5740        Processor architecture: Intel x86
23:11:20.0404 5740        Number of processors: 2
23:11:20.0404 5740        Page size: 0x1000
23:11:20.0404 5740        Boot type: Normal boot
23:11:20.0404 5740        ============================================================
23:11:21.0652 5740        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000, SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000050
23:11:21.0668 5740        Drive \Device\Harddisk1\DR4 - Size: 0x3D2FFE00, SectorSize: 0x200, Cylinders: 0x7C, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
23:11:21.0871 5740        Initialize success
23:11:39.0343 5856        ============================================================
23:11:39.0343 5856        Scan started
23:11:39.0343 5856        Mode: Manual; SigCheck; TDLFS;
23:11:39.0343 5856        ============================================================
23:11:39.0936 5856        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
23:11:40.0154 5856        ACPI - ok
23:11:40.0201 5856        adp94xx        (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
23:11:40.0232 5856        adp94xx - ok
23:11:40.0263 5856        adpahci        (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
23:11:40.0294 5856        adpahci - ok
23:11:40.0326 5856        adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
23:11:40.0357 5856        adpu160m - ok
23:11:40.0388 5856        adpu320        (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
23:11:40.0404 5856        adpu320 - ok
23:11:40.0528 5856        AFD            (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
23:11:40.0606 5856        AFD - ok
23:11:40.0950 5856        AgereSoftModem  (1cfeba39fc613e45b49d3eddfbcda289) C:\Windows\system32\DRIVERS\AGRSM.sys
23:11:41.0090 5856        AgereSoftModem - ok
23:11:41.0293 5856        agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
23:11:41.0324 5856        agp440 - ok
23:11:41.0386 5856        aic78xx        (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
23:11:41.0402 5856        aic78xx - ok
23:11:41.0449 5856        aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
23:11:41.0480 5856        aliide - ok
23:11:41.0542 5856        amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
23:11:41.0558 5856        amdagp - ok
23:11:41.0589 5856        amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
23:11:41.0605 5856        amdide - ok
23:11:41.0636 5856        AmdK7          (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
23:11:41.0792 5856        AmdK7 - ok
23:11:41.0870 5856        AmdK8          (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
23:11:41.0932 5856        AmdK8 - ok
23:11:42.0073 5856        arc            (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
23:11:42.0088 5856        arc - ok
23:11:42.0120 5856        arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
23:11:42.0151 5856        arcsas - ok
23:11:42.0213 5856        ASMMAP          (7b4d08d2017ac06689d422e06c43f0aa) C:\Program Files\ATKGFNEX\ASMMAP.sys
23:11:42.0338 5856        ASMMAP - ok
23:11:42.0432 5856        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
23:11:42.0494 5856        AsyncMac - ok
23:11:42.0541 5856        atapi          (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
23:11:42.0556 5856        atapi - ok
23:11:42.0634 5856        athr            (4df523f49694b2884f8e5d870bf3e253) C:\Windows\system32\DRIVERS\athr.sys
23:11:42.0712 5856        athr - ok
23:11:42.0822 5856        avgio          (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
23:11:42.0837 5856        avgio - ok
23:11:42.0915 5856        avgntflt        (14fe36d8f2c6a2435275338d061a0b66) C:\Windows\system32\DRIVERS\avgntflt.sys
23:11:42.0962 5856        avgntflt - ok
23:11:42.0993 5856        avipbb          (6d52060b59e7d79cd2a044b6add1f1ef) C:\Windows\system32\DRIVERS\avipbb.sys
23:11:43.0009 5856        avipbb - ok
23:11:43.0102 5856        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
23:11:43.0165 5856        Beep - ok
23:11:43.0212 5856        blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
23:11:43.0258 5856        blbdrive - ok
23:11:43.0321 5856        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
23:11:43.0383 5856        bowser - ok
23:11:43.0430 5856        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
23:11:43.0539 5856        BrFiltLo - ok
23:11:43.0633 5856        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
23:11:43.0680 5856        BrFiltUp - ok
23:11:43.0726 5856        Brserid        (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
23:11:43.0898 5856        Brserid - ok
23:11:43.0976 5856        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
23:11:44.0085 5856        BrSerWdm - ok
23:11:44.0116 5856        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
23:11:44.0210 5856        BrUsbMdm - ok
23:11:44.0226 5856        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
23:11:44.0304 5856        BrUsbSer - ok
23:11:44.0350 5856        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
23:11:44.0428 5856        BTHMODEM - ok
23:11:44.0522 5856        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
23:11:44.0569 5856        cdfs - ok
23:11:44.0616 5856        cdrom          (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
23:11:44.0678 5856        cdrom - ok
23:11:44.0756 5856        circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
23:11:44.0803 5856        circlass - ok
23:11:44.0834 5856        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
23:11:44.0850 5856        CLFS - ok
23:11:44.0912 5856        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
23:11:44.0959 5856        CmBatt - ok
23:11:44.0974 5856        cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
23:11:44.0990 5856        cmdide - ok
23:11:45.0021 5856        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
23:11:45.0037 5856        Compbatt - ok
23:11:45.0052 5856        crcdisk        (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
23:11:45.0068 5856        crcdisk - ok
23:11:45.0115 5856        CRFILTER        (d18893845ae1c5833b5b2ea9b7f5c670) C:\Windows\system32\DRIVERS\CRFILTER.sys
23:11:45.0177 5856        CRFILTER - ok
23:11:45.0208 5856        Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
23:11:45.0271 5856        Crusoe - ok
23:11:45.0349 5856        DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
23:11:45.0396 5856        DfsC - ok
23:11:45.0474 5856        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
23:11:45.0489 5856        disk - ok
23:11:45.0567 5856        drmkaud        (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
23:11:45.0630 5856        drmkaud - ok
23:11:45.0692 5856        DXGKrnl        (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
23:11:45.0739 5856        DXGKrnl - ok
23:11:45.0786 5856        E1G60          (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
23:11:45.0848 5856        E1G60 - ok
23:11:45.0942 5856        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
23:11:45.0973 5856        Ecache - ok
23:11:46.0035 5856        elxstor        (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
23:11:46.0066 5856        elxstor - ok
23:11:46.0113 5856        ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
23:11:46.0176 5856        ErrDev - ok
23:11:46.0269 5856        exfat          (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
23:11:46.0316 5856        exfat - ok
23:11:46.0332 5856        fastfat        (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
23:11:46.0394 5856        fastfat - ok
23:11:46.0456 5856        fdc            (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
23:11:46.0534 5856        fdc - ok
23:11:46.0566 5856        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
23:11:46.0597 5856        FileInfo - ok
23:11:46.0612 5856        Filetrace      (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
23:11:46.0690 5856        Filetrace - ok
23:11:46.0706 5856        flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
23:11:46.0784 5856        flpydisk - ok
23:11:46.0815 5856        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
23:11:46.0846 5856        FltMgr - ok
23:11:46.0893 5856        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
23:11:46.0956 5856        Fs_Rec - ok
23:11:46.0987 5856        gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
23:11:47.0002 5856        gagp30kx - ok
23:11:47.0034 5856        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
23:11:47.0049 5856        GEARAspiWDM - ok
23:11:47.0112 5856        ghaio          (31b40f40e09513addc460f6a297ad474) C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys
23:11:47.0174 5856        ghaio - ok
23:11:47.0314 5856        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
23:11:47.0377 5856        HdAudAddService - ok
23:11:47.0424 5856        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
23:11:47.0470 5856        HDAudBus - ok
23:11:47.0502 5856        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
23:11:47.0564 5856        HidBth - ok
23:11:47.0595 5856        HidIr          (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
23:11:47.0658 5856        HidIr - ok
23:11:47.0767 5856        HidUsb          (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
23:11:47.0814 5856        HidUsb - ok
23:11:47.0829 5856        HpCISSs        (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
23:11:47.0845 5856        HpCISSs - ok
23:11:47.0892 5856        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
23:11:47.0938 5856        HTTP - ok
23:11:48.0048 5856        hwdatacard      (348c3a9d01e68a0222a246346924aa55) C:\Windows\system32\DRIVERS\ewusbmdm.sys
23:11:48.0110 5856        hwdatacard - ok
23:11:48.0172 5856        hwusbdev        (460b1945c3e6b0419a76e1b507b90b71) C:\Windows\system32\DRIVERS\ewusbdev.sys
23:11:48.0219 5856        hwusbdev - ok
23:11:48.0313 5856        i2omp          (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
23:11:48.0313 5856        i2omp - ok
23:11:48.0360 5856        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
23:11:48.0391 5856        i8042prt - ok
23:11:48.0438 5856        iaStorV        (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
23:11:48.0453 5856        iaStorV - ok
23:11:48.0469 5856        iirsp          (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
23:11:48.0484 5856        iirsp - ok
23:11:48.0594 5856        IntcAzAudAddService (0557aaee4c86e2c333acd2baf42a7619) C:\Windows\system32\drivers\RTKVHDA.sys
23:11:48.0672 5856        IntcAzAudAddService - ok
23:11:48.0781 5856        intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
23:11:48.0796 5856        intelide - ok
23:11:48.0843 5856        intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
23:11:48.0890 5856        intelppm - ok
23:11:48.0952 5856        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:11:48.0999 5856        IpFilterDriver - ok
23:11:49.0015 5856        IpInIp - ok
23:11:49.0030 5856        IPMIDRV        (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
23:11:49.0077 5856        IPMIDRV - ok
23:11:49.0108 5856        IPNAT          (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
23:11:49.0155 5856        IPNAT - ok
23:11:49.0186 5856        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
23:11:49.0218 5856        IRENUM - ok
23:11:49.0233 5856        isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
23:11:49.0249 5856        isapnp - ok
23:11:49.0296 5856        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
23:11:49.0311 5856        iScsiPrt - ok
23:11:49.0342 5856        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
23:11:49.0342 5856        iteatapi - ok
23:11:49.0389 5856        iteraid        (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
23:11:49.0405 5856        iteraid - ok
23:11:49.0420 5856        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
23:11:49.0436 5856        kbdclass - ok
23:11:49.0467 5856        kbdhid          (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\drivers\kbdhid.sys
23:11:49.0498 5856        kbdhid - ok
23:11:49.0545 5856        kbfiltr        (27bd4ac228ef6c0d490617c32e86a672) C:\Windows\system32\DRIVERS\kbfiltr.sys
23:11:49.0608 5856        kbfiltr - ok
23:11:49.0639 5856        KSecDD          (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
23:11:49.0670 5856        KSecDD - ok
23:11:49.0764 5856        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
23:11:49.0795 5856        lltdio - ok
23:11:49.0826 5856        LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
23:11:49.0857 5856        LSI_FC - ok
23:11:49.0873 5856        LSI_SAS        (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
23:11:49.0888 5856        LSI_SAS - ok
23:11:49.0904 5856        LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
23:11:49.0920 5856        LSI_SCSI - ok
23:11:49.0951 5856        luafv          (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
23:11:49.0982 5856        luafv - ok
23:11:50.0060 5856        MBAMProtector  (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys
23:11:50.0107 5856        MBAMProtector - ok
23:11:50.0138 5856        megasas        (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
23:11:50.0154 5856        megasas - ok
23:11:50.0185 5856        MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
23:11:50.0216 5856        MegaSR - ok
23:11:50.0247 5856        Modem          (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
23:11:50.0294 5856        Modem - ok
23:11:50.0341 5856        MODEMCSA        (cbb59c41f19efea1a000793e08070a62) C:\Windows\system32\drivers\MODEMCSA.sys
23:11:50.0388 5856        MODEMCSA - ok
23:11:50.0481 5856        monitor        (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
23:11:50.0528 5856        monitor - ok
23:11:50.0559 5856        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
23:11:50.0559 5856        mouclass - ok
23:11:50.0590 5856        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
23:11:50.0637 5856        mouhid - ok
23:11:50.0653 5856        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
23:11:50.0668 5856        MountMgr - ok
23:11:50.0715 5856        mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
23:11:50.0731 5856        mpio - ok
23:11:50.0762 5856        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
23:11:50.0793 5856        mpsdrv - ok
23:11:50.0824 5856        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
23:11:50.0840 5856        Mraid35x - ok
23:11:50.0887 5856        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
23:11:50.0934 5856        MRxDAV - ok
23:11:50.0996 5856        mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
23:11:51.0027 5856        mrxsmb - ok
23:11:51.0074 5856        mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:11:51.0105 5856        mrxsmb10 - ok
23:11:51.0152 5856        mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:11:51.0199 5856        mrxsmb20 - ok
23:11:51.0261 5856        msahci          (5457dcfa7c0da43522f4d9d4049c1472) C:\Windows\system32\drivers\msahci.sys
23:11:51.0277 5856        msahci - ok
23:11:51.0308 5856        msdsm          (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
23:11:51.0324 5856        msdsm - ok
23:11:51.0402 5856        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
23:11:51.0433 5856        Msfs - ok
23:11:51.0526 5856        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
23:11:51.0542 5856        msisadrv - ok
23:11:51.0604 5856        MSKSSRV        (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
23:11:51.0636 5856        MSKSSRV - ok
23:11:51.0698 5856        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
23:11:51.0745 5856        MSPCLOCK - ok
23:11:51.0776 5856        MSPQM          (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
23:11:51.0838 5856        MSPQM - ok
23:11:51.0948 5856        MsRPC          (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
23:11:51.0963 5856        MsRPC - ok
23:11:52.0119 5856        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
23:11:52.0135 5856        mssmbios - ok
23:11:52.0260 5856        MSTEE          (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
23:11:52.0306 5856        MSTEE - ok
23:11:52.0369 5856        MTsensor        (97affa9d95ffe20eee6229bc6be166cf) C:\Windows\system32\DRIVERS\ATKACPI.sys
23:11:52.0400 5856        MTsensor - ok
23:11:52.0447 5856        Mup            (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
23:11:52.0462 5856        Mup - ok
23:11:52.0540 5856        NativeWifiP    (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
23:11:52.0572 5856        NativeWifiP - ok
23:11:52.0603 5856        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
23:11:52.0650 5856        NDIS - ok
23:11:52.0712 5856        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
23:11:52.0759 5856        NdisTapi - ok
23:11:52.0774 5856        Ndisuio        (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
23:11:52.0837 5856        Ndisuio - ok
23:11:52.0899 5856        NdisWan        (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
23:11:52.0946 5856        NdisWan - ok
23:11:52.0993 5856        NDProxy        (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
23:11:53.0040 5856        NDProxy - ok
23:11:53.0086 5856        NetBIOS        (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
23:11:53.0149 5856        NetBIOS - ok
23:11:53.0242 5856        netbt          (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
23:11:53.0289 5856        netbt - ok
23:11:53.0352 5856        nfrd960        (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
23:11:53.0367 5856        nfrd960 - ok
23:11:53.0430 5856        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
23:11:53.0476 5856        Npfs - ok
23:11:53.0523 5856        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
23:11:53.0586 5856        nsiproxy - ok
23:11:53.0710 5856        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
23:11:53.0788 5856        Ntfs - ok
23:11:53.0929 5856        ntrigdigi      (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
23:11:54.0022 5856        ntrigdigi - ok
23:11:54.0163 5856        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
23:11:54.0210 5856        Null - ok
23:11:54.0397 5856        NVENETFD        (adb84b1e6b837c45443aa25abe9e7012) C:\Windows\system32\DRIVERS\nvmfdx32.sys
23:11:54.0522 5856        NVENETFD - ok
23:11:54.0693 5856        NVHDA          (2c7ac27710e8d41c1eb7d1599187d237) C:\Windows\system32\drivers\nvhda32v.sys
23:11:54.0787 5856        NVHDA - ok
23:11:55.0364 5856        nvlddmkm        (b5d2b15d3eba77bef9392fbefb3ddda0) C:\Windows\system32\DRIVERS\nvlddmkm.sys
23:11:55.0801 5856        nvlddmkm - ok
23:11:55.0941 5856        nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
23:11:55.0972 5856        nvraid - ok
23:11:56.0004 5856        nvsmu          (736054614ab962d4ec01ef4abce115f1) C:\Windows\system32\DRIVERS\nvsmu.sys
23:11:56.0066 5856        nvsmu - ok
23:11:56.0097 5856        nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
23:11:56.0128 5856        nvstor - ok
23:11:56.0160 5856        nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
23:11:56.0191 5856        nv_agp - ok
23:11:56.0206 5856        NwlnkFlt - ok
23:11:56.0222 5856        NwlnkFwd - ok
23:11:56.0269 5856        ohci1394        (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys
23:11:56.0331 5856        ohci1394 - ok
23:11:56.0378 5856        Parport        (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
23:11:56.0440 5856        Parport - ok
23:11:56.0472 5856        partmgr        (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
23:11:56.0487 5856        partmgr - ok
23:11:56.0518 5856        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
23:11:56.0596 5856        Parvdm - ok
23:11:56.0643 5856        pci            (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
23:11:56.0659 5856        pci - ok
23:11:56.0706 5856        pciide          (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
23:11:56.0721 5856        pciide - ok
23:11:56.0737 5856        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
23:11:56.0752 5856        pcmcia - ok
23:11:56.0799 5856        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
23:11:56.0893 5856        PEAUTH - ok
23:11:57.0002 5856        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
23:11:57.0049 5856        PptpMiniport - ok
23:11:57.0080 5856        Processor      (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
23:11:57.0111 5856        Processor - ok
23:11:57.0174 5856        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
23:11:57.0205 5856        PSched - ok
23:11:57.0236 5856        PxHelp20        (49452bfcec22f36a7a9b9c2181bc3042) C:\Windows\system32\Drivers\PxHelp20.sys
23:11:57.0298 5856        PxHelp20 - ok
23:11:57.0361 5856        ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
23:11:57.0408 5856        ql2300 - ok
23:11:57.0439 5856        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
23:11:57.0454 5856        ql40xx - ok
23:11:57.0486 5856        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
23:11:57.0548 5856        QWAVEdrv - ok
23:11:57.0579 5856        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
23:11:57.0642 5856        RasAcd - ok
23:11:57.0673 5856        Rasl2tp        (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
23:11:57.0735 5856        Rasl2tp - ok
23:11:57.0798 5856        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
23:11:57.0829 5856        RasPppoe - ok
23:11:57.0860 5856        RasSstp        (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
23:11:57.0891 5856        RasSstp - ok
23:11:57.0922 5856        rdbss          (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
23:11:57.0954 5856        rdbss - ok
23:11:57.0985 5856        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
23:11:58.0032 5856        RDPCDD - ok
23:11:58.0063 5856        rdpdr          (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
23:11:58.0094 5856        rdpdr - ok
23:11:58.0125 5856        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
23:11:58.0156 5856        RDPENCDD - ok
23:11:58.0203 5856        RDPWD          (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
23:11:58.0234 5856        RDPWD - ok
23:11:58.0281 5856        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
23:11:58.0328 5856        rspndr - ok
23:11:58.0344 5856        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
23:11:58.0375 5856        sbp2port - ok
23:11:58.0422 5856        sdbus          (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys
23:11:58.0468 5856        sdbus - ok
23:11:58.0500 5856        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
23:11:58.0562 5856        secdrv - ok
23:11:58.0718 5856        Serenum        (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
23:11:58.0780 5856        Serenum - ok
23:11:58.0952 5856        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
23:11:59.0030 5856        Serial - ok
23:11:59.0248 5856        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
23:11:59.0311 5856        sermouse - ok
23:11:59.0592 5856        sffdisk        (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
23:11:59.0638 5856        sffdisk - ok
23:11:59.0716 5856        sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
23:11:59.0779 5856        sffp_mmc - ok
23:11:59.0810 5856        sffp_sd        (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
23:11:59.0857 5856        sffp_sd - ok
23:11:59.0904 5856        sfloppy        (c33bfbd6e9e41fcd9ffef9729e9faed6) C:\Windows\system32\DRIVERS\sfloppy.sys
23:11:59.0966 5856        sfloppy - ok
23:12:00.0184 5856        sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
23:12:00.0216 5856        sisagp - ok
23:12:00.0247 5856        SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
23:12:00.0278 5856        SiSRaid2 - ok
23:12:00.0294 5856        SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
23:12:00.0325 5856        SiSRaid4 - ok
23:12:00.0387 5856        Smb            (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
23:12:00.0434 5856        Smb - ok
23:12:00.0528 5856        smserial        (c8a58fc905c9184fa70e37f71060c64d) C:\Windows\system32\DRIVERS\smserial.sys
23:12:00.0652 5856        smserial - ok
23:12:01.0027 5856        SNP2UVC        (85da7b2a2f248c8c69d7d0a526342683) C:\Windows\system32\DRIVERS\snp2uvc.sys
23:12:01.0167 5856        SNP2UVC - ok
23:12:01.0292 5856        spldr          (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
23:12:01.0323 5856        spldr - ok
23:12:01.0510 5856        srv            (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
23:12:01.0573 5856        srv - ok
23:12:01.0791 5856        srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
23:12:01.0854 5856        srv2 - ok
23:12:01.0885 5856        srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
23:12:01.0932 5856        srvnet - ok
23:12:01.0978 5856        ssmdrv          (5ec550b8952882ee856b862cf648522d) C:\Windows\system32\DRIVERS\ssmdrv.sys
23:12:01.0994 5856        ssmdrv - ok
23:12:02.0103 5856        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
23:12:02.0119 5856        swenum - ok
23:12:02.0228 5856        Symc8xx        (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
23:12:02.0259 5856        Symc8xx - ok
23:12:02.0306 5856        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
23:12:02.0322 5856        Sym_hi - ok
23:12:02.0368 5856        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
23:12:02.0384 5856        Sym_u3 - ok
23:12:02.0415 5856        SynTP          (db835c324cd488a86e9bfc2c3fd29cd8) C:\Windows\system32\DRIVERS\SynTP.sys
23:12:02.0493 5856        SynTP - ok
23:12:02.0805 5856        Tcpip          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys
23:12:02.0852 5856        Tcpip - ok
23:12:03.0133 5856        Tcpip6          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys
23:12:03.0336 5856        Tcpip6 - ok
23:12:03.0476 5856        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
23:12:03.0538 5856        tcpipreg - ok
23:12:03.0601 5856        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
23:12:03.0710 5856        TDPIPE - ok
23:12:03.0726 5856        TDTCP          (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
23:12:03.0788 5856        TDTCP - ok
23:12:04.0022 5856        tdx            (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
23:12:04.0084 5856        tdx - ok
23:12:04.0225 5856        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
23:12:04.0256 5856        TermDD - ok
23:12:04.0412 5856        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
23:12:04.0474 5856        tssecsrv - ok
23:12:04.0599 5856        tunmp          (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
23:12:04.0693 5856        tunmp - ok
23:12:04.0833 5856        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
23:12:04.0864 5856        tunnel - ok
23:12:04.0958 5856        uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
23:12:04.0989 5856        uagp35 - ok
23:12:05.0020 5856        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
23:12:05.0067 5856        udfs - ok
23:12:05.0114 5856        uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
23:12:05.0145 5856        uliagpkx - ok
23:12:05.0176 5856        uliahci        (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
23:12:05.0208 5856        uliahci - ok
23:12:05.0332 5856        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
23:12:05.0364 5856        UlSata - ok
23:12:05.0410 5856        ulsata2        (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
23:12:05.0426 5856        ulsata2 - ok
23:12:05.0566 5856        umbus          (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
23:12:05.0629 5856        umbus - ok
23:12:05.0816 5856        USBAAPL        (d4fb6ecc60a428564ba8768b0e23c0fc) C:\Windows\system32\Drivers\usbaapl.sys
23:12:05.0863 5856        USBAAPL - ok
23:12:05.0956 5856        usbccgp        (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
23:12:06.0019 5856        usbccgp - ok
23:12:06.0034 5856        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
23:12:06.0128 5856        usbcir - ok
23:12:06.0175 5856        usbehci        (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
23:12:06.0237 5856        usbehci - ok
23:12:06.0300 5856        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
23:12:06.0346 5856        usbhub - ok
23:12:06.0487 5856        usbohci        (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys
23:12:06.0549 5856        usbohci - ok
23:12:06.0612 5856        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
23:12:06.0690 5856        usbprint - ok
23:12:06.0768 5856        usbscan        (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
23:12:06.0830 5856        usbscan - ok
23:12:06.0877 5856        USBSTOR        (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
23:12:06.0924 5856        USBSTOR - ok
23:12:06.0970 5856        usbuhci        (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
23:12:07.0033 5856        usbuhci - ok
23:12:07.0158 5856        usbvideo        (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
23:12:07.0236 5856        usbvideo - ok
23:12:07.0454 5856        vga            (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
23:12:07.0532 5856        vga - ok
23:12:07.0672 5856        VgaSave        (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
23:12:07.0782 5856        VgaSave - ok
23:12:07.0813 5856        viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
23:12:07.0844 5856        viaagp - ok
23:12:07.0875 5856        ViaC7          (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
23:12:07.0953 5856        ViaC7 - ok
23:12:07.0969 5856        viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
23:12:07.0984 5856        viaide - ok
23:12:08.0031 5856        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
23:12:08.0047 5856        volmgr - ok
23:12:08.0094 5856        volmgrx        (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
23:12:08.0125 5856        volmgrx - ok
23:12:08.0172 5856        volsnap        (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
23:12:08.0218 5856        volsnap - ok
23:12:08.0250 5856        vsmraid        (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
23:12:08.0281 5856        vsmraid - ok
23:12:08.0374 5856        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
23:12:08.0484 5856        WacomPen - ok
23:12:08.0671 5856        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
23:12:08.0733 5856        Wanarp - ok
23:12:08.0749 5856        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
23:12:08.0796 5856        Wanarpv6 - ok
23:12:09.0045 5856        Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
23:12:09.0045 5856        Wd - ok
23:12:09.0123 5856        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
23:12:09.0154 5856        Wdf01000 - ok
23:12:09.0326 5856        WmiAcpi        (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
23:12:09.0357 5856        WmiAcpi - ok
23:12:09.0420 5856        WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
23:12:09.0451 5856        WpdUsb - ok
23:12:09.0482 5856        ws2ifsl        (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
23:12:09.0529 5856        ws2ifsl - ok
23:12:09.0576 5856        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
23:12:09.0607 5856        WUDFRd - ok
23:12:09.0700 5856        yukonwlh        (7d1f3b131d503ef43ee594b5a2b9b427) C:\Windows\system32\DRIVERS\yk60x86.sys
23:12:09.0763 5856        yukonwlh - ok
23:12:09.0794 5856        MBR (0x1B8)    (64b1e91c5c6c2157642651010728f90f) \Device\Harddisk0\DR0
23:12:10.0122 5856        \Device\Harddisk0\DR0 - ok
23:12:10.0122 5856        MBR (0x1B8)    (671b81004fdd1588fa9ed1331c9ceca9) \Device\Harddisk1\DR4
23:12:17.0937 5856        \Device\Harddisk1\DR4 - ok
23:12:17.0968 5856        Boot (0x1200)  (dee3e6a168f2db2e996f2ab63c3c3854) \Device\Harddisk0\DR0\Partition0
23:12:17.0968 5856        \Device\Harddisk0\DR0\Partition0 - ok
23:12:18.0000 5856        Boot (0x1200)  (5f2bfe29efbec95b639df4583a68b225) \Device\Harddisk0\DR0\Partition1
23:12:18.0000 5856        \Device\Harddisk0\DR0\Partition1 - ok
23:12:18.0015 5856        Boot (0x1200)  (1a2b2a497d664150766fb17cb0d7b270) \Device\Harddisk1\DR4\Partition0
23:12:18.0015 5856        \Device\Harddisk1\DR4\Partition0 - ok
23:12:18.0015 5856        ============================================================
23:12:18.0015 5856        Scan finished
23:12:18.0015 5856        ============================================================
23:12:18.0031 5284        Detected object count: 0
23:12:18.0031 5284        Actual detected object count: 0

:kaffee::kaffee::kaffee:

Sunshine_Mel 12.01.2012 23:40
Zitat:
Zitat von cosinus (Beitrag 753788)
Ich hoffe NICHT bei softonic :balla: :stirn:
Die Downloadlinks sind alle sauber in der Anleitung zu sehen
Sorry, aber schön aneinander vorbei gequatscht :stirn:

leider wirklich bei softonic ... :killpc: als erstes, als zweites dann direkt bei kaspersky.

Deswegen, kann ich auf der Seite auch nicht posten :stirn: :stirn:
:stirn:

cosinus 12.01.2012 23:43
sry aber :lach: :lach: :rofl: :stirn:

Finger weg von Softonic!!

Softonic ist eine Toolbar- und Adwareschleuder! Finger weg! Software lädt man sich mit oberster Priorität direkt vom Hersteller und nicht von solchen Toolbarklitschen wie Softonic! Im Notfall würde natürlich chip.de gehen

Sunshine_Mel 12.01.2012 23:46
Zitat:
Zitat von cosinus (Beitrag 753801)
sry aber :lach: :lach: :rofl: :stirn:

Finger weg von Softonic!!

Softonic ist eine Toolbar- und Adwareschleuder! Finger weg! Software lädt man sich mit oberster Priorität direkt vom Hersteller und nicht von solchen Toolbarklitschen wie Softonic! Im Notfall würde natürlich chip.de gehen
Eyyyy, ist schon spät :D :D :D

Hab alle Häkchen entfernt gehabt, mich da aber auch schon gewundert. Sollte mehr uff meinen Bauch hören.


Ist jetzt soweit aber alles ok mit dem letzten post? oder muss ich noch irgendwas ändern?

cosinus 13.01.2012 01:20
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Sunshine_Mel 13.01.2012 18:48
Hallöchen Arne,

hier die Combofix.log

Code:
ComboFix 12-01-13.03 - Administrator 13.01.2012  17:43:55.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3070.1601 [GMT 1:00]
ausgeführt von:: c:\users\Administrator\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jenny\AppData\Roaming\Desktopicon
c:\users\Jenny\AppData\Roaming\Desktopicon\eBay.ico
c:\users\Jenny\AppData\Roaming\Desktopicon\uninst.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-13 bis 2012-01-13  ))))))))))))))))))))))))))))))
.
.
2012-01-13 16:49 . 2012-01-13 16:49        --------        d-----w-        c:\users\Jenny\AppData\Local\temp
2012-01-13 16:49 . 2012-01-13 16:49        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2012-01-13 16:49 . 2012-01-13 16:49        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-01-12 20:49 . 2012-01-12 20:49        --------        d-----w-        C:\_OTL
2012-01-11 19:30 . 2012-01-11 19:30        --------        d-----w-        c:\program files\ESET
2012-01-09 20:41 . 2012-01-09 20:41        --------        d-----w-        c:\users\Jenny\AppData\Roaming\Malwarebytes
2012-01-09 20:40 . 2012-01-09 20:40        --------        d-----w-        c:\programdata\Malwarebytes
2012-01-09 20:40 . 2012-01-09 20:41        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-01-09 20:40 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-09 20:12 . 2012-01-10 18:24        --------        d-----w-        c:\users\Administrator
2012-01-06 13:11 . 2009-06-22 19:01        112128        ----a-w-        c:\windows\system32\drivers\ewusbnet.sys
2012-01-06 13:11 . 2009-06-22 18:38        102912        ----a-w-        c:\windows\system32\drivers\ewusbmdm.sys
2012-01-06 13:11 . 2009-06-22 18:26        100736        ----a-w-        c:\windows\system32\drivers\ewusbdev.sys
2012-01-06 13:11 . 2007-08-09 03:06        23424        ----a-w-        c:\windows\system32\drivers\ewdcsc.sys
2012-01-06 13:11 . 2012-01-06 13:13        --------        d-----w-        c:\program files\Mobile Partner
2011-12-30 23:20 . 2011-11-21 10:47        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{13C4E3AE-75B9-4F63-9EBA-0E65F0197AA2}\mpengine.dll
2011-12-24 16:30 . 2011-12-24 16:30        1207568        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-15 20:29 . 2011-10-27 08:01        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-12-15 20:29 . 2011-10-27 08:01        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-12-15 20:29 . 2011-11-23 13:37        2043904        ----a-w-        c:\windows\system32\win32k.sys
2011-12-15 20:29 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll
2011-12-15 20:29 . 2011-11-08 12:10        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
2011-12-15 20:29 . 2011-10-25 15:56        49152        ----a-w-        c:\windows\system32\csrsrv.dll
2011-12-15 20:29 . 2011-11-08 14:42        2048        ----a-w-        c:\windows\system32\tzres.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-12 21:39 . 2008-11-10 23:58        45056        ----a-w-        c:\windows\system32\acovcnt.exe
2011-12-11 19:08 . 2011-12-11 19:08        161792        ----a-w-        c:\windows\system32\msls31.dll
2011-12-11 19:07 . 2011-12-11 19:07        86528        ----a-w-        c:\windows\system32\iesysprep.dll
2011-12-11 19:07 . 2011-12-11 19:07        76800        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2011-12-11 19:07 . 2011-12-11 19:07        74752        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe
2011-12-11 19:07 . 2011-12-11 19:07        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2011-12-11 19:07 . 2011-12-11 19:07        63488        ----a-w-        c:\windows\system32\tdc.ocx
2011-12-11 19:07 . 2011-12-11 19:07        367104        ----a-w-        c:\windows\system32\html.iec
2011-12-11 19:07 . 2011-12-11 19:07        74752        ----a-w-        c:\windows\system32\iesetup.dll
2011-12-11 19:07 . 2011-12-11 19:07        420864        ----a-w-        c:\windows\system32\vbscript.dll
2011-12-11 19:07 . 2011-12-11 19:07        23552        ----a-w-        c:\windows\system32\licmgr10.dll
2011-12-11 19:07 . 2011-12-11 19:07        152064        ----a-w-        c:\windows\system32\wextract.exe
2011-12-11 19:07 . 2011-12-11 19:07        150528        ----a-w-        c:\windows\system32\iexpress.exe
2011-12-11 19:07 . 2011-12-11 19:07        35840        ----a-w-        c:\windows\system32\imgutil.dll
2011-12-11 19:07 . 2011-12-11 19:07        142848        ----a-w-        c:\windows\system32\ieUnatt.exe
2011-12-11 19:07 . 2011-12-11 19:07        11776        ----a-w-        c:\windows\system32\mshta.exe
2011-12-11 19:07 . 2011-12-11 19:07        101888        ----a-w-        c:\windows\system32\admparse.dll
2011-12-11 19:07 . 2011-12-11 19:07        110592        ----a-w-        c:\windows\system32\IEAdvpack.dll
2011-11-19 19:05 . 2011-06-14 22:50        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2009-12-05 13:28 . 2009-07-26 14:31        119808        ----a-w-        c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 14:57        948672        ----a-r-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-18 07:58        40368        ----a-w-        c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Camera ScreenSaver]
2008-11-10 23:53        47672        ----a-w-        c:\windows\AsScrProlog.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
2008-11-10 23:53        3054136        ----a-w-        c:\windows\AsScrPro.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATKOSD2]
2008-01-23 23:34        7766016        ----a-w-        c:\program files\ATKOSD2\ATKOSD2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2009-03-02 11:08        209153        ----a-w-        c:\program files\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2008-07-19 03:52        104936        ----a-w-        c:\program files\CyberLink\Power2Go\CLMLSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-01 06:39        1164584        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:25        125952        ----a-w-        c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus SX200 Series]
2007-12-13 15:00        188928        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATIEFE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2009-12-05 13:28        30192        ----a-w-        c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HControlUser]
2008-01-12 06:40        98304        ----a-w-        c:\program files\ATK Hotkey\HControlUser.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-07 14:33        421160        ----a-w-        c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-06-09 18:16        2363392        ----a-w-        c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 20:12        3872080        ----a-w-        c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSSInstallation]
2010-03-08 18:00        497016        ----a-w-        c:\program files\DivX\Symantec\scstubinstaller.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-07-25 08:30        13548064        ----a-w-        c:\windows\System32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-07-25 08:30        92704        ----a-w-        c:\windows\System32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2Go_Menu]
2008-06-14 02:11        210216        ----a-w-        c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-08-12 08:21        6265376        ----a-w-        c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28        1233920        ----a-w-        c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2008-08-12 08:21        1833504        ----a-w-        c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPStart]
2007-08-17 06:40        102400        ----a-w-        c:\program files\Synaptics\SynTP\SynTPStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
2009-04-11 06:28        2153472        ----a-w-        c:\windows\System32\oobefldr.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 18:14        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2011-02-07 c:\windows\Tasks\Install_NSS.job
- c:\program files\DivX\Symantec\scstubinstaller.exe [2010-03-08 18:00]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
mStart Page = hxxp://alice.aol.de
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-Free Audio CD Burner_is1 - c:\program files\DVDVideoSoft\Free Audio CD Burner\unins000.exe
AddRemove-Uninstall_is1 - c:\program files\Common Files\DVDVideoSoft\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-13 17:50
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (Administrator)
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,3b,1b,21,87,1f,
  e1,6c,9b,49,03,ab,36,c9,b5,29,9c,15,1a
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,3b,1b,6f,c7,f0,
  a3,53,95,b7,5c,a8,e0,5f,fc,c9,40,f5,16
"{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"=hex:51,66,7a,6c,4c,1d,3b,1b,8f,87,9e,
  18,e1,9f,3e,00,ac,70,27,17,7d,21,a0,aa
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,3b,1b,74,cd,2a,
  8e,34,1b,d8,07,9a,c1,0e,38,76,42,23,df
"{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,3b,1b,79,41,9a,
  b0,6a,79,b3,03,9b,76,ae,ab,85,50,04,8e
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (Administrator)
"Timestamp"=hex:80,62,72,9f,b8,cf,cc,01
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
  d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e5,55,96,3c,30,5e,52,48,bc,65,1a,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
  d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e5,55,96,3c,30,5e,52,48,bc,65,1a,\
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.HTM"
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.HTM"
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.PARTIAL"
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.SVG"
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.URL"
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.WEBSITE"
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.XHT"
.
[HKEY_USERS\S-1-5-21-787148086-109556013-2554673955-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.XHT"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2012-01-13  17:52:10
ComboFix-quarantined-files.txt  2012-01-13 16:52
.
Vor Suchlauf: 7 Verzeichnis(se), 85.263.802.368 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 89.161.097.216 Bytes frei
.
- - End Of File - - 311E4CBA2E3E7DCA8047922C9643F269
:dankeschoen:

cosinus 13.01.2012 19:25
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Sunshine_Mel 15.01.2012 17:08
Hallöchen Arne,

Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-01-15 15:35:18
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9320320AS rev.0303
Running: gmer.exe; Driver: C:\Users\ADMINI~1\AppData\Local\Temp\fwtoypog.sys


---- System - GMER 1.0.15 ----

SSDT            9ED7A9CC                                  ZwCreateThread
SSDT            9ED7A9B8                                  ZwOpenProcess
SSDT            9ED7A9BD                                  ZwOpenThread
SSDT            9ED7A9C7                                  ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!KeSetEvent + 221            824E99A4 4 Bytes  [CC, A9, D7, 9E]
.text          ntkrnlpa.exe!KeSetEvent + 3F1            824E9B74 4 Bytes  [B8, A9, D7, 9E]
.text          ntkrnlpa.exe!KeSetEvent + 40D            824E9B90 4 Bytes  [BD, A9, D7, 9E]
.text          ntkrnlpa.exe!KeSetEvent + 621            824E9DA4 4 Bytes  [C7, A9, D7, 9E]
.text          C:\Windows\system32\DRIVERS\nvlddmkm.sys  section is writeable [0x8E206340, 0x3EE587, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0  Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1  Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\00000077        halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \FileSystem\fastfat \Fat                  fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 16:39:20 on 15.01.2012

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[AppInit DLLs]
-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----
"AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ASMMAP" (ASMMAP) - ? - C:\Program Files\ATKGFNEX\ASMMAP.sys
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\ADMINI~1\AppData\Local\Temp\catchme.sys  (File not found)
"ghaio" (ghaio) - ? - C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys  (File found, but it contains no detailed information)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

[Internet Explorer]
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"LightScribe Control Panel" - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASLDR Service" (ASLDRService) - ? - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
"ATKGFNEX Service" (ATKGFNEXSrv) - ? - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"Google Desktop Manager 5.9.911.3589" (GoogleDesktopManager-110309-193829) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"spmgr" (spmgr) - ? - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-15 16:50:40
-----------------------------
16:50:40.200    OS Version: Windows 6.0.6002 Service Pack 2
16:50:40.200    Number of processors: 2 586 0xF0D
16:50:40.200    ComputerName: JENNY-PC  UserName:
16:50:41.651    Initialize success
16:50:57.504    AVAST engine download error: 0
16:51:05.273    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
16:51:05.273    Disk 0 Vendor: ST9320320AS 0303 Size: 305245MB BusType: 3
16:51:05.289    Disk 0 MBR read successfully
16:51:05.304    Disk 0 MBR scan
16:51:05.304    Disk 0 unknown MBR code
16:51:05.304    Disk 0 Partition 1 00    1C Hidd FAT32 LBA MSDOS5.0    10001 MB offset 63
16:51:05.336    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      152622 MB offset 20484096
16:51:05.336    Disk 0 Partition - 00    0F Extended LBA            142620 MB offset 333053952
16:51:05.382    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      142619 MB offset 333056000
16:51:05.382    Disk 0 scanning sectors +625139712
16:51:05.507    Disk 0 scanning C:\Windows\system32\drivers
16:51:13.526    Service scanning
16:51:15.008    Modules scanning
16:51:32.448    Disk 0 trace - called modules:
16:51:32.480    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys halmacpi.dll ataport.SYS PCIIDEX.SYS msahci.sys
16:51:32.480    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x858ddac8]
16:51:32.495    3 CLASSPNP.SYS[8a7af8b3] -> nt!IofCallDriver -> [0x85769860]
16:51:32.495    5 acpi.sys[8069a6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x85732390]
16:51:32.511    Scan finished successfully
16:52:04.085    Disk 0 MBR has been saved successfully to "C:\Users\Administrator\Desktop\MBR.dat"
16:52:04.101    The log file has been saved successfully to "C:\Users\Administrator\Desktop\aswMBR.txt"
:Boogie:

cosinus 15.01.2012 18:35
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.
Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

Sunshine_Mel 17.01.2012 16:33
Hallo Arne,

MBR fixen ging ohne Probleme
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-17 15:48:15
-----------------------------
15:48:15.616    OS Version: Windows 6.0.6002 Service Pack 2
15:48:15.616    Number of processors: 2 586 0xF0D
15:48:15.619    ComputerName: JENNY-PC  UserName:
15:48:17.062    Initialize success
15:48:32.333    AVAST engine download error: 0
15:49:10.879    Verifying
15:49:20.895    Disk 0 Windows 600 MBR fixed successfully
15:49:43.999    Disk 0 MBR has been saved successfully to "C:\Users\Administrator\Desktop\MBR.dat"
15:49:44.001    The log file has been saved successfully to "C:\Users\Administrator\Desktop\aswMBR Fix.txt"
Nach dem Neustart dann MBR Scan gestartet. Programm ist mit BlueScreen abgestürzt. Laptop automatisch neugestartet.
Erneut Scan mit MBR, da hat dann alles geklappt:

Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-17 16:03:22
-----------------------------
16:03:22.860    OS Version: Windows 6.0.6002 Service Pack 2
16:03:22.860    Number of processors: 2 586 0xF0D
16:03:22.864    ComputerName: JENNY-PC  UserName:
16:03:24.738    Initialize success
16:08:00.615    AVAST engine defs: 12011700
16:09:12.970    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
16:09:12.975    Disk 0 Vendor: ST9320320AS 0303 Size: 305245MB BusType: 3
16:09:13.068    Disk 0 MBR read successfully
16:09:13.072    Disk 0 MBR scan
16:09:13.081    Disk 0 Windows VISTA default MBR code
16:09:13.157    Disk 0 Partition 1 00    1C Hidd FAT32 LBA MSDOS5.0    10001 MB offset 63
16:09:13.204    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      152622 MB offset 20484096
16:09:13.214    Disk 0 Partition - 00    0F Extended LBA            142620 MB offset 333053952
16:09:13.253    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      142619 MB offset 333056000
16:09:13.266    Disk 0 scanning sectors +625139712
16:09:13.389    Disk 0 scanning C:\Windows\system32\drivers
16:09:27.663    Service scanning
16:09:29.155    Modules scanning
16:09:38.087    Disk 0 trace - called modules:
16:09:38.119    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys halmacpi.dll ataport.SYS PCIIDEX.SYS msahci.sys
16:09:38.129    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85e58ac8]
16:09:38.140    3 CLASSPNP.SYS[8a7a88b3] -> nt!IofCallDriver -> [0x84d76860]
16:09:38.151    5 acpi.sys[8069f6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x85750b98]
16:09:39.083    AVAST engine scan C:\Windows
16:09:47.123    AVAST engine scan C:\Windows\system32
16:12:49.961    AVAST engine scan C:\Windows\system32\drivers
16:13:04.605    AVAST engine scan C:\Users\Administrator
16:13:37.486    AVAST engine scan C:\ProgramData
16:14:48.744    Scan finished successfully
16:15:09.750    Disk 0 MBR has been saved successfully to "C:\Users\Administrator\Desktop\MBR.dat"
16:15:09.762    The log file has been saved successfully to "C:\Users\Administrator\Desktop\aswMBR 17.1..txt"

cosinus 17.01.2012 20:27
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Sunshine_Mel 18.01.2012 21:49
Nabend Arne,

hatte leichte Internetprobleme ...

Hier die Logs

Code:
Malwarebytes Anti-Malware (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.18.03

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Administrator :: JENNY-PC [Administrator]

Schutz: Aktiviert

18.01.2012 14:33:28
mbam-log-2012-01-18 (14-33-28).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 341139
Laufzeit: 1 Stunde(n), 19 Minute(n), 27 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
SUPERAntiSpyware

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/18/2012 at 06:36 PM

Application Version : 5.0.1142

Core Rules Database Version : 8139
Trace Rules Database Version: 5951

Scan type      : Complete Scan
Total Scan Time : 01:53:59

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC Off - Administrator

Memory items scanned      : 700
Memory threats detected  : 0
Registry items scanned    : 36465
Registry threats detected : 0
File items scanned        : 132607
File threats detected    : 719

Adware.Tracking Cookie
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\CHL7I6P2.txt [ /atdmt.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\HBRLD41N.txt [ /apmebf.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\EIU1TM4H.txt [ /fl01.ct2.comclick.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\QKQ47ZVG.txt [ /tradedoubler.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\NQ42885A.txt [ /ads.creative-serving.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\V2AJ7YOL.txt [ /ad.ad-srv.net ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\1TSZ47Y2.txt [ /ad3.adfarm1.adition.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\Y37AX6VM.txt [ /webmasterplan.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\ZD3JA483.txt [ /ad4.adfarm1.adition.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\9W5XKSN1.txt [ /ad.zanox.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\XAGOPBC0.txt [ /tracking.quisma.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\EDGHRAOI.txt [ /2o7.net ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\6O2VQ11F.txt [ /e-2dj6aekowjd5wkq.stats.esomniture.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\ES827MPX.txt [ /adfarm1.adition.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\4XAOK79C.txt [ /invitemedia.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\A4VTMP88.txt [ /ad2.adfarm1.adition.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\RTJMS325.txt [ /ad.dyntracker.de ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\N5QC9ZUJ.txt [ /unitymedia.de ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\XUN0GE3O.txt [ /doubleclick.net ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\3LNJXRF0.txt [ /traffictrack.de ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\88IVSJBZ.txt [ /adx.chip.de ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\31ET807R.txt [ /zanox-affiliate.de ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\K7M05HDA.txt [ /mediaplex.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\KUBOL2AX.txt [ /advertising.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\RBWHYWXI.txt [ /www.zanox-affiliate.de ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\9KA1XJ2F.txt [ /ad1.adfarm1.adition.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\2J141RN0.txt [ /zanox.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\TF1A520R.txt [ /ad.yieldmanager.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\1ACI49OY.txt [ /ad.adc-serv.net ]
        C:\USERS\ADMINISTRATOR\Cookies\CHL7I6P2.txt [ Cookie:administrator@atdmt.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\HBRLD41N.txt [ Cookie:administrator@apmebf.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\EIU1TM4H.txt [ Cookie:administrator@fl01.ct2.comclick.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\QKQ47ZVG.txt [ Cookie:administrator@tradedoubler.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\1TSZ47Y2.txt [ Cookie:administrator@ad3.adfarm1.adition.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\Y37AX6VM.txt [ Cookie:administrator@webmasterplan.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\ZD3JA483.txt [ Cookie:administrator@ad4.adfarm1.adition.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\9W5XKSN1.txt [ Cookie:administrator@ad.zanox.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\XAGOPBC0.txt [ Cookie:administrator@tracking.quisma.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\EDGHRAOI.txt [ Cookie:administrator@2o7.net/ ]
        C:\USERS\ADMINISTRATOR\Cookies\ES827MPX.txt [ Cookie:administrator@adfarm1.adition.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\A4VTMP88.txt [ Cookie:administrator@ad2.adfarm1.adition.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\N5QC9ZUJ.txt [ Cookie:administrator@unitymedia.de/ ]
        C:\USERS\ADMINISTRATOR\Cookies\XUN0GE3O.txt [ Cookie:administrator@doubleclick.net/ ]
        C:\USERS\ADMINISTRATOR\Cookies\K7M05HDA.txt [ Cookie:administrator@mediaplex.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\KUBOL2AX.txt [ Cookie:administrator@advertising.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\RBWHYWXI.txt [ Cookie:administrator@www.zanox-affiliate.de/ ]
        C:\USERS\ADMINISTRATOR\Cookies\9KA1XJ2F.txt [ Cookie:administrator@ad1.adfarm1.adition.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\TF1A520R.txt [ Cookie:administrator@ad.yieldmanager.com/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\jenny@smartadserver[2].txt [ Cookie:jenny@smartadserver.com/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\jenny@tradedoubler[2].txt [ Cookie:jenny@tradedoubler.com/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\BH5VZIQR.txt [ Cookie:jenny@atdmt.com/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\TFC1OPPI.txt [ Cookie:jenny@doubleclick.net/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\6C08DY61.txt [ Cookie:jenny@clkads.com/adServe/banners/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\7IJJCG97.txt [ Cookie:jenny@clkads.com/adServe/banners ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\jenny@bs.serving-sys[1].txt [ Cookie:jenny@bs.serving-sys.com/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\jenny@weborama[1].txt [ Cookie:jenny@weborama.fr/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\jenny@mediaplex[3].txt [ Cookie:jenny@mediaplex.com/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\jenny@apmebf[2].txt [ Cookie:jenny@apmebf.com/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\U1G65Z0W.txt [ Cookie:jenny@microsoftwllivemkt.112.2o7.net/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\jenny@adfarm1.adition[1].txt [ Cookie:jenny@adfarm1.adition.com/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\jenny@ad2.adfarm1.adition[1].txt [ Cookie:jenny@ad2.adfarm1.adition.com/ ]
        C:\USERS\JENNY\AppData\Roaming\Microsoft\Windows\Cookies\Low\QNSQ85YN.txt [ Cookie:jenny@doubleclick.net/ ]
        C:\USERS\JENNY\Cookies\jenny@smartadserver[2].txt [ Cookie:jenny@smartadserver.com/ ]
        C:\USERS\JENNY\Cookies\jenny@tradedoubler[2].txt [ Cookie:jenny@tradedoubler.com/ ]
        C:\USERS\JENNY\Cookies\BH5VZIQR.txt [ Cookie:jenny@atdmt.com/ ]
        C:\USERS\JENNY\Cookies\TFC1OPPI.txt [ Cookie:jenny@doubleclick.net/ ]
        C:\USERS\JENNY\Cookies\6C08DY61.txt [ Cookie:jenny@clkads.com/adServe/banners/ ]
        C:\USERS\JENNY\Cookies\7IJJCG97.txt [ Cookie:jenny@clkads.com/adServe/banners ]
        C:\USERS\JENNY\Cookies\jenny@bs.serving-sys[1].txt [ Cookie:jenny@bs.serving-sys.com/ ]
        C:\USERS\JENNY\Cookies\jenny@weborama[1].txt [ Cookie:jenny@weborama.fr/ ]
        C:\USERS\JENNY\Cookies\jenny@mediaplex[3].txt [ Cookie:jenny@mediaplex.com/ ]
        C:\USERS\JENNY\Cookies\jenny@apmebf[2].txt [ Cookie:jenny@apmebf.com/ ]
        C:\USERS\JENNY\Cookies\U1G65Z0W.txt [ Cookie:jenny@microsoftwllivemkt.112.2o7.net/ ]
        C:\USERS\JENNY\Cookies\jenny@adfarm1.adition[1].txt [ Cookie:jenny@adfarm1.adition.com/ ]
        C:\USERS\JENNY\Cookies\jenny@ad2.adfarm1.adition[1].txt [ Cookie:jenny@ad2.adfarm1.adition.com/ ]
        vht.tradedoubler.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\WJ9DX3KN ]
        track.webtrekk.net [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.net [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .tracking.mindshare.de [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .content.yieldmanager.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G7VNATBG.DEFAULT\COOKIES.SQLITE ]
        ad.adserver01.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.tldadserv.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .doubleclick.net [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zedo.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zanox-affiliate.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .specificclick.net [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        tracking.dc-storm.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adserv.kwick.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adserv.kwick.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.usenext.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .apmebf.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .mediaplex.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .azjmp.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .azjmp.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .azjmp.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .mediaplex.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .server.cpmstar.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .server.cpmstar.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .server.cpmstar.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .server.cpmstar.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        media.gan-online.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .myroitracking.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .clicksor.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .clicksor.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .clicksor.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .clicksor.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .clicksor.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .media6degrees.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .media6degrees.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .media6degrees.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .media6degrees.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .statcounter.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ads.247activemedia.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adsrv1.admediate.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .eliteautotune.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .eliteautotune.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .eliteautotune.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.eliteautotune.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.eliteautotune.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.eliteautotune.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.eliteautotune.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.eliteautotune.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.eliteautotune.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.eliteautotune.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .interclick.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .lucidmedia.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .interclick.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .interclick.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .im.banner.t-online.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ad.adnet.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .content.yieldmanager.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zanox.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zedo.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adxpose.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .stats.ilivid.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zedo.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .zedo.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .fastclick.net [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.zanox.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.zanox.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        rts.pgmediaserve.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        rts.pgmediaserve.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        rts.pgmediaserve.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .de.partypoker.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .de.partypoker.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .de.partypoker.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .de.partypoker.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .de.partypoker.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adbrite.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adbrite.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .imrworldwide.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .imrworldwide.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        www.counterstatistik.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad2.adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        track.adform.net [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        track.adform.net [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adform.net [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .lfstmedia.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .lfstmedia.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .lfstmedia.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .lfstmedia.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        tracking.mlsat02.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .bs.serving-sys.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .mediaplex.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad1.adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .ad.adnet.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .traffictrack.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .im.banner.t-online.de [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adviva.net [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad3.adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adultcyberfun.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        delivery.ibanner.de [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        ia.media-imdb.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        imagesrv.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        media.kyte.tv [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        media.mtvnservices.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        media.onsugar.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        media.whosay.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        media1.shufuni.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        media8.onsugar.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        msnbcmedia.msn.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        s0.2mdn.net [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        secure-us.imrworldwide.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        tracking.deal69.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        www.99counters.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        www.adservercentral.info [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        wwwstatic.megaporn.com [ C:\USERS\JENNY\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\2ZAWBEY8 ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JENNY@SERVING-SYS[2].TXT [ /SERVING-SYS ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JENNY@VDWP.SOLUTION.WEBORAMA[2].TXT [ /VDWP.SOLUTION.WEBORAMA ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JENNY@REVSCI[2].TXT [ /REVSCI ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JENNY@MEDIAPLEX[2].TXT [ /MEDIAPLEX ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JENNY@SMARTADSERVER[1].TXT [ /SMARTADSERVER ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JENNY@APMEBF[1].TXT [ /APMEBF ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JENNY@ATDMT[2].TXT [ /ATDMT ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JENNY@ATDMT[3].TXT [ /ATDMT ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JENNY@ATDMT[4].TXT [ /ATDMT ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\JENNY@ADX.CHIP[2].TXT [ /ADX.CHIP ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@TRAFFICTRACK[2].TXT [ /TRAFFICTRACK ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@ADS2.IT-POLAND[1].TXT [ /ADS2.IT-POLAND ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@ETARGETNET[1].TXT [ /ETARGETNET ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@ZANOX[1].TXT [ /ZANOX ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@AD2.ADFARM1.ADITION[2].TXT [ /AD2.ADFARM1.ADITION ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@ADFARM1.ADITION[2].TXT [ /ADFARM1.ADITION ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@STATCOUNTER[2].TXT [ /STATCOUNTER ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@A.REVENUEMAX[1].TXT [ /A.REVENUEMAX ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@CONTENT.YIELDMANAGER[3].TXT [ /CONTENT.YIELDMANAGER ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@CONTENT.YIELDMANAGER[1].TXT [ /CONTENT.YIELDMANAGER ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@ATDMT[1].TXT [ /ATDMT ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@WEBMASTERPLAN[2].TXT [ /WEBMASTERPLAN ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@TRADEDOUBLER[1].TXT [ /TRADEDOUBLER ]
        C:\USERS\JENNY\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\JENNY@ADTECH[1].TXT [ /ADTECH ]
        in.getclicky.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .getclicky.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .static.getclicky.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        adsrv1.admediate.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        stats.internet-yadro.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adultfriendfinder.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        stats.kroogy.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        stats.kroogy.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .www.traffictrack.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tto2.traffictrack.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .xm.xtendmedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        tracking.klicktel.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        tracking.klicktel.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www9.addfreestats.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .rambler.ru [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.adserver01.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .realmedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adcentriconline.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .openstat.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.digital-eliteboard.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.digital-eliteboard.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtechus.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adserver.adtechus.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .bravenet.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .clickaider.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .pubads.g.doubleclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        us.2.cqcounter.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ads.247activemedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .celebrity-sunglasses-finder.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .linksynergy.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .linksynergy.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .linksynergy.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .linksynergy.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        wstat.wibiya.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ads.rokatraffic.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .stats.complex.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .stats.complex.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .mediabrandsww.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .atomicwarez.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .cdn.atomicwarez.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        counter.hitslink.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .trafficmp.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .trafficmp.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .trafficmp.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        s1.trafficmaxx.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        rgadvert.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .yieldmanager.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .c.gigcount.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .modepilot.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .modepilot.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ibanner.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .media.photobucket.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adxpose.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        warezleech.org [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        warezleech.org [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .pornmap.tv [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .aim4media.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .countomat.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .pro-market.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        tracking.dc-storm.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        adserver.vistery.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adserver.gs [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.ontoplist.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .warezcz.cz [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .warezcz.cz [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .warezcz.cz [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .warezcz.cz [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        upvalue1.easymedia-adserver.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        adservercentral.info [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        tracking.sim-technik.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        f.blogads.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .elitepartner.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.elitepartner.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ads.adxvalue.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tracking.deal69.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .usenext.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tacoda.at.atwola.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .chitika.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        adserver.adreactor.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .sevenoneintermedia.112.2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .112.2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .122.2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .122.2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .snapfish.112.2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .iscout24.112.2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .germanwings.112.2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .beiersdorf.122.2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .nike.112.2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .msnportal.112.2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tns-counter.ru [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        advert.istanbul.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        dc.tremormedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        adserv.kwick.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        adserv.kwick.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        adserver2.clipkit.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .estat.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .burstnet.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.mediamarkt.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .mediamarkt.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wgmiwpd5ecp.stats.esomniture.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        testdata.coremetrics.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .atrack.allposters.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .viewablemedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        keyword-advertising.gmx.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        adserver.kauperts.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        adserver.kauperts.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .mmotraffic.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .mmotraffic.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        tracking.gameforge.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .dyntracker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .azjmp.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .azjmp.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .www.burstnet.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .gostats.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .aim4media.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .aim4media.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aeloqkcpseo.stats.esomniture.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aemiohdzacp.stats.esomniture.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ad-emea.doubleclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aelyopd5klo.stats.esomniture.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wdkoaoczeao.stats.esomniture.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wjmyugcpagq.stats.esomniture.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .burstnet.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wgl4ohdjsko.stats.esomniture.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        clicks.stylefruits.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .gostats.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .f.megaclick.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .f.megaclick.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .f.megaclick.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .megaclick.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .de.partypoker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        media.gan-online.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        www.counterstatistik.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        rts.pgmediaserve.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .server.cpmstar.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
        ad.velmedia.net [ C:\USERS\JENNY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YXFCBWVH.DEFAULT\COOKIES.SQLITE ]
ESET

Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=d9ef1d72dcfe674f9e1aeb0196b23913
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-11 08:58:57
# local_time=2012-01-11 09:58:57 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1797 16775165 100 100 26711 101825879 79961 0
# compatibility_mode=5892 16776573 100 100 4409 163843300 0 0
# compatibility_mode=8192 67108863 100 0 3918 3918 0 0
# scanned=144022
# found=2
# cleaned=0
# scan_time=4965
C:\Users\Jenny\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\eBay.lnk        Win32/Adware.ADON Anwendung (Säubern nicht möglich)        00000000000000000000000000000000        I
C:\Users\Jenny\AppData\Roaming\Microsoft\Windows\Start Menu\eBay.lnk        Win32/Adware.ADON Anwendung (Säubern nicht möglich)        00000000000000000000000000000000        I
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=d9ef1d72dcfe674f9e1aeb0196b23913
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-18 08:26:17
# local_time=2012-01-18 09:26:17 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1797 16775165 100 100 94758 102426239 1271 0
# compatibility_mode=5892 16776573 100 100 15565 164443660 0 0
# compatibility_mode=8192 67108863 100 0 604278 604278 0 0
# scanned=140570
# found=2
# cleaned=0
# scan_time=7445
C:\Users\Jenny\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\eBay.lnk        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Jenny\AppData\Roaming\Microsoft\Windows\Start Menu\eBay.lnk        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I

cosinus 18.01.2012 21:51
Sieht ok aus, da wurden nur Cookies gefunden. Die können weg.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Noch Probleme oder weitere Funde in der Zwischenzeit?

Sunshine_Mel 18.01.2012 22:11
Zitat:
Zitat von cosinus (Beitrag 756969)
Sieht ok aus, da wurden nur Cookies gefunden. Die können weg.

Noch Probleme oder weitere Funde in der Zwischenzeit?
Hab ich mir gedacht, hab die Cookies und Browserverlauf gelöscht.

Ich würde jetzt mal im normalen Konto alles testen und nochmal Bescheid geben.

Meinste denn, das wir dann durch sind???

Sunshine_Mel 18.01.2012 22:31
Bin jetzt in das normale Benutzerkonto gegangen (vorher Admin).

Es erscheint noch immer www.conduit.de als Startseite, statt Google ...

kurz danach ist der Rechner immer abgeschmiert! Ging bisher aber seit juten 10 Minuten gut.

Macht es denn einen Unterschied in welchem Benutzerkonto ich bin?!

Ich habe jetzt Avast! Antivirus und Avira AntiVir drauf. Beißen die sich? Sollte ich eins runterkicken???

cosinus 19.01.2012 10:00
Zitat:
Ich habe jetzt Avast! Antivirus und Avira AntiVir drauf. Beißen die sich? Sollte ich eins runterkicken???
Sowas wie AntiVir und Avast sollte man niemals gleichzeitig verwenden. Die können sich gegenseitig das Handwerk legen, das System beeinträchtigen oder sich andersweitig gegenseitig behindern, zudem schaffst du nicht mehr Sicherheit indem mehr "Sicherheits"programme aus bunten Pappschachten oder aus Downloads und mit bunten Schirmchen daherkommen.

Umgehend eins der beiden deinstallieren. Mach danach ein neues OTL-Log (CustomScan) dann kann ich auch nochmal wegen dieser Conduit Startseite nachsehen

Sunshine_Mel 19.01.2012 15:06
Hi Arne,

Zitat:
Umgehend eins der beiden deinstallieren. Mach danach ein neues OTL-Log (CustomScan)
meinst du damit benutzerdefinierte Scans? Also das mit dem einfügen des Textes in das Feld?

Hab Antivir gelöscht.

cosinus 19.01.2012 16:45
Ja, so hab ich es geschrieben...

Sunshine_Mel 20.01.2012 17:53
Hi,

Code:
OTL logfile created on: 20.01.2012 17:10:49 - Run 11
OTL by OldTimer - Version 3.2.31.0    Folder = c:\Users\Jenny\Documents
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,50 Gb Available Physical Memory | 49,95% Memory free
6,20 Gb Paging File | 4,75 Gb Available in Paging File | 76,66% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 75,43 Gb Free Space | 50,61% Space Free | Partition Type: NTFS
Drive D: | 139,28 Gb Total Space | 138,99 Gb Free Space | 99,79% Space Free | Partition Type: NTFS
Drive F: | 23,17 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive H: | 978,73 Mb Total Space | 963,28 Mb Free Space | 98,42% Space Free | Partition Type: FAT
 
Computer Name: JENNY-PC | User Name: Jenny | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.18 22:54:28 | 000,247,968 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil11e_ActiveX.exe
PRC - [2012.01.06 15:08:24 | 000,584,192 | ---- | M] (OldTimer Tools) -- c:\Users\Jenny\Documents\OTL by Oldtimer.com
PRC - [2011.11.28 19:01:24 | 003,744,552 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.06.18 07:10:24 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll
MOD - [2009.10.23 17:01:58 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.11.28 19:01:23 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011.11.16 17:23:44 | 000,377,344 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- winhttp.dll -- (WinHttpAutoProxySvc)
SRV - [2011.08.12 00:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2008.03.18 05:27:11 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2007.10.03 06:53:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2007.08.08 09:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.11.28 18:53:53 | 000,435,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011.11.28 18:53:35 | 000,314,456 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011.11.28 18:52:19 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011.11.28 18:52:16 | 000,052,952 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011.11.28 18:52:07 | 000,055,128 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2011.11.28 18:51:50 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2011.07.22 17:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
DRV - [2011.07.12 22:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009.06.22 19:38:22 | 000,102,912 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009.06.22 19:26:04 | 000,100,736 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV - [2008.07.25 09:30:59 | 007,547,552 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.07.22 03:21:07 | 000,015,872 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008.07.08 11:32:51 | 001,050,656 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008.06.25 06:05:05 | 000,044,064 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2008.06.03 07:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2008.04.07 07:00:45 | 000,006,656 | ---- | M] (Generic) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CRFILTER.sys -- (CRFILTER)
DRV - [2008.04.06 03:56:08 | 000,908,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.04.01 08:13:57 | 001,807,744 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.03.21 05:12:59 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2007.07.24 20:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)
DRV - [2006.12.14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://alice.aol.de
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13"
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.12.1.16460
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=DVSV5&o=15012&locale=de_DE&apn_uid=0FF8B90C-46D2-41D3-B30C-1D961BBB9C8C&apn_ptnrs=U9&apn_sauid=1E724A9B-7BEF-4EC5-84A2-E595B6D1FC88&apn_dtid=&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\Jenny\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
 
 
[2009.07.25 20:08:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jenny\AppData\Roaming\mozilla\Extensions
[2012.01.07 20:31:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jenny\AppData\Roaming\mozilla\Firefox\Profiles\yxfcbwvh.default\extensions
[2010.06.29 19:59:41 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Jenny\AppData\Roaming\mozilla\Firefox\Profiles\yxfcbwvh.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.12.07 11:20:40 | 000,000,000 | ---D | M] (Zynga Community Toolbar) -- C:\Users\Jenny\AppData\Roaming\mozilla\Firefox\Profiles\yxfcbwvh.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2011.11.13 11:33:43 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Jenny\AppData\Roaming\mozilla\Firefox\Profiles\yxfcbwvh.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009.07.25 20:16:40 | 000,000,000 | ---D | M] (Microsoft Choice Guard) -- C:\Users\Jenny\AppData\Roaming\mozilla\Firefox\Profiles\yxfcbwvh.default\extensions\ChoiceGuard@Microsoft
[2011.11.10 14:38:07 | 000,002,392 | ---- | M] () -- C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\yxfcbwvh.default\searchplugins\askcom.xml
[2010.07.27 09:34:32 | 000,000,873 | ---- | M] () -- C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\yxfcbwvh.default\searchplugins\conduit.xml
[2012.01.06 15:06:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2011.10.14 21:10:45 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.63\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\16.0.912.63\pdf.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Jenny\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.8013_0\npSkypeChromePlugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa2\npPicasa2.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa2\npPicasa3.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Users\Jenny\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\Jenny\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: Google-Suche = C:\Users\Jenny\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\
CHR - Extension: Skype Click to Call = C:\Users\Jenny\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\
CHR - Extension: Google Mail = C:\Users\Jenny\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.4_0\
 
O1 HOSTS File: ([2012.01.13 17:50:11 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [EPSON Stylus SX200 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE (SEIKO EPSON CORPORATION)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{519FCBD7-0111-42B0-836E-4CC3EE2C5515}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{75546297-CFB9-400E-AA66-A02D5961D71A}: DhcpNameServer = 192.168.2.1 213.191.74.18 62.109.123.196
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{98775085-DEC1-485E-AFC6-C036886F94EB}: NameServer = 212.23.115.148 212.23.97.2
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\Jenny\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Jenny\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O29 - HKLM SecurityProviders - (credssp.dll) -credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.01.21 10:22:18 | 000,126,976 | R--- | M] (Huawei Technologies Co., Ltd.) - F:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2007.11.18 08:41:52 | 000,000,047 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{0522bd83-3860-11e1-9c81-bc753ffa179f}\Shell - "" = AutoRun
O33 - MountPoints2\{0522bd83-3860-11e1-9c81-bc753ffa179f}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2009.01.21 10:22:18 | 000,126,976 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{2c288ccb-1e66-11df-8278-cf74a34c7197}\Shell - "" = AutoRun
O33 - MountPoints2\{2c288ccb-1e66-11df-8278-cf74a34c7197}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\Shell - "" = AutoRun
O33 - MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{717a3fe8-a5f8-11df-bd94-b84a205b6b74}\Shell - "" = AutoRun
O33 - MountPoints2\{717a3fe8-a5f8-11df-bd94-b84a205b6b74}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2009.01.21 10:22:18 | 000,126,976 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{717a4756-a5f8-11df-bd94-a3df5854563d}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\CAROLIN.exE
O33 - MountPoints2\{82ff6fb0-ff20-11de-b969-832dd93b968d}\Shell\AutoRun\command - "" = F:\Menu.exe
O33 - MountPoints2\{88406cd6-7183-11e0-b94d-c369c17efa92}\Shell - "" = AutoRun
O33 - MountPoints2\{88406cd6-7183-11e0-b94d-c369c17efa92}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{d27f6fd7-416c-11df-be2b-cf23b323d028}\Shell\AutoRun\command - "" = F:\pccompanion\Startme.exe
O33 - MountPoints2\{d27f6fd7-416c-11df-be2b-cf23b323d028}\Shell\menu1\command - "" = F:\pccompanion\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: ASUS Camera ScreenSaver - hkey= - key= - C:\Windows\AsScrProlog.exe ()
MsConfig - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)
MsConfig - StartUpReg: ATKOSD2 - hkey= - key= - C:\Program Files\ATKOSD2\ATKOSD2.exe ()
MsConfig - StartUpReg: avgnt - hkey= - key= -  File not found
MsConfig - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MsConfig - StartUpReg: ehTray.exe - hkey= - key= - C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
MsConfig - StartUpReg: EPSON Stylus SX200 Series - hkey= - key= -  File not found
MsConfig - StartUpReg: Google Desktop Search - hkey= - key= -  File not found
MsConfig - StartUpReg: HControlUser - hkey= - key= - C:\Program Files\ATK Hotkey\HcontrolUser.exe ()
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: LightScribe Control Panel - hkey= - key= - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig - StartUpReg: NSSInstallation - hkey= - key= - C:\Program Files\DivX\Symantec\scstubinstaller.exe (Symantec Corporation)
MsConfig - StartUpReg: NvCplDaemon - hkey= - key= -  File not found
MsConfig - StartUpReg: NvMediaCenter - hkey= - key= -  File not found
MsConfig - StartUpReg: P2Go_Menu - hkey= - key= - C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: RtHDVCpl - hkey= - key= - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
MsConfig - StartUpReg: Sidebar - hkey= - key= - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
MsConfig - StartUpReg: Skytel - hkey= - key= - C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: SynTPStart - hkey= - key= - C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
MsConfig - StartUpReg: WindowsWelcomeCenter - hkey= - key= -  File not found
MsConfig - State: "startup" - 2
 
SafeBootMin: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SafeBootMin: AppMgmt -  File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SafeBootNet: AppMgmt -  File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\System32\Microsoft
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - C:\Windows\System32\Microsoft
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: aux - wdmaud.drv (Microsoft Corporation)
Drivers32: midi - wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - midimap.dll (Microsoft Corporation)
Drivers32: mixer - wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - VfWWDM32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - DivX.dll (DivX, Inc.)
Drivers32: vidc.i420 - iyuv_32.dll (Microsoft Corporation)
Drivers32: VIDC.IYUV - iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - DivX.dll (DivX, Inc.)
Drivers32: VIDC.YVU9 - tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - msyuv.dll (Microsoft Corporation)
Drivers32: wave - wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - serwvdrv.dll (Microsoft Corporation)
Drivers32: wavemapper - msacm32.drv (Microsoft Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.18 16:03:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012.01.18 16:03:25 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012.01.18 14:34:27 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012.01.17 16:45:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2012.01.17 16:45:08 | 000,314,456 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2012.01.17 16:45:08 | 000,020,568 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2012.01.17 16:45:04 | 000,034,392 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2012.01.17 16:45:03 | 000,052,952 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2012.01.17 16:45:02 | 000,435,032 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2012.01.17 16:45:01 | 000,055,128 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2012.01.17 16:43:48 | 000,041,184 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.01.17 16:43:47 | 000,199,816 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2012.01.17 16:43:22 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2012.01.17 16:43:22 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012.01.15 16:07:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.01.15 16:07:29 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.01.15 15:55:35 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012.01.13 17:57:23 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.01.13 17:52:12 | 000,000,000 | ---D | C] -- C:\Users\Jenny\AppData\Local\temp
[2012.01.13 17:51:40 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.01.13 17:41:16 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.01.13 17:41:16 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.01.13 17:41:16 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.01.13 17:41:07 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.01.13 17:41:05 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012.01.13 17:40:56 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.01.12 21:49:21 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.01.09 21:41:41 | 000,000,000 | ---D | C] -- C:\Users\Jenny\AppData\Roaming\Malwarebytes
[2012.01.09 21:40:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.01.09 21:40:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.01.09 21:40:57 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.01.09 21:40:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.01.08 17:29:55 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Jenny\Documents\OTL by Oldtimer.com
[2012.01.07 20:37:27 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.01.06 14:11:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Partner
[2012.01.06 14:11:34 | 000,112,128 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbnet.sys
[2012.01.06 14:11:34 | 000,102,912 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbmdm.sys
[2012.01.06 14:11:34 | 000,100,736 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbdev.sys
[2012.01.06 14:11:34 | 000,023,424 | ---- | C] (Huawei Tech. Co., Ltd.) -- C:\Windows\System32\drivers\ewdcsc.sys
[2012.01.06 14:11:09 | 000,000,000 | ---D | C] -- C:\Program Files\Mobile Partner
[2008.06.03 07:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.20 16:54:29 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.01.20 16:54:29 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.01.20 16:54:29 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.01.20 16:54:29 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.20 15:49:41 | 000,084,229 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.01.20 15:49:07 | 000,005,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.20 15:49:07 | 000,005,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.20 15:48:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.20 15:48:52 | 3220,267,008 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.19 14:46:03 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2012.01.18 16:03:31 | 000,001,807 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.01.18 14:35:16 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012.01.17 15:56:24 | 273,079,766 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.01.15 16:07:40 | 000,000,825 | ---- | M] () -- C:\Users\Public\Desktop\WinRAR.lnk
[2012.01.13 17:50:11 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.01.10 21:30:23 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2012.01.10 19:16:16 | 000,084,229 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.01.09 21:40:59 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.09 20:41:32 | 000,014,336 | ---- | M] () -- C:\Users\Jenny\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.01.08 17:30:53 | 000,000,000 | ---- | M] () -- C:\Users\Jenny\defogger_reenable
[2012.01.07 20:51:24 | 000,302,592 | ---- | M] () -- C:\Users\Jenny\Documents\GMER 1.0.15.15641.exe
[2012.01.07 20:47:12 | 000,050,477 | ---- | M] () -- C:\Users\Jenny\Documents\Defogger.exe
[2012.01.06 19:06:50 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012.01.06 19:06:50 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2012.01.06 15:08:24 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Jenny\Documents\OTL by Oldtimer.com
[2012.01.06 14:11:38 | 000,000,883 | ---- | M] () -- C:\Users\Public\Desktop\Mobile Partner.lnk
[2012.01.03 20:28:33 | 000,001,356 | ---- | M] () -- C:\Users\Jenny\AppData\Local\d3d9caps.dat
 
========== Files Created - No Company Name ==========
 
[2012.01.18 16:03:31 | 000,001,807 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.01.15 16:07:40 | 000,000,825 | ---- | C] () -- C:\Users\Public\Desktop\WinRAR.lnk
[2012.01.13 17:41:16 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.01.13 17:41:16 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.01.13 17:41:16 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.01.13 17:41:16 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.01.13 17:41:16 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.01.11 20:22:05 | 3220,267,008 | -HS- | C] () -- C:\hiberfil.sys
[2012.01.10 21:30:23 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012.01.09 21:40:59 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.08 17:30:53 | 000,000,000 | ---- | C] () -- C:\Users\Jenny\defogger_reenable
[2012.01.08 17:29:47 | 000,302,592 | ---- | C] () -- C:\Users\Jenny\Documents\GMER 1.0.15.15641.exe
[2012.01.08 17:29:17 | 000,050,477 | ---- | C] () -- C:\Users\Jenny\Documents\Defogger.exe
[2012.01.07 20:37:22 | 273,079,766 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.01.06 19:06:50 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2012.01.06 19:06:50 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2012.01.06 14:11:38 | 000,000,883 | ---- | C] () -- C:\Users\Public\Desktop\Mobile Partner.lnk
[2011.05.19 21:39:02 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.02.06 00:51:53 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2009.10.24 15:21:08 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat
[2009.10.24 15:21:08 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat
[2009.10.24 15:21:08 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat
[2009.10.24 15:21:08 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat
[2009.10.24 15:21:08 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat
[2009.10.24 15:21:08 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat
[2009.10.24 15:21:08 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat
[2009.10.24 15:21:08 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat
[2009.10.24 15:21:08 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat
[2009.10.24 15:21:08 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat
[2009.10.24 15:21:08 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2009.10.24 15:21:07 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat
[2009.10.24 15:21:07 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat
[2009.10.24 15:21:07 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat
[2009.10.24 15:21:07 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat
[2009.10.24 15:21:07 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat
[2009.10.24 15:21:07 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat
[2009.10.24 15:21:07 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat
[2009.10.24 15:21:07 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat
[2009.10.24 15:15:31 | 000,000,025 | ---- | C] () -- C:\Windows\CDE SX200DEFGIPS.ini
[2009.10.09 14:07:18 | 000,001,356 | ---- | C] () -- C:\Users\Jenny\AppData\Local\d3d9caps.dat
[2009.08.22 16:03:48 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.22 16:03:48 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.08.15 11:50:04 | 000,014,336 | ---- | C] () -- C:\Users\Jenny\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.07.23 00:21:22 | 000,084,229 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.07.23 00:16:28 | 000,084,229 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2008.11.11 00:58:11 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe
[2008.11.11 00:53:57 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe
[2008.11.11 00:39:22 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2008.11.10 23:39:50 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.04.16 12:11:34 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.04.16 12:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.04.16 12:11:34 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.04.16 12:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2008.04.16 11:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini
[2008.04.07 07:00:45 | 000,005,120 | ---- | C] () -- C:\Windows\System32\CRFILTER.dll
[2008.04.01 08:13:57 | 001,807,744 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2007.05.09 08:16:39 | 000,028,160 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,371,416 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.03.09 03:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
 
========== LOP Check ==========
 
[2012.01.07 20:31:19 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\DVDVideoSoft
[2011.07.20 14:30:30 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.06.01 12:46:29 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\EPSON
[2010.04.27 13:10:36 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Facebook
[2009.11.10 20:02:56 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\TeamViewer
[2012.01.19 16:01:50 | 000,032,588 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2009.11.10 19:58:54 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Adobe
[2011.03.22 21:42:21 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Apple Computer
[2009.11.04 16:56:32 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\CyberLink
[2010.06.28 12:48:12 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\DivX
[2012.01.07 20:31:19 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\DVDVideoSoft
[2011.07.20 14:30:30 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.06.01 12:46:29 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\EPSON
[2010.04.27 13:10:36 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Facebook
[2009.07.25 19:59:11 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Google
[2009.07.25 19:21:39 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Identities
[2009.10.24 15:21:05 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\InstallShield
[2009.07.25 19:22:41 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Macromedia
[2012.01.09 21:41:41 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Malwarebytes
[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Media Center Programs
[2010.02.28 15:54:29 | 000,000,000 | --SD | M] -- C:\Users\Jenny\AppData\Roaming\Microsoft
[2009.07.25 20:08:52 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Mozilla
[2011.11.15 00:16:46 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Skype
[2011.07.30 12:27:41 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\skypePM
[2009.07.25 19:23:04 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Symantec
[2009.11.10 20:02:56 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\TeamViewer
[2011.05.01 21:33:06 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\U3
[2011.04.27 21:27:33 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\vlc
 
< %APPDATA%\*.exe /s >
[2010.04.27 13:10:36 | 000,050,354 | ---- | M] (Facebook, Inc.) -- C:\Users\Jenny\AppData\Roaming\Facebook\uninstall.exe
[2007.10.23 08:27:20 | 000,110,592 | ---- | M] () -- C:\Users\Jenny\AppData\Roaming\U3\temp\cleanup.exe
[2008.05.02 09:41:48 | 003,493,888 | -H-- | M] (SanDisk Corporation) -- C:\Users\Jenny\AppData\Roaming\U3\temp\Launchpad Removal.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\ERDNT\cache\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\ERDNT\cache\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\ERDNT\cache\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\ERDNT\cache\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\ERDNT\cache\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\ERDNT\cache\wininit.exe
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
Das mit der Startseite scheint sich erledigt zu haben, jetzt kommt google als Startseite.

cosinus 20.01.2012 22:48
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://alice.aol.de
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT2269050&SearchSource=13"
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.12.1.16460
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=DVSV5&o=15012&locale=de_DE&apn_uid=0FF8B90C-46D2-41D3-B30C-1D961BBB9C8C&apn_ptnrs=U9&apn_sauid=1E724A9B-7BEF-4EC5-84A2-E595B6D1FC88&apn_dtid=&q="
[2011.11.10 14:38:07 | 000,002,392 | ---- | M] () -- C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\yxfcbwvh.default\searchplugins\askcom.xml
[2010.07.27 09:34:32 | 000,000,873 | ---- | M] () -- C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\yxfcbwvh.default\searchplugins\conduit.xml
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.01.21 10:22:18 | 000,126,976 | R--- | M] (Huawei Technologies Co., Ltd.) - F:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2007.11.18 08:41:52 | 000,000,047 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{0522bd83-3860-11e1-9c81-bc753ffa179f}\Shell - "" = AutoRun
O33 - MountPoints2\{0522bd83-3860-11e1-9c81-bc753ffa179f}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2009.01.21 10:22:18 | 000,126,976 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{2c288ccb-1e66-11df-8278-cf74a34c7197}\Shell - "" = AutoRun
O33 - MountPoints2\{2c288ccb-1e66-11df-8278-cf74a34c7197}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\Shell - "" = AutoRun
O33 - MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{717a3fe8-a5f8-11df-bd94-b84a205b6b74}\Shell - "" = AutoRun
O33 - MountPoints2\{717a3fe8-a5f8-11df-bd94-b84a205b6b74}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2009.01.21 10:22:18 | 000,126,976 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{717a4756-a5f8-11df-bd94-a3df5854563d}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\CAROLIN.exE
O33 - MountPoints2\{82ff6fb0-ff20-11de-b969-832dd93b968d}\Shell\AutoRun\command - "" = F:\Menu.exe
O33 - MountPoints2\{88406cd6-7183-11e0-b94d-c369c17efa92}\Shell - "" = AutoRun
O33 - MountPoints2\{88406cd6-7183-11e0-b94d-c369c17efa92}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{d27f6fd7-416c-11df-be2b-cf23b323d028}\Shell\AutoRun\command - "" = F:\pccompanion\Startme.exe
O33 - MountPoints2\{d27f6fd7-416c-11df-be2b-cf23b323d028}\Shell\menu1\command - "" = F:\pccompanion\Startme.exe
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Sunshine_Mel 20.01.2012 23:22
Nabend,

OTL wurde mittendrin geschlossen/abgebrochen. Laut Windows konnte Programm nicht richtig ausgeführt und muss geschlossen werden.

Der Bildschirm zeigt nichts mehr ausser das Hintergrundbild. Ich kann keine Programme öffnen und ihn nicht runterfahren (ich schreibe über anderen Rechner).

Was nun? :confused::confused::confused:

cosinus 23.01.2012 09:30
Rechner neu starten und den Fix wiederholen, ggf im abgesicherten Modus

Sunshine_Mel 27.01.2012 15:37
Zitat:
Zitat von cosinus (Beitrag 758827)
Rechner neu starten und den Fix wiederholen, ggf im abgesicherten Modus
Ich komm nicht in den abgesicherten Modus und wenn er ohne hochfährt, läd er Windows anscheinend nicht. Es kommt wieder nur das Hinergrundbild. Kein Desktop, keine Icons und ins Windowsmenü komm ich auch nicht. :heulen::heulen::heulen:

Code:
Can not open file C:\Recovery.dat. ERROR

cosinus 27.01.2012 15:47
Ausprobieren:


Abgesicherter Modus zur Bereinigung
  • Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
  • Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

    Windows im abgesicherten Modusstarten

Sunshine_Mel 27.01.2012 16:05
nach dem 4. Mal hat es endlich geklappt. ... :killpc:

Nun nochmal OTL Costum durchlaufen lassen?

Fullquote entfernt //cosinus

cosinus 27.01.2012 16:17
Ja, da den Fix ausführen. Und unterlasse die nervigen Fullquotes bitte! :pfui:

Sunshine_Mel 27.01.2012 16:37
Fix wurde vollständig ausgeführt. Logfile kam nicht, da ich sofort neustarten musste.

Beim Neustart kommt er nicht über den schwarzen Bildschirm mit dem Markenlogo hinaus. Im Hintergrund höre ich ca. alle 3 Minuten den Ton, als wäre Windows gestartet, aber es passiert leider gar nichts.

Laptop zum runterfahren gezwungen, im abgesicherten Modus mit Netzwerk wieder hochgefahren

Code:
All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "Ask.com" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13" removed from browser.startup.homepage
Prefs.js: toolbar@ask.com:3.12.1.16460 removed from extensions.enabledItems
Prefs.js: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=DVSV5&o=15012&locale=de_DE&apn_uid=0FF8B90C-46D2-41D3-B30C-1D961BBB9C8C&apn_ptnrs=U9&apn_sauid=1E724A9B-7BEF-4EC5-84A2-E595B6D1FC88&apn_dtid=&q=" removed from keyword.URL
File C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\yxfcbwvh.default\searchplugins\askcom.xml not found.
File C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\yxfcbwvh.default\searchplugins\conduit.xml not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{872B5B88-9DB5-4310-BDD0-AC189557E5F5} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File F:\AutoRun.exe not found.
File F:\AUTORUN.INF not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0522bd83-3860-11e1-9c81-bc753ffa179f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0522bd83-3860-11e1-9c81-bc753ffa179f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0522bd83-3860-11e1-9c81-bc753ffa179f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0522bd83-3860-11e1-9c81-bc753ffa179f}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c288ccb-1e66-11df-8278-cf74a34c7197}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c288ccb-1e66-11df-8278-cf74a34c7197}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c288ccb-1e66-11df-8278-cf74a34c7197}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c288ccb-1e66-11df-8278-cf74a34c7197}\ not found.
File F:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33058186-3ba9-11e1-a0a1-98196e7d17cf}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{717a3fe8-a5f8-11df-bd94-b84a205b6b74}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{717a3fe8-a5f8-11df-bd94-b84a205b6b74}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{717a3fe8-a5f8-11df-bd94-b84a205b6b74}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{717a3fe8-a5f8-11df-bd94-b84a205b6b74}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{717a4756-a5f8-11df-bd94-a3df5854563d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{717a4756-a5f8-11df-bd94-a3df5854563d}\ not found.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\CAROLIN.exE not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{82ff6fb0-ff20-11de-b969-832dd93b968d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82ff6fb0-ff20-11de-b969-832dd93b968d}\ not found.
File F:\Menu.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{88406cd6-7183-11e0-b94d-c369c17efa92}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88406cd6-7183-11e0-b94d-c369c17efa92}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{88406cd6-7183-11e0-b94d-c369c17efa92}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88406cd6-7183-11e0-b94d-c369c17efa92}\ not found.
File G:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d27f6fd7-416c-11df-be2b-cf23b323d028}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d27f6fd7-416c-11df-be2b-cf23b323d028}\ not found.
File F:\pccompanion\Startme.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d27f6fd7-416c-11df-be2b-cf23b323d028}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d27f6fd7-416c-11df-be2b-cf23b323d028}\ not found.
File F:\pccompanion\Startme.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Jenny
->Temp folder emptied: 31832 bytes
->Temporary Internet Files folder emptied: 28634827 bytes
->FireFox cache emptied: 147208128 bytes
->Google Chrome cache emptied: 856432 bytes
->Flash cache emptied: 65298 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1710442 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 170,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 01272012_162701

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\MpCmdRun-5B-421CFC91-A93E-42AB-A35C-F06F127FCC44.lock not found!
C:\Windows\temp\MpCmdRun.log moved successfully.
File\Folder C:\Windows\temp\TMP000000018B0D46A279BD4532 not found!

Registry entries deleted on Reboot...

cosinus 27.01.2012 23:39
Ich vermisse einen Status um deinen Rechner.
Wenn du das nicht machst wäre eine Neuinstallation sinnvoller gewesen

Sunshine_Mel 28.01.2012 10:08
Ich weiss leider nicht genau was du mit dem fehlenden Status meinst ...

Aktuell fährt er nur im abgesicherten Modus mit Netzwerktreibern hoch.

Was ärgerlich ist, da wir ja eigentlich fertig waren, und OTL das ganze jetzt ausgelöst hat :heulen::heulen::heulen:

cosinus 29.01.2012 18:32
Ich weiß nicht was die Ursache dafür ist, dass dein Rechner nicht mehr im normalen Modus gochfahrt. Scheint ja seit dem OTL auf deinem Rechner abgestürzt ist nicht mehr zu funktionieren.

Der normale Modus fährt zwar hoch aber du hast keinen Desktop? Auch mit einem anderen Windows-Benutzer nicht?

Sunshine_Mel 30.01.2012 19:44
Nein er fährt im normalen Modus gar nicht hoch. Komm nicht mal zur Kontenauswahl.

Nur im abgesicherten Modus. Da wollte ich es mit Systemwiederherstellung versuchen, konnte den Wiederherstellungspunkt vor OTL setzen, allerdings fährt er nach dem Neustart wieder nicht hoch.

Was mach ich nun?
Kann ich den Rechner platt machen jedoch mit einer anderen Recovery-CD? Für den "befallenden" Laptop hab ich keine Recovery, nur für meinen eigenen.

Sunshine_Mel 30.01.2012 21:07
HEY ARNE,

hab es geschafft. Keine Ahnung wie, aber ick bin drin.
Ich würde den Rechner gerne überprüfen, ob es jetzt wirklich an OTL lag. Womit mach ich das am Besten bzw was rätst du mir zu tun?

cosinus 30.01.2012 22:12
Mach erstmal wieder zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Sunshine_Mel 03.02.2012 17:12
Hallo Arne,

leider hab ich mich zu früh gefreut.
Ich kriege den Rechner nur über F8 in den abgesicherten Modus hochgefahren.

Bin leider ratlos, was kann ich noch tun, damit er wieder normal funktioniert?

cosinus 04.02.2012 13:32
Ich denke dein System ist so wackelig, dass eine Neuinstallation wohl das sinnvollste wäre :pfeiff:

Sunshine_Mel 04.02.2012 17:55
Ärgerlich, weil ich es dann auch gleich vor 4 Wochen hätte machen können.

Naja was soll´s, hab mit sowas gerechnet :killpc:

Aber immerhin hatten wir den Trojaner runter bekommen ;-)

Danke für die Hilfe


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:05 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131