Trojaner-Board - Ordner auf Wechseldatenträger sind nur noch Verknüpfungen

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Ordner auf Wechseldatenträger sind nur noch Verknüpfungen (https://www.trojaner-board.de/111503-ordner-wechseldatentraeger-nur-noch-verknuepfungen.html)

Ordner auf Wechseldatenträger sind nur noch Verknüpfungen

Hallo Trojaner-Board-Team,

seitdem ich vor einigen Tagen meinen USB-Stick auf einem fremden Rechner verwendet habe, funktioniert dieser nicht mehr normal. Alle Ordner werden nur noch als Verknüpfung angezeigt, einige davon sowie die meisten Daten lassen sich dabei gar nicht mehr öffnen.
Als Zielort der Verknüpfungen wird immer "system32" bzw. für z.B. den Ordner "EWL" das Ziel: %windir%\system32\cmd.exe /c "start %cd%RECYCLER\e621ca05.exe &&%windir%\explorer.exe %cd%EWL angegeben.

Als Antivirus-Software verwende ich die kostenlose Version von Avira AntiVir Personal. Ein Scan des kompletten PCs, sowie des betroffenen Wechseldatenträger führte allerdings zu keinem Ergebnis.
Ich habe in diesem Forum bereits einige Themen zu diesem Problem gefunden und wollte dementsprechen auch Malewarebytes mit dem entsprechenden Link von euch installieren, allerdings funktioniert der Download nicht. Ich werde immer auf eine Seite mit folgender Fehlermeldung weitergeleitet:

"Die Seite store.malwarebytes.org wurde nicht gefunden.
Möglicherweise ist die Internet-Adresse (URL) nicht korrekt."

Ich hoffe ihr könnt mir helfen, leider habe ich einige wirklich wichtige Daten auf dem USB-Stick und wäre sehr froh, wenn diese nicht vollständig weg sind.
Vielen Dank für eure Hilfe, Grüße Nicole

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hallo Cosinus,

danke für die schnelle Antwort, habe den Scan durchlaufen lassen (der betroffene USB-Stick war dabei angeschlossen) und folgende log-Datei erhalten:

OTL.Txt

Code:

OTL logfile created on: 17.03.2012 19:32:03 - Run 1

OTL by OldTimer - Version 3.2.39.1     Folder = C:\Users\Nicole\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1013,44 Mb Total Physical Memory | 391,30 Mb Available Physical Memory | 38,61% Memory free

2,24 Gb Paging File | 1,16 Gb Available in Paging File | 51,74% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 54,62 Gb Total Space | 13,29 Gb Free Space | 24,34% Space Free | Partition Type: NTFS

Drive D: | 47,40 Gb Total Space | 32,55 Gb Free Space | 68,67% Space Free | Partition Type: NTFS

Drive E: | 457,20 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF

Drive F: | 7,49 Gb Total Space | 2,91 Gb Free Space | 38,89% Space Free | Partition Type: FAT32

 

Computer Name: NICOLEACER | User Name: Nicole | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.03.17 19:23:31 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\Nicole\Desktop\OTL.exe

PRC - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.07.03 20:10:43 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.03.28 15:15:17 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.03.28 15:15:04 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2011.03.28 15:14:56 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.12.10 17:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe

PRC - [2010.12.10 17:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe

PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.02.23 11:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

PRC - [2008.10.24 15:35:44 | 000,128,296 | ---- | M] () -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

PRC - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe

PRC - [2007.04.24 17:40:54 | 000,024,576 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe

PRC - [2007.04.24 15:48:22 | 000,163,840 | ---- | M] (acer) -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

PRC - [2007.04.17 19:36:34 | 000,131,072 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNet Service.exe

PRC - [2007.04.12 17:43:16 | 000,457,512 | ---- | M] (HiTRSUT) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe

PRC - [2007.04.12 17:42:26 | 000,457,728 | ---- | M] (HiTRUST) -- C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe

PRC - [2007.03.21 13:00:04 | 000,355,096 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2007.03.14 10:52:30 | 000,024,576 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe

PRC - [2007.02.13 06:26:50 | 000,053,248 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

PRC - [2006.11.24 12:57:54 | 000,107,008 | ---- | M] () -- C:\Acer\Mobility Center\MobilityService.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2007.04.12 17:40:04 | 000,028,672 | ---- | M] () -- C:\Windows\System32\BatchCrypto.dll

MOD - [2007.04.12 17:39:48 | 000,063,488 | ---- | M] () -- C:\Windows\System32\ShowErrMsg.dll

MOD - [2007.01.31 15:39:28 | 000,180,224 | ---- | M] () -- C:\Windows\System32\igfxTMM.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService)

SRV - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)

SRV - [2011.07.03 20:10:43 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.03.28 15:15:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2010.12.10 17:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)

SRV - [2010.12.10 17:29:30 | 029,293,408 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ)

SRV - [2010.12.10 17:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)

SRV - [2010.12.10 17:29:30 | 000,044,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)

SRV - [2009.02.23 11:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)

SRV - [2008.10.24 15:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)

SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2007.04.24 17:40:54 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)

SRV - [2007.04.24 15:48:22 | 000,163,840 | ---- | M] (acer) [Auto | Running] -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- (WMIService)

SRV - [2007.04.17 19:36:34 | 000,131,072 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eNet\eNet Service.exe -- (eNet Service)

SRV - [2007.04.12 17:43:16 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Running] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)

SRV - [2007.03.21 13:00:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

SRV - [2007.03.14 10:52:30 | 000,024,576 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe -- (eLockService)

SRV - [2007.02.13 06:26:50 | 000,053,248 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)

SRV - [2006.11.24 12:57:54 | 000,107,008 | ---- | M] () [Auto | Running] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)

SRV - [2006.10.26 13:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)

DRV - [2011.10.21 19:33:28 | 000,697,328 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV - [2011.07.03 20:10:45 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.07.03 20:10:45 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.06.17 14:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2007.04.30 06:45:18 | 002,219,520 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R)

DRV - [2007.03.02 18:19:34 | 000,076,584 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15)

DRV - [2007.01.24 23:44:06 | 000,290,304 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21)

DRV - [2006.11.29 01:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)

DRV - [2006.11.02 16:51:58 | 000,013,560 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Programme\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4c74-92FE-5B863F82066B})

DRV - [2006.11.02 08:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2006.11.02 08:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)

DRV - [2006.11.02 08:30:52 | 000,467,456 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/sp/*hxxp://de.yahoo.com

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\..\SearchScopes,DefaultScope = {A6645767-9D69-46A8-B0BE-72221A1A3216}

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\..\SearchScopes\{A6645767-9D69-46A8-B0BE-72221A1A3216}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.459

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94

FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.04.15 17:10:10 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.04.15 17:10:11 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.23 08:31:18 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.15 16:37:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.11.12 13:46:59 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

 

[2010.12.29 12:02:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nicole\AppData\Roaming\mozilla\Extensions

[2012.03.09 11:40:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nicole\AppData\Roaming\mozilla\Firefox\Profiles\d88wytyq.default\extensions

[2011.01.19 13:34:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Nicole\AppData\Roaming\mozilla\Firefox\Profiles\d88wytyq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.06.28 17:08:03 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Nicole\AppData\Roaming\mozilla\Firefox\Profiles\d88wytyq.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.02.27 09:38:57 | 000,000,933 | ---- | M] () -- C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\11-suche.xml

[2012.02.27 09:38:57 | 000,002,419 | ---- | M] () -- C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\englische-ergebnisse.xml

[2012.02.27 09:38:57 | 000,010,525 | ---- | M] () -- C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\gmx-suche.xml

[2012.02.27 09:38:57 | 000,002,457 | ---- | M] () -- C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\lastminute.xml

[2012.02.27 09:38:57 | 000,005,508 | ---- | M] () -- C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\webde-suche.xml

[2012.01.07 12:25:11 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

() (No name found) -- C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI

[2012.02.23 08:31:18 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.02.23 08:31:13 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.23 08:31:13 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.02.23 08:31:13 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.23 08:31:13 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.23 08:31:13 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.02.23 08:31:13 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)

O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O3 - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)

O4 - HKLM..\Run: [Acer Tour]  File not found

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)

O4 - HKLM..\Run: [eRecoveryService]  File not found

O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-906325586-3288372563-1108372128-1003..\Run: [Temqmj] C:\Users\Nicole\AppData\Roaming\Temqmj.exe (Piriform Ltd)

O8 - Extra context menu item: Free YouTube Download - C:\Users\Nicole\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Nicole\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{133E5250-77ED-44DC-AD84-7F04E33B430D}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AD661D68-B163-4039-8EFB-33D7F9E1C04F}: DhcpNameServer = 192.168.0.1

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (eNetHook.dll) - C:\Windows\System32\eNetHook.dll (acer)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg

O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe - (Acer Inc.)

MsConfig - StartUpReg: Acer Tour Reminder - hkey= - key= - C:\Acer\AcerTour\Reminder.exe (Acer Inc.)

MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: Comrade.exe - hkey= - key= - C:\Programme\GameSpy\Comrade\Comrade.exe (IGN Entertainment Inc.)

MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

MsConfig - StartUpReg: IAAnotif - hkey= - key= - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)

MsConfig - StartUpReg: LanguageShortcut - hkey= - key= - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()

MsConfig - StartUpReg: LManager - hkey= - key= - C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)

MsConfig - StartUpReg: RemoteControl - hkey= - key= - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)

MsConfig - StartUpReg: RtHDVCpl - hkey= - key= - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

MsConfig - StartUpReg: Skytel - hkey= - key= - C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig - StartUpReg: Temqmj - hkey= - key= - C:\Users\Nicole\AppData\Roaming\Temqmj.exe (Piriform Ltd)

MsConfig - StartUpReg: WMPNSCFG - hkey= - key= - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

MsConfig - State: "startup" - 2

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Shockwave Flash

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.03.17 19:22:55 | 000,594,432 | ---- | C] (OldTimer Tools) -- C:\Users\Nicole\Desktop\OTL.exe

[2012.03.17 19:21:34 | 000,139,264 | ---- | C] (Piriform Ltd) -- C:\Users\Nicole\AppData\Roaming\Temqmj.exe

[2012.03.13 19:25:10 | 000,000,000 | ---D | C] -- C:\Windows\pss

[2012.03.13 19:07:43 | 000,000,000 | ---D | C] -- C:\Users\Nicole\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD

[2012.03.13 09:11:31 | 000,000,000 | ---D | C] -- C:\Users\Nicole\Desktop\Neuer Ordner

[2012.03.04 14:13:54 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.03.01 17:00:41 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices

[2012.02.29 17:11:07 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES

[2012.02.29 17:11:07 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES

[2012.02.29 17:11:03 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN

[2012.02.21 14:04:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics

[2012.02.21 13:58:41 | 000,000,000 | ---D | C] -- C:\Program Files\SPSS19

[2012.02.17 09:50:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer

[2012.02.17 09:50:19 | 000,000,000 | ---D | C] -- C:\Program Files\Tracker Software

[3 C:\Users\Nicole\AppData\Roaming\*.tmp files -> C:\Users\Nicole\AppData\Roaming\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.03.17 19:31:30 | 000,681,718 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.03.17 19:31:30 | 000,138,096 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.03.17 19:31:29 | 000,732,162 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.03.17 19:31:29 | 000,170,176 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.03.17 19:23:31 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\Nicole\Desktop\OTL.exe

[2012.03.17 19:21:36 | 000,139,264 | ---- | M] (Piriform Ltd) -- C:\Users\Nicole\AppData\Roaming\Temqmj.exe

[2012.03.17 19:15:31 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.03.17 19:15:30 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.03.17 19:15:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.03.17 19:14:49 | 1063,444,480 | -HS- | M] () -- C:\hiberfil.sys

[2012.03.15 19:07:41 | 000,397,368 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.03.09 21:13:09 | 000,018,720 | ---- | M] () -- C:\Users\Nicole\Documents\so sweet.xspf

[2012.03.04 14:10:54 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat

[2012.03.04 14:10:54 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat

[2012.03.04 14:10:42 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf

[2012.03.01 16:49:57 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf

[2012.03.01 16:49:43 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf

[2012.02.29 10:08:42 | 010,052,026 | ---- | M] () -- C:\Users\Nicole\Desktop\Schwimmen_Training.pdf

[2012.02.21 13:58:12 | 000,000,219 | ---- | M] () -- C:\Windows\System32\lsprst7.tgz

[2012.02.21 13:58:12 | 000,000,205 | ---- | M] () -- C:\Windows\System32\lsprst7.dll

[2012.02.21 13:58:12 | 000,000,016 | -H-- | M] () -- C:\Windows\System32\servdat.slm

[3 C:\Users\Nicole\AppData\Roaming\*.tmp files -> C:\Users\Nicole\AppData\Roaming\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.03.09 21:13:08 | 000,018,720 | ---- | C] () -- C:\Users\Nicole\Documents\so sweet.xspf

[2012.03.04 14:10:42 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf

[2012.03.01 16:49:57 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf

[2012.03.01 16:49:43 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf

[2012.02.29 10:08:42 | 010,052,026 | ---- | C] () -- C:\Users\Nicole\Desktop\Schwimmen_Training.pdf

[2011.12.28 09:59:21 | 000,001,025 | ---- | C] () -- C:\Windows\System32\sysprs7.dll

[2011.12.28 09:59:21 | 000,000,205 | ---- | C] () -- C:\Windows\System32\lsprst7.dll

[2011.04.28 14:34:12 | 000,000,094 | ---- | C] () -- C:\Users\Nicole\AppData\Local\fusioncache.dat

[2011.02.15 11:39:07 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2011.02.15 11:39:07 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2011.02.15 10:21:58 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2010.12.29 13:05:39 | 000,017,408 | ---- | C] () -- C:\Users\Nicole\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.12.29 06:14:41 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1187.dll

[2010.12.29 06:14:40 | 000,180,224 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll

[2010.12.28 20:51:31 | 000,016,384 | ---- | C] () -- C:\Windows\System32\LauncheRyAgentUser.exe

[2010.12.28 20:51:31 | 000,016,384 | ---- | C] ( ) -- C:\Windows\System32\ClearEvent.exe

[2010.12.28 20:50:48 | 000,076,584 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys

[2010.12.28 20:50:48 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys

[2010.12.28 20:49:57 | 000,065,536 | ---- | C] () -- C:\Windows\System32\NATTraversal.dll

 
 ========== LOP Check ==========

 

[2011.10.21 21:18:23 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\AquaSoft

[2011.11.23 18:37:40 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\DVDVideoSoft

[2011.11.23 18:36:11 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.06.06 21:17:36 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\IrfanView

[2011.04.01 12:31:18 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\MoneyManagerEx

[2010.12.29 16:22:06 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\OpenOffice.org

[2011.11.12 13:47:17 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Thunderbird

[2012.03.15 22:36:28 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.01.10 23:00:51 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Adobe

[2011.10.21 21:18:23 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\AquaSoft

[2012.01.15 16:47:20 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Avira

[2011.08.25 19:19:36 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\CyberLink

[2011.11.23 18:46:40 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\DivX

[2011.11.23 18:37:40 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\DVDVideoSoft

[2011.11.23 18:36:11 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\DVDVideoSoftIEHelpers

[2010.12.28 20:39:40 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Identities

[2010.12.28 21:14:14 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\InstallShield

[2011.06.06 21:17:36 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\IrfanView

[2010.12.28 20:48:57 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Macromedia

[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Media Center Programs

[2011.09.27 21:54:18 | 000,000,000 | --SD | M] -- C:\Users\Nicole\AppData\Roaming\Microsoft

[2011.04.01 12:31:18 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\MoneyManagerEx

[2010.12.29 12:02:11 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Mozilla

[2010.12.29 16:22:06 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\OpenOffice.org

[2011.11.12 13:47:17 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Thunderbird

[2012.03.10 21:47:11 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\vlc

 
 < %APPDATA%\*.exe /s >

[2012.03.17 19:21:36 | 000,139,264 | ---- | M] (Piriform Ltd) -- C:\Users\Nicole\AppData\Roaming\Temqmj.exe

[3 C:\Users\Nicole\AppData\Roaming\*.tmp files -> C:\Users\Nicole\AppData\Roaming\*.tmp -> ]

[2011.05.15 13:33:57 | 000,086,528 | R--- | M] () -- C:\Users\Nicole\AppData\Roaming\Microsoft\Installer\{36FE657A-F88B-4CB6-AAD3-34E3FB6F3AD9}\MsiIcon.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2007.06.15 11:40:20 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys

[2007.06.15 11:40:20 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys

[2007.06.15 11:40:20 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2007.06.15 11:40:06 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_5a9555b4\atapi.sys

[2007.06.15 11:40:06 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20509_none_dbe4850d3d78c736\atapi.sys

[2010.12.30 13:08:42 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys

[2010.12.30 13:08:42 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys

[2010.12.30 13:08:41 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys

[2010.12.30 13:08:41 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: ENETHOOK.DLL  >

[2007.04.17 19:36:34 | 000,090,112 | ---- | M] (acer) MD5=C41A868BFC6C68C7A72A2553C44460FA -- C:\Acer\Empowering Technology\eNet\eNetHook.dll

[2007.04.17 19:36:34 | 000,090,112 | ---- | M] (acer) MD5=C41A868BFC6C68C7A72A2553C44460FA -- C:\Windows\System32\eNetHook.dll

 
 < MD5 for: IASTOR.SYS  >

[2007.03.21 12:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\Program Files\Intel\Intel Matrix Storage Manager\Driver\IaStor.sys

[2007.03.21 12:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\Windows\System32\drivers\iaStor.sys

[2007.03.21 12:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_3a63e5a6\iaStor.sys

[2007.03.21 12:59:30 | 000,381,720 | ---- | M] (Intel Corporation) MD5=9D7ED4275702E2FC409F2CC563245740 -- C:\Program Files\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys

[2007.02.12 12:36:54 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1cb29a96\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.12.30 11:56:18 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll

[2010.12.30 11:56:18 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll

[2008.01.19 08:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2006.11.02 10:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2006.11.02 09:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys

[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2011.10.21 19:33:28 | 000,697,328 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys

 
 < %systemroot%\System32\config\*.sav >

[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2006.11.02 11:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

Hoffe das hilft weiter, vielen Dank schonmal für deine Hilfe!! : )
Grüße Nicole

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://de.intl.acer.yahoo.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://de.intl.acer.yahoo.com

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://global.acer.com [binary data]

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://global.acer.com [binary data]

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://de.rd.yahoo.com/customize/ycomp/defaults/sp/*http://de.yahoo.com

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://global.acer.com [binary data]

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://de.intl.acer.yahoo.com

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\..\SearchScopes,DefaultScope = {A6645767-9D69-46A8-B0BE-72221A1A3216}

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC

IE - HKU\S-1-5-21-906325586-3288372563-1108372128-1003\..\SearchScopes\{A6645767-9D69-46A8-B0BE-72221A1A3216}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

[2011.01.19 13:34:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Nicole\AppData\Roaming\mozilla\Firefox\Profiles\d88wytyq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2012.02.27 09:38:57 | 000,000,933 | ---- | M] () -- C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\11-suche.xml

[2012.02.27 09:38:57 | 000,002,419 | ---- | M] () -- C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\englische-ergebnisse.xml

[2012.02.27 09:38:57 | 000,010,525 | ---- | M] () -- C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\gmx-suche.xml

[2012.02.27 09:38:57 | 000,002,457 | ---- | M] () -- C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\lastminute.xml

[2012.02.27 09:38:57 | 000,005,508 | ---- | M] () -- C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\webde-suche.xml

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)

O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O4 - HKLM..\Run: [Acer Tour]  File not found

O4 - HKU\S-1-5-21-906325586-3288372563-1108372128-1003..\Run: [Temqmj] C:\Users\Nicole\AppData\Roaming\Temqmj.exe (Piriform Ltd)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

MsConfig - StartUpReg: Temqmj - hkey= - key= - C:\Users\Nicole\AppData\Roaming\Temqmj.exe (Piriform Ltd)

[2012.03.17 19:21:36 | 000,139,264 | ---- | M] (Piriform Ltd) -- C:\Users\Nicole\AppData\Roaming\Temqmj.exe

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hallo Cosinus,

ich habe den OTL-Fix wie beschrieben ausgeführt.

Folgendes Logfile habe ich daraufhin erhalten:

Code:

All processes killed

========== OTL ==========

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\\Secondary Start Pages| /E : value set successfully!

HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main\\Secondary Start Pages| /E : value set successfully!

HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully!

HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\SearchMigratedDefaultName| /E : value set successfully!

HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\SearchMigratedDefaultURL| /E : value set successfully!

HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Secondary Start Pages| /E : value set successfully!

HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKU\S-1-5-21-906325586-3288372563-1108372128-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\StartPageCache| /E : value set successfully!

Registry value HKEY_USERS\S-1-5-21-906325586-3288372563-1108372128-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.

C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll moved successfully.

HKEY_USERS\S-1-5-21-906325586-3288372563-1108372128-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_USERS\S-1-5-21-906325586-3288372563-1108372128-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_USERS\S-1-5-21-906325586-3288372563-1108372128-1003\Software\Microsoft\Internet Explorer\SearchScopes\{A6645767-9D69-46A8-B0BE-72221A1A3216}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6645767-9D69-46A8-B0BE-72221A1A3216}\ not found.

C:\Users\Nicole\AppData\Roaming\mozilla\Firefox\Profiles\d88wytyq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults\preferences folder moved successfully.

C:\Users\Nicole\AppData\Roaming\mozilla\Firefox\Profiles\d88wytyq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults folder moved successfully.

C:\Users\Nicole\AppData\Roaming\mozilla\Firefox\Profiles\d88wytyq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\chrome folder moved successfully.

C:\Users\Nicole\AppData\Roaming\mozilla\Firefox\Profiles\d88wytyq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} folder moved successfully.

C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\11-suche.xml moved successfully.

C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\englische-ergebnisse.xml moved successfully.

C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\gmx-suche.xml moved successfully.

C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\lastminute.xml moved successfully.

C:\Users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\searchplugins\webde-suche.xml moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0\ deleted successfully.

C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0\ deleted successfully.

C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\Adobe Reader\ deleted successfully.

C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ deleted successfully.

File C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{326E768D-4182-46FD-9C16-1449A49795F4}\ deleted successfully.

File C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{593DDEC6-7468-4cdd-90E1-42DADAA222E9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{593DDEC6-7468-4cdd-90E1-42DADAA222E9}\ deleted successfully.

File C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}\ deleted successfully.

C:\Windows\System32\ActiveToolBand.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5CBE3B7C-1E47-477e-A7DD-396DB0476E29}\ deleted successfully.

C:\Windows\System32\eDStoolbar.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.

File C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Acer Tour deleted successfully.

Registry value HKEY_USERS\S-1-5-21-906325586-3288372563-1108372128-1003\Software\Microsoft\Windows\CurrentVersion\Run\\Temqmj deleted successfully.

C:\Users\Nicole\AppData\Roaming\Temqmj.exe moved successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\Temqmj\ deleted successfully.

File C:\Users\Nicole\AppData\Roaming\Temqmj.exe not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Nicole

->Temp folder emptied: 208723962 bytes

->Temporary Internet Files folder emptied: 91768226 bytes

->Java cache emptied: 5441012 bytes

->FireFox cache emptied: 672712583 bytes

->Flash cache emptied: 4585 bytes

 

User: Public

 

User: surfen

->Temp folder emptied: 916297 bytes

->Temporary Internet Files folder emptied: 300376 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 43432200 bytes

->Flash cache emptied: 2077 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 242245213 bytes

RecycleBin emptied: 4458753716 bytes

 

Total Files Cleaned = 5.459,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.39.1 log created on 03202012_141948
 

Files\Folders moved on Reboot...
 

Registry entries deleted on Reboot...

Vielen Dank weiterhin für deine Hilfe! Kannst du denn ev. schon sagen, ob ich wieder an die Daten auf dem USB-Stick komme oder siehts schlecht aus?

Grüße Nicole

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Hatte leider wieder Probleme mit dem Download m.H. des Links. Habe mir den TDSSKiller daher über eine andere Seite runtergeladen. Daran liegt es wahrscheinlich auch, dass ich nirgendwo auf "chanche parameters" klicken konnte (Scrennshot hab ich angehängt).

Folgenden Log habe ich nach dem Scannen erhalten, das gefundene Objekt wurde wie beschrieben "geskippt" ; )

Code:

2012/03/20 16:57:38.0025 3864        TDSS rootkit removing tool 2.5.5.0 Jun 16 2011 15:25:15

2012/03/20 16:57:38.0114 3864        ================================================================================

2012/03/20 16:57:38.0114 3864        SystemInfo:

2012/03/20 16:57:38.0114 3864        

2012/03/20 16:57:38.0114 3864        OS Version: 6.0.6002 ServicePack: 2.0

2012/03/20 16:57:38.0114 3864        Product type: Workstation

2012/03/20 16:57:38.0114 3864        ComputerName: NICOLEACER

2012/03/20 16:57:38.0117 3864        UserName: Nicole

2012/03/20 16:57:38.0117 3864        Windows directory: C:\Windows

2012/03/20 16:57:38.0117 3864        System windows directory: C:\Windows

2012/03/20 16:57:38.0117 3864        Processor architecture: Intel x86

2012/03/20 16:57:38.0117 3864        Number of processors: 2

2012/03/20 16:57:38.0117 3864        Page size: 0x1000

2012/03/20 16:57:38.0117 3864        Boot type: Normal boot

2012/03/20 16:57:38.0118 3864        ================================================================================

2012/03/20 16:57:39.0650 3864        Initialize success

2012/03/20 17:09:23.0302 0524        ================================================================================

2012/03/20 17:09:23.0302 0524        Scan started

2012/03/20 17:09:23.0302 0524        Mode: Manual; 

2012/03/20 17:09:23.0302 0524        ================================================================================

2012/03/20 17:09:25.0141 0524        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

2012/03/20 17:09:25.0259 0524        adp94xx         (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

2012/03/20 17:09:25.0390 0524        adpahci         (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

2012/03/20 17:09:25.0423 0524        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

2012/03/20 17:09:25.0467 0524        adpu320         (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

2012/03/20 17:09:25.0651 0524        AFD             (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

2012/03/20 17:09:25.0735 0524        agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys

2012/03/20 17:09:25.0781 0524        aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

2012/03/20 17:09:25.0839 0524        aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys

2012/03/20 17:09:25.0947 0524        amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

2012/03/20 17:09:26.0002 0524        amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys

2012/03/20 17:09:26.0067 0524        AmdK7           (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

2012/03/20 17:09:26.0103 0524        AmdK8           (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys

2012/03/20 17:09:26.0188 0524        arc             (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

2012/03/20 17:09:26.0320 0524        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

2012/03/20 17:09:26.0437 0524        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

2012/03/20 17:09:26.0501 0524        atapi           (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

2012/03/20 17:09:26.0682 0524        athr            (6046a55f79de9c581b8d5e9c1366cc81) C:\Windows\system32\DRIVERS\athr.sys

2012/03/20 17:09:26.0765 0524        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys

2012/03/20 17:09:26.0871 0524        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys

2012/03/20 17:09:26.0950 0524        b57nd60x        (0b92ccf7bfcbe2b33838434f2f50cb61) C:\Windows\system32\DRIVERS\b57nd60x.sys

2012/03/20 17:09:27.0160 0524        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

2012/03/20 17:09:27.0286 0524        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

2012/03/20 17:09:27.0462 0524        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

2012/03/20 17:09:27.0515 0524        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

2012/03/20 17:09:27.0598 0524        Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

2012/03/20 17:09:27.0633 0524        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

2012/03/20 17:09:27.0759 0524        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

2012/03/20 17:09:27.0829 0524        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

2012/03/20 17:09:27.0881 0524        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

2012/03/20 17:09:27.0944 0524        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

2012/03/20 17:09:28.0069 0524        cdrom           (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

2012/03/20 17:09:28.0160 0524        circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

2012/03/20 17:09:28.0246 0524        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

2012/03/20 17:09:28.0406 0524        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys

2012/03/20 17:09:28.0465 0524        cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys

2012/03/20 17:09:28.0532 0524        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys

2012/03/20 17:09:28.0572 0524        crcdisk         (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

2012/03/20 17:09:28.0615 0524        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

2012/03/20 17:09:28.0744 0524        DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

2012/03/20 17:09:28.0889 0524        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

2012/03/20 17:09:29.0021 0524        DKbFltr         (73baf270d24fe726b9cd7f80bb17a23d) C:\Windows\system32\DRIVERS\DKbFltr.sys

2012/03/20 17:09:29.0113 0524        drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

2012/03/20 17:09:29.0205 0524        DXGKrnl         (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

2012/03/20 17:09:29.0339 0524        E1G60           (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

2012/03/20 17:09:29.0457 0524        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

2012/03/20 17:09:29.0637 0524        elxstor         (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

2012/03/20 17:09:29.0850 0524        exfat           (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

2012/03/20 17:09:29.0915 0524        fastfat         (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

2012/03/20 17:09:29.0981 0524        fdc             (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

2012/03/20 17:09:30.0132 0524        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

2012/03/20 17:09:30.0168 0524        Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

2012/03/20 17:09:30.0221 0524        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

2012/03/20 17:09:30.0279 0524        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

2012/03/20 17:09:30.0425 0524        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

2012/03/20 17:09:30.0470 0524        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

2012/03/20 17:09:30.0530 0524        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys

2012/03/20 17:09:30.0688 0524        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

2012/03/20 17:09:30.0837 0524        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

2012/03/20 17:09:30.0873 0524        HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

2012/03/20 17:09:30.0940 0524        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

2012/03/20 17:09:31.0002 0524        HpCISSs         (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

2012/03/20 17:09:31.0151 0524        HSFHWAZL        (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS

2012/03/20 17:09:31.0224 0524        HSF_DPV         (7bc42c65b5c6281777c1a7605b253ba8) C:\Windows\system32\DRIVERS\HSX_DPV.sys

2012/03/20 17:09:31.0389 0524        HSXHWAZL        (9ebf2d102ccbb6bcdfbf1b7922f8ba2e) C:\Windows\system32\DRIVERS\HSXHWAZL.sys

2012/03/20 17:09:31.0448 0524        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

2012/03/20 17:09:31.0598 0524        i2omp           (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

2012/03/20 17:09:31.0660 0524        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

2012/03/20 17:09:31.0774 0524        ialm            (229be1b236fc93634b39c26ae45cbfba) C:\Windows\system32\DRIVERS\igdkmd32.sys

2012/03/20 17:09:31.0932 0524        iaStor          (997e8f5939f2d12cd9f2e6b395724c16) C:\Windows\system32\DRIVERS\iaStor.sys

2012/03/20 17:09:31.0976 0524        iaStorV         (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

2012/03/20 17:09:32.0174 0524        igfx            (229be1b236fc93634b39c26ae45cbfba) C:\Windows\system32\DRIVERS\igdkmd32.sys

2012/03/20 17:09:32.0303 0524        iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

2012/03/20 17:09:32.0369 0524        int15           (9d64201c9e5ac8d1f088762ba00ff3ab) C:\Windows\system32\drivers\int15.sys

2012/03/20 17:09:32.0508 0524        IntcAzAudAddService (2bd6633db50a98534aa3262e0f9f5a14) C:\Windows\system32\drivers\RTKVHDA.sys

2012/03/20 17:09:32.0640 0524        intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys

2012/03/20 17:09:32.0693 0524        intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

2012/03/20 17:09:32.0786 0524        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2012/03/20 17:09:32.0861 0524        IPMIDRV         (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

2012/03/20 17:09:32.0941 0524        IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

2012/03/20 17:09:33.0041 0524        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

2012/03/20 17:09:33.0088 0524        isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

2012/03/20 17:09:33.0146 0524        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

2012/03/20 17:09:33.0202 0524        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

2012/03/20 17:09:33.0307 0524        iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

2012/03/20 17:09:33.0361 0524        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

2012/03/20 17:09:33.0421 0524        kbdhid          (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

2012/03/20 17:09:33.0483 0524        KSecDD          (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys

2012/03/20 17:09:33.0658 0524        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

2012/03/20 17:09:33.0734 0524        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

2012/03/20 17:09:33.0762 0524        LSI_SAS         (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

2012/03/20 17:09:33.0791 0524        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

2012/03/20 17:09:33.0835 0524        luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

2012/03/20 17:09:33.0973 0524        mdmxsdk         (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys

2012/03/20 17:09:34.0034 0524        megasas         (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

2012/03/20 17:09:34.0115 0524        Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

2012/03/20 17:09:34.0260 0524        monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

2012/03/20 17:09:34.0300 0524        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

2012/03/20 17:09:34.0354 0524        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

2012/03/20 17:09:34.0392 0524        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

2012/03/20 17:09:34.0530 0524        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

2012/03/20 17:09:34.0579 0524        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

2012/03/20 17:09:34.0629 0524        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

2012/03/20 17:09:34.0686 0524        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

2012/03/20 17:09:34.0819 0524        mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

2012/03/20 17:09:34.0865 0524        mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2012/03/20 17:09:34.0906 0524        mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2012/03/20 17:09:34.0946 0524        msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys

2012/03/20 17:09:34.0974 0524        msdsm           (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

2012/03/20 17:09:35.0029 0524        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

2012/03/20 17:09:35.0151 0524        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

2012/03/20 17:09:35.0226 0524        MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

2012/03/20 17:09:35.0281 0524        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

2012/03/20 17:09:35.0332 0524        MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

2012/03/20 17:09:35.0471 0524        MsRPC           (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

2012/03/20 17:09:35.0530 0524        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

2012/03/20 17:09:35.0595 0524        MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

2012/03/20 17:09:35.0649 0524        Mup             (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

2012/03/20 17:09:35.0832 0524        NativeWifiP     (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

2012/03/20 17:09:35.0910 0524        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

2012/03/20 17:09:36.0047 0524        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

2012/03/20 17:09:36.0099 0524        Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

2012/03/20 17:09:36.0156 0524        NdisWan         (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

2012/03/20 17:09:36.0219 0524        NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

2012/03/20 17:09:36.0355 0524        NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

2012/03/20 17:09:36.0421 0524        netbt           (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

2012/03/20 17:09:36.0543 0524        NETw3v32        (a15f219208843a5a210c8cb391384453) C:\Windows\system32\DRIVERS\NETw3v32.sys

2012/03/20 17:09:36.0790 0524        NETw4v32        (cb3af516a6797b27725e3f1e73f3496c) C:\Windows\system32\DRIVERS\NETw4v32.sys

2012/03/20 17:09:36.0951 0524        nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

2012/03/20 17:09:37.0007 0524        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

2012/03/20 17:09:37.0059 0524        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

2012/03/20 17:09:37.0152 0524        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

2012/03/20 17:09:37.0299 0524        NTIDrvr         (7f1c1f78d709c4a54cbb46ede7e0b48d) C:\Windows\system32\DRIVERS\NTIDrvr.sys

2012/03/20 17:09:37.0330 0524        ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

2012/03/20 17:09:37.0365 0524        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

2012/03/20 17:09:37.0402 0524        nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys

2012/03/20 17:09:37.0442 0524        nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys

2012/03/20 17:09:37.0570 0524        nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

2012/03/20 17:09:37.0723 0524        ohci1394        (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

2012/03/20 17:09:37.0777 0524        Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

2012/03/20 17:09:37.0827 0524        partmgr         (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

2012/03/20 17:09:37.0949 0524        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

2012/03/20 17:09:38.0017 0524        pci             (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

2012/03/20 17:09:38.0053 0524        pciide          (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys

2012/03/20 17:09:38.0118 0524        pcmcia          (3bb2244f343b610c29c98035504c9b75) C:\Windows\system32\DRIVERS\pcmcia.sys

2012/03/20 17:09:38.0286 0524        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

2012/03/20 17:09:38.0533 0524        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

2012/03/20 17:09:38.0595 0524        Processor       (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

2012/03/20 17:09:38.0704 0524        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

2012/03/20 17:09:38.0824 0524        PSDFilter       (9aed513c256e49bd3485190f4db0dcd1) C:\Windows\system32\DRIVERS\psdfilter.sys

2012/03/20 17:09:38.0861 0524        PSDNServ        (aa7c6ff04fe84674959bcc9762f400a3) C:\Windows\system32\drivers\PSDNServ.sys

2012/03/20 17:09:38.0898 0524        psdvdisk        (d0ab5a590ff8ec49241fafc3cf29f49d) C:\Windows\system32\drivers\psdvdisk.sys

2012/03/20 17:09:38.0977 0524        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

2012/03/20 17:09:39.0135 0524        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

2012/03/20 17:09:39.0185 0524        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

2012/03/20 17:09:39.0240 0524        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

2012/03/20 17:09:39.0394 0524        Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

2012/03/20 17:09:39.0449 0524        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

2012/03/20 17:09:39.0511 0524        RasSstp         (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

2012/03/20 17:09:39.0574 0524        rdbss           (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

2012/03/20 17:09:39.0698 0524        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

2012/03/20 17:09:39.0755 0524        rdpdr           (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

2012/03/20 17:09:39.0886 0524        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

2012/03/20 17:09:39.0932 0524        RDPWD           (79c6df8477250f5c54f7c5ae1d6b814e) C:\Windows\system32\drivers\RDPWD.sys

2012/03/20 17:09:40.0012 0524        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

2012/03/20 17:09:40.0064 0524        RTL8169         (283392af1860ecdb5e0f8ebd7f3d72df) C:\Windows\system32\DRIVERS\Rtlh86.sys

2012/03/20 17:09:40.0192 0524        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

2012/03/20 17:09:40.0277 0524        sdbus           (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys

2012/03/20 17:09:40.0309 0524        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

2012/03/20 17:09:40.0364 0524        Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

2012/03/20 17:09:40.0493 0524        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

2012/03/20 17:09:40.0556 0524        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

2012/03/20 17:09:40.0624 0524        sffdisk         (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys

2012/03/20 17:09:40.0652 0524        sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

2012/03/20 17:09:40.0690 0524        sffp_sd         (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys

2012/03/20 17:09:40.0817 0524        sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

2012/03/20 17:09:40.0865 0524        sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys

2012/03/20 17:09:40.0898 0524        SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

2012/03/20 17:09:40.0931 0524        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

2012/03/20 17:09:40.0994 0524        Smb             (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

2012/03/20 17:09:41.0152 0524        spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

2012/03/20 17:09:41.0269 0524        sptd            (c4bb8a12843d9cbb65f5ff617f389bbd) C:\Windows\system32\Drivers\sptd.sys

2012/03/20 17:09:41.0269 0524        Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: c4bb8a12843d9cbb65f5ff617f389bbd

2012/03/20 17:09:41.0279 0524        sptd - detected LockedFile.Multi.Generic (1)

2012/03/20 17:09:41.0435 0524        srv             (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

2012/03/20 17:09:41.0493 0524        srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

2012/03/20 17:09:41.0533 0524        srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

2012/03/20 17:09:41.0586 0524        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys

2012/03/20 17:09:41.0754 0524        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

2012/03/20 17:09:41.0822 0524        Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

2012/03/20 17:09:41.0853 0524        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

2012/03/20 17:09:41.0895 0524        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

2012/03/20 17:09:42.0035 0524        SynTP           (f7a4250bb3e3afcd4af100e551509352) C:\Windows\system32\DRIVERS\SynTP.sys

2012/03/20 17:09:42.0147 0524        Tcpip           (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys

2012/03/20 17:09:42.0313 0524        Tcpip6          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys

2012/03/20 17:09:42.0451 0524        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

2012/03/20 17:09:42.0493 0524        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

2012/03/20 17:09:42.0531 0524        TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

2012/03/20 17:09:42.0591 0524        tdx             (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

2012/03/20 17:09:42.0747 0524        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

2012/03/20 17:09:42.0815 0524        tifm21          (e4c85c291ddb3dc5e4a2f227ca465ba6) C:\Windows\system32\drivers\tifm21.sys

2012/03/20 17:09:42.0988 0524        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

2012/03/20 17:09:43.0040 0524        tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

2012/03/20 17:09:43.0085 0524        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

2012/03/20 17:09:43.0130 0524        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys

2012/03/20 17:09:43.0270 0524        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

2012/03/20 17:09:43.0345 0524        uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

2012/03/20 17:09:43.0383 0524        uliahci         (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

2012/03/20 17:09:43.0513 0524        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

2012/03/20 17:09:43.0561 0524        ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

2012/03/20 17:09:43.0598 0524        umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

2012/03/20 17:09:43.0670 0524        usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

2012/03/20 17:09:43.0792 0524        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

2012/03/20 17:09:43.0878 0524        usbehci         (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

2012/03/20 17:09:43.0916 0524        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

2012/03/20 17:09:43.0953 0524        usbohci         (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys

2012/03/20 17:09:44.0077 0524        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

2012/03/20 17:09:44.0156 0524        USBSTOR         (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2012/03/20 17:09:44.0200 0524        usbuhci         (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

2012/03/20 17:09:44.0332 0524        usbvideo        (0a6b81f01bc86399482e27e6fda7b33b) C:\Windows\system32\Drivers\usbvideo.sys

2012/03/20 17:09:44.0411 0524        vga             (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

2012/03/20 17:09:44.0459 0524        VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

2012/03/20 17:09:44.0496 0524        viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

2012/03/20 17:09:44.0612 0524        ViaC7           (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

2012/03/20 17:09:44.0656 0524        viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys

2012/03/20 17:09:44.0689 0524        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

2012/03/20 17:09:44.0755 0524        volmgrx         (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

2012/03/20 17:09:44.0880 0524        volsnap         (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

2012/03/20 17:09:44.0928 0524        vsmraid         (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

2012/03/20 17:09:44.0998 0524        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

2012/03/20 17:09:45.0048 0524        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2012/03/20 17:09:45.0063 0524        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2012/03/20 17:09:45.0207 0524        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

2012/03/20 17:09:45.0264 0524        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

2012/03/20 17:09:45.0460 0524        winachsf        (5a77ac34a0ffb70ce8b35b524fede9ba) C:\Windows\system32\DRIVERS\HSX_CNXT.sys

2012/03/20 17:09:45.0652 0524        WmiAcpi         (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys

2012/03/20 17:09:45.0749 0524        WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

2012/03/20 17:09:45.0805 0524        ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

2012/03/20 17:09:45.0883 0524        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

2012/03/20 17:09:46.0017 0524        XAudio          (88af537264f2b818da15479ceeaf5d7c) C:\Windows\system32\DRIVERS\xaudio.sys

2012/03/20 17:09:46.0095 0524        {95808DC4-FA4A-4c74-92FE-5B863F82066B} (8098180b3f6c430a4e60333bc036f936) C:\Program Files\CyberLink\PowerDVD\000.fcl

2012/03/20 17:09:46.0120 0524        MBR (0x1B8)     (6fc6f9186c07bca94e140f63bfe6e9b4) \Device\Harddisk0\DR0

2012/03/20 17:09:46.0214 0524        MBR (0x1B8)     (3205973b5c22365846269f263539e310) \Device\Harddisk1\DR1

2012/03/20 17:09:46.0433 0524        ================================================================================

2012/03/20 17:09:46.0433 0524        Scan finished

2012/03/20 17:09:46.0433 0524        ================================================================================

2012/03/20 17:09:46.0450 4008        Detected object count: 1

2012/03/20 17:09:46.0451 4008        Actual detected object count: 1

2012/03/20 17:10:06.0440 4008        LockedFile.Multi.Generic(sptd) - User select action: Skip

Danke für die schnelle Hilfe & Grüße Nicole

Hoffentlich hast du den NICHT von Softonic runtergeladen! :balla:

Finger weg von Softonic!!

Softonic ist eine Toolbar- und Adwareschleuder! Finger weg! Software lädt man sich mit oberster Priorität direkt vom Hersteller und nicht von solchen Toolbarklitschen wie Softonic! Im Notfall würde natürlich chip.de gehen

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

sorry, wird sofort durchgeführt... :heulen:

Habe ComboFix erfolgreich ausgeführt. Allerdings hat es erst beim zweiten Anlauf funktioniert, weil ich beim ersten Mal anscheinend noch einen Windows Schutz an hatte.
Beim zweiten Mal hat es dann geklappt und nach einem manuellen Neustart hatte ich auch keine Fehlermeldung mehr. Folgenden Log habe ich erhalten:

Code:

ComboFix 12-03-20.01 - Nicole 20.03.2012  19:30:31.2.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.1013.426 [GMT 1:00]

ausgeführt von:: c:\users\Nicole\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-02-20 bis 2012-03-20  ))))))))))))))))))))))))))))))

.

.

2012-03-20 18:39 . 2012-03-20 18:39        --------        d-----w-        c:\users\Nicole\AppData\Local\temp

2012-03-20 18:39 . 2012-03-20 18:39        --------        d-----w-        c:\users\surfen\AppData\Local\temp

2012-03-20 18:39 . 2012-03-20 18:39        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-03-20 13:19 . 2012-03-20 13:19        --------        d-----w-        C:\_OTL

2012-03-14 17:39 . 2012-02-02 15:16        2044416        ----a-w-        c:\windows\system32\win32k.sys

2012-03-14 17:39 . 2012-02-14 15:45        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll

2012-03-14 17:39 . 2012-02-14 15:45        160768        ----a-w-        c:\windows\system32\d3d10_1.dll

2012-03-14 17:39 . 2012-02-13 14:12        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll

2012-03-14 17:39 . 2012-02-13 13:47        683008        ----a-w-        c:\windows\system32\d2d1.dll

2012-03-14 17:39 . 2012-02-13 13:44        1068544        ----a-w-        c:\windows\system32\DWrite.dll

2012-03-14 17:39 . 2012-01-31 10:59        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2012-03-13 18:33 . 2012-01-09 15:54        613376        ----a-w-        c:\windows\system32\rdpencom.dll

2012-03-13 18:33 . 2012-01-09 13:58        180736        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-03-04 12:52 . 2011-03-12 21:55        876032        ----a-w-        c:\windows\system32\XpsPrint.dll

2012-03-01 16:00 . 2012-03-01 16:00        --------        d-----w-        c:\program files\Windows Portable Devices

2012-03-01 11:17 . 2009-09-10 02:00        1164800        ----a-w-        c:\windows\system32\UIRibbonRes.dll

2012-03-01 11:17 . 2009-09-10 02:00        92672        ----a-w-        c:\windows\system32\UIAnimation.dll

2012-03-01 11:17 . 2009-09-10 02:01        3023360        ----a-w-        c:\windows\system32\UIRibbon.dll

2012-03-01 11:16 . 2009-09-25 01:33        369664        ----a-w-        c:\windows\system32\WMPhoto.dll

2012-03-01 11:16 . 2009-09-25 02:10        974848        ----a-w-        c:\windows\system32\WindowsCodecs.dll

2012-03-01 11:16 . 2009-09-25 02:07        189440        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll

2012-03-01 11:16 . 2009-09-25 02:04        321024        ----a-w-        c:\windows\system32\PhotoMetadataHandler.dll

2012-03-01 11:16 . 2009-09-25 01:33        195584        ----a-w-        c:\windows\system32\dxdiagn.dll

2012-03-01 11:16 . 2009-09-25 01:32        252928        ----a-w-        c:\windows\system32\dxdiag.exe

2012-03-01 11:16 . 2009-09-25 01:31        519680        ----a-w-        c:\windows\system32\d3d11.dll

2012-03-01 09:23 . 2011-01-20 14:15        979456        ----a-w-        c:\windows\system32\MFH264Dec.dll

2012-03-01 09:22 . 2011-01-20 16:06        26112        ----a-w-        c:\windows\system32\printfilterpipelineprxy.dll

2012-03-01 09:05 . 2011-10-25 15:58        1314816        ----a-w-        c:\windows\system32\quartz.dll

2012-03-01 09:05 . 2011-10-25 15:58        497152        ----a-w-        c:\windows\system32\qdvd.dll

2012-03-01 08:57 . 2011-10-27 08:01        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-03-01 08:57 . 2011-10-27 08:01        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-03-01 08:57 . 2011-07-29 16:01        293376        ----a-w-        c:\windows\system32\psisdecd.dll

2012-03-01 08:57 . 2011-07-29 16:01        217088        ----a-w-        c:\windows\system32\psisrndr.ax

2012-03-01 08:57 . 2011-07-29 16:00        69632        ----a-w-        c:\windows\system32\Mpeg2Data.ax

2012-03-01 08:57 . 2011-07-29 16:00        57856        ----a-w-        c:\windows\system32\MSDvbNP.ax

2012-03-01 08:57 . 2011-10-14 16:03        189952        ----a-w-        c:\windows\system32\winmm.dll

2012-03-01 08:57 . 2011-10-14 16:00        23552        ----a-w-        c:\windows\system32\mciseq.dll

2012-03-01 08:56 . 2011-11-18 20:23        1205064        ----a-w-        c:\windows\system32\ntdll.dll

2012-03-01 08:55 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll

2012-03-01 08:50 . 2011-08-13 04:43        6144        ----a-w-        c:\program files\Internet Explorer\iecompat.dll

2012-03-01 08:50 . 2011-02-22 13:33        797696        ----a-w-        c:\windows\system32\FntCache.dll

2012-03-01 08:50 . 2011-01-20 16:08        1029120        ----a-w-        c:\windows\system32\d3d10.dll

2012-03-01 08:50 . 2011-01-20 14:11        486400        ----a-w-        c:\windows\system32\d3d10level9.dll

2012-03-01 08:50 . 2011-02-22 14:13        288768        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2012-03-01 08:50 . 2011-01-20 16:08        189952        ----a-w-        c:\windows\system32\d3d10core.dll

2012-03-01 08:50 . 2011-01-20 14:28        1554432        ----a-w-        c:\windows\system32\xpsservices.dll

2012-03-01 08:50 . 2011-01-20 14:25        847360        ----a-w-        c:\windows\system32\OpcServices.dll

2012-03-01 08:47 . 2011-11-18 17:47        66560        ----a-w-        c:\windows\system32\packager.dll

2012-03-01 08:46 . 2011-11-25 15:59        376320        ----a-w-        c:\windows\system32\winsrv.dll

2012-03-01 08:46 . 2011-12-14 16:17        680448        ----a-w-        c:\windows\system32\msvcrt.dll

2012-03-01 08:39 . 2011-09-20 21:02        905088        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2012-03-01 08:29 . 2011-10-25 15:56        49152        ----a-w-        c:\windows\system32\csrsrv.dll

2012-03-01 08:29 . 2011-11-17 06:48        440192        ----a-w-        c:\windows\system32\drivers\ksecdd.sys

2012-03-01 08:29 . 2011-11-16 16:23        278528        ----a-w-        c:\windows\system32\schannel.dll

2012-03-01 08:29 . 2011-11-16 16:23        377344        ----a-w-        c:\windows\system32\winhttp.dll

2012-03-01 08:29 . 2011-11-16 16:21        1259008        ----a-w-        c:\windows\system32\lsasrv.dll

2012-03-01 08:29 . 2011-11-16 16:23        72704        ----a-w-        c:\windows\system32\secur32.dll

2012-03-01 08:29 . 2011-11-16 14:12        9728        ----a-w-        c:\windows\system32\lsass.exe

2012-03-01 08:24 . 2011-11-08 14:42        2048        ----a-w-        c:\windows\system32\tzres.dll

2012-03-01 08:21 . 2011-08-25 16:15        555520        ----a-w-        c:\windows\system32\UIAutomationCore.dll

2012-03-01 08:21 . 2011-08-25 16:14        238080        ----a-w-        c:\windows\system32\oleacc.dll

2012-03-01 08:21 . 2011-08-25 13:31        4096        ----a-w-        c:\windows\system32\oleaccrc.dll

2012-03-01 08:21 . 2011-08-25 16:14        563712        ----a-w-        c:\windows\system32\oleaut32.dll

2012-03-01 08:20 . 2011-09-30 15:57        707584        ----a-w-        c:\program files\Common Files\System\wab32.dll

2012-03-01 08:16 . 2010-05-04 19:13        231424        ----a-w-        c:\windows\system32\msshsq.dll

2012-02-29 16:11 . 2012-02-29 16:12        --------        d-----w-        c:\windows\system32\ca-ES

2012-02-29 16:11 . 2012-02-29 16:12        --------        d-----w-        c:\windows\system32\eu-ES

2012-02-29 16:11 . 2012-02-29 16:12        --------        d-----w-        c:\windows\system32\vi-VN

2012-02-21 12:58 . 2012-02-21 13:07        --------        d-----w-        c:\program files\SPSS19

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-02-23 07:31 . 2011-05-27 11:56        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-31 131072]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-31 151552]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-31 126976]

"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-12 457728]

"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\eNetHook.dll

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk

backup=c:\windows\pss\Empowering Technology Launcher.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]

2007-02-15 16:39        151552        ----a-w-        c:\acer\AcerTour\Reminder.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-01-03 07:37        843712        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe]

2007-05-27 01:19        36864        ----a-w-        c:\program files\GameSpy\Comrade\Comrade.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2011-03-21 21:10        1230704        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]

2007-03-21 12:00        174872        ----a-w-        c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]

2007-02-07 15:21        54832        ----a-w-        c:\program files\CyberLink\PowerDVD\Language\Language.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]

2007-05-22 22:37        850704        ----a-w-        c:\progra~1\LAUNCH~1\LManager.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

2007-03-14 20:01        71216        ------w-        c:\program files\CyberLink\PowerDVD\PDVDServ.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]

2007-03-24 03:04        4423680        ----a-w-        c:\windows\RtHDVCpl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]

2007-03-16 23:06        1822720        ----a-w-        c:\windows\SkyTel.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2011-06-09 11:06        254696        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

2008-01-19 07:33        202240        ----a-w-        c:\program files\Windows Media Player\wmpnscfg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

.

S2 AAV UpdateService;AAV UpdateService;c:\program files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [2008-10-24 128296]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - 98875346

*Deregistered* - 98875346

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

uSearchMigratedDefaultURL = 

mStart Page = 

uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/su/*hxxp://de.yahoo.com

IE: Free YouTube Download - c:\users\Nicole\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\Nicole\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

FF - ProfilePath - c:\users\Nicole\AppData\Roaming\Mozilla\Firefox\Profiles\d88wytyq.default\

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-03-20 19:39

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

 [0] 0x62006C00

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]

"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(796)

c:\windows\system32\eNetHook.dll

.

- - - - - - - > 'lsass.exe'(688)

c:\windows\system32\eNetHook.dll

.

Zeit der Fertigstellung: 2012-03-20  19:42:32

ComboFix-quarantined-files.txt  2012-03-20 18:42

ComboFix2.txt  2012-03-20 18:22

.

Vor Suchlauf: 14 Verzeichnis(se), 17.409.490.944 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 17.380.954.112 Bytes frei

.

- - End Of File - - 9C2750C6473B4B5990D22C71C2C3AC34

Was installiert denn Softronic auf dem Rechner, wenn man etwas runterläd? Schönen Abend noch, Grüße Nicole

Ich hab doch oben erwähnt was da drin ist! Adware/Toolbars! Zeug das kein Mensch eigentlich haben will!

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Hallo Cosinus,
nach dem Fehler mit softronic gehe ich jetzt doch nochmal auf Nummer Sicher.

Habe GMER problemlos ausgeführt und das Log gespeichert.
Dann habe ich auch OSAM ausgeführt und mich dabei an deine verlinkte Anleitung vom Board gehalten.
Da dort nicht stand, dass ich die Online-Abfrage überspringen soll, habe ich dies auch nicht gemacht. Nicht falsch verstehen, war natürlich mein Fehler.

Ist das jetzt ein Problem?
...danke für deine Geduld... : )

Zitat:

Ist das jetzt ein Problem?

Ja weil es zu diversen Nachfragen immer geführt hat wenn die Onlineabfrage nicht klappte! Also halte dich bitte auch an die Hinweise die ich poste!

Ok, hab es verstanden...

Habe alles Weitere so ausgeführt, wie du es beschrieben hast und folgenden aswMBR.txt erhalten:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-03-22 12:42:46

-----------------------------

12:42:46.139    OS Version: Windows 6.0.6002 Service Pack 2

12:42:46.140    Number of processors: 2 586 0xF02

12:42:46.141    ComputerName: NICOLEACER  UserName: Nicole

12:43:33.188    Initialize success

12:44:16.698    AVAST engine defs: 12032000

12:45:19.702    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0

12:45:19.705    Disk 0 Vendor: Hitachi_ SBDO Size: 114473MB BusType: 3

12:45:19.741    Disk 0 MBR read successfully

12:45:19.744    Disk 0 MBR scan

12:45:20.101    Disk 0 unknown MBR code

12:45:20.120    Disk 0 Partition 1 00     27 Hidden NTFS WinRE MSDOS5.0    10000 MB offset 2048

12:45:20.175    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        55930 MB offset 20482048

12:45:20.214    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        48541 MB offset 135026688

12:45:20.266    Disk 0 scanning sectors +234438656

12:45:20.379    Disk 0 scanning C:\Windows\system32\drivers

12:45:40.957    Service scanning

12:46:12.350    Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32

12:46:22.153    Modules scanning

12:46:45.557    Disk 0 trace - called modules:

12:46:45.595    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys spro.sys 

12:46:45.601    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85a1b4e0]

12:46:45.607    3 CLASSPNP.SYS[86bb88b3] -> nt!IofCallDriver -> [0x84edaeb8]

12:46:45.613    5 acpi.sys[805c06bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x84ed9030]

12:46:46.313    AVAST engine scan C:\Windows

12:46:55.534    AVAST engine scan C:\Windows\system32

12:52:15.688    AVAST engine scan C:\Windows\system32\drivers

12:52:31.288    AVAST engine scan C:\Users\Nicole

12:58:59.351    AVAST engine scan C:\ProgramData

13:00:30.494    Scan finished successfully

13:11:28.647    Disk 0 MBR has been saved successfully to "C:\Users\Nicole\Desktop\MBR.dat"

13:11:28.670    The log file has been saved successfully to "C:\Users\Nicole\Desktop\aswMBR.txt"

:daumenhoc & Grüße Nicole

Und warum postest du die anderen Logs nicht

Ich mach das nicht absichtlich....

GMER-Log:

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-03-21 20:57:48

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Hitachi_ rev.SBDO

Running: e3g62syr.exe; Driver: C:\Users\Nicole\AppData\Local\Temp\ugdoauog.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            8CD4173E                                                                          ZwCreateSection

SSDT            8CD41743                                                                          ZwSetContextThread

SSDT            8CD416DF                                                                          ZwTerminateProcess
 

INT 0x51        ?                                                                                 86082C88

INT 0x52        ?                                                                                 86082C88

INT 0x72        ?                                                                                 848FFC88

INT 0x82        ?                                                                                 83F70C88

INT 0xA2        ?                                                                                 86082C88
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!KeSetEvent + 215                                                     822BB998 4 Bytes  [3E, 17, D4, 8C]

.text           ntkrnlpa.exe!KeSetEvent + 56D                                                     822BBCF0 4 Bytes  [43, 17, D4, 8C] {INC EBX; POP SS; AAM 0x8c}

.text           ntkrnlpa.exe!KeSetEvent + 621                                                     822BBDA4 4 Bytes  [DF, 16, D4, 8C] {FIST WORD [ESI]; AAM 0x8c}

?               System32\Drivers\sppg.sys                                                         Das System kann den angegebenen Pfad nicht finden. !

.text           USBPORT.SYS!DllUnload                                                             8AE6C41B 5 Bytes  JMP 860821D8 
 

---- Kernel IAT/EAT - GMER 1.0.15 ----
 

IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar]         [8068DF9C] \SystemRoot\System32\Drivers\sppg.sys

IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUlong]         [8068D3E6] \SystemRoot\System32\Drivers\sppg.sys

IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar]          [8068D90E] \SystemRoot\System32\Drivers\sppg.sys

IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort]  [8068E178] \SystemRoot\System32\Drivers\sppg.sys

IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort]         [8068D116] \SystemRoot\System32\Drivers\sppg.sys

IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort]   [8068D1D4] \SystemRoot\System32\Drivers\sppg.sys

IAT             \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                [8069E976] \SystemRoot\System32\Drivers\sppg.sys
 

---- Devices - GMER 1.0.15 ----
 

Device          \FileSystem\Ntfs \Ntfs                                                            849011F8

Device          \FileSystem\fastfat \FatCdrom                                                     8CE531F8

Device          \FileSystem\udfs \UdfsCdRom                                                       860E51F8

Device          \FileSystem\udfs \UdfsDisk                                                        860E51F8
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                           Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                           Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
 

Device          \Driver\volmgr \Device\VolMgrControl                                              83F721F8

Device          \Driver\usbuhci \Device\USBPDO-0                                                  8609F1F8

Device          \Driver\usbuhci \Device\USBPDO-1                                                  8609F1F8

Device          \Driver\usbuhci \Device\USBPDO-2                                                  8609F1F8

Device          \Driver\usbuhci \Device\USBPDO-3                                                  8609F1F8

Device          \Driver\usbehci \Device\USBPDO-4                                                  860A01F8

Device          \Driver\volmgr \Device\HarddiskVolume1                                            83F721F8

Device          \Driver\volmgr \Device\HarddiskVolume2                                            83F721F8

Device          \Driver\cdrom \Device\CdRom0                                                      860A61F8

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                       849001F8

Device          \Driver\iaStor \Device\Ide\iaStor0                                                [864F66D0] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort0                                                849001F8

Device          \Driver\iaStor \Device\Ide\IAAStorageDevice-0                                     [864F66D0] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\volmgr \Device\HarddiskVolume3                                            83F721F8

Device          \Driver\netbt \Device\NetBT_Tcpip_{AD661D68-B163-4039-8EFB-33D7F9E1C04F}          8CE10470

Device          \Driver\netbt \Device\NetBt_Wins_Export                                           8CE10470

Device          \Driver\Smb \Device\NetbiosSmb                                                    8C7C11F8

Device          \Driver\iScsiPrt \Device\RaidPort0                                                860DA1F8

Device          \Driver\usbuhci \Device\USBFDO-0                                                  8609F1F8

Device          \Driver\usbuhci \Device\USBFDO-1                                                  8609F1F8

Device          \Driver\usbuhci \Device\USBFDO-2                                                  8609F1F8

Device          \Driver\usbuhci \Device\USBFDO-3                                                  8609F1F8

Device          \Driver\usbehci \Device\USBFDO-4                                                  860A01F8

Device          \FileSystem\fastfat \Fat                                                          8CE531F8
 

AttachedDevice  \FileSystem\fastfat \Fat                                                          fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                771343423

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                285507792
 

---- EOF - GMER 1.0.15 ----

OSAM-Log:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 21:20:36 on 21.03.2012
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Mozilla Corporation Firefox 10.0.2
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[AppInit DLLs]

-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----

"AppInit_DLLs" - "acer" - C:\Windows\System32\eNetHook.dll
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\Users\Nicole\AppData\Local\Temp\catchme.sys  (File not found)

"int15" (int15) - ? - C:\Windows\system32\drivers\int15.sys  (File found, but it contains no detailed information)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"PSDFilter" (PSDFilter) - "HiTRUST" - C:\Windows\System32\DRIVERS\psdfilter.sys

"PSDNSERVER" (PSDNServ) - "HiTRUST" - C:\Windows\System32\drivers\PSDNServ.sys

"psdvdisk" (psdvdisk) - "HiTRUST" - C:\Windows\System32\drivers\psdvdisk.sys

"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"ugdoauog" (ugdoauog) - ? - C:\Users\Nicole\AppData\Local\Temp\ugdoauog.sys  (Hidden registry entry, rootkit activity | File not found)

"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys

"{95808DC4-FA4A-4c74-92FE-5B863F82066B}" ({95808DC4-FA4A-4c74-92FE-5B863F82066B}) - "Cyberlink Corp." - C:\Program Files\CyberLink\PowerDVD\000.fcl
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A} "PXCInfoShlExt Class" - "Tracker Software Products (Canada) Ltd." - C:\Program Files\Tracker Software\Shell Extensions\XCShInfo.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0} "EPM-PO Shell Extensions" - ? - epm-po.dll  (File not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{CF822AB4-6DB5-4FDA-BC28-E61DF36D2583} "PDF-XChange PDF Preview Provider" - "Tracker Software Products (Canada) Ltd." - C:\Program Files\Tracker Software\Shell Extensions\XCShInfo.dll

{67EB453C-1BE1-48EC-AAF3-23B10277FCC1} "PDF-XChange PDF Property Handler" - "Tracker Software Products (Canada) Ltd." - C:\Program Files\Tracker Software\Shell Extensions\XCShInfo.dll

{EBD0B8F4-A9A0-41B7-9695-030CD264D9C8} "PDF-XChange PDF Thumbnail Provider" - "Tracker Software Products (Canada) Ltd." - C:\Program Files\Tracker Software\Shell Extensions\XCShInfo.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

XCShInfo "{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A}" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Nicole\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"eDataSecurity Loader" - "HiTRUST" - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

"WarReg_PopUp" - "Acer Inc." - C:\Acer\WR_PopUp\WarReg_PopUp.exe
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"AAV UpdateService" (AAV UpdateService) - ? - C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

"eDSService.exe" (eDataSecurity Service) - "HiTRSUT" - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe

"eLock Service" (eLockService) - "Acer Inc." - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe

"eNet Service" (eNet Service) - "Acer Inc." - C:\Acer\Empowering Technology\eNet\eNet Service.exe

"ePower Service" (WMIService) - "acer" - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

"eRecovery Service" (eRecoveryService) - "Acer Inc." - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

"eSettings Service" (eSettingsService) - ? - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe

"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"MobilityService" (MobilityService) - ? - C:\Acer\Mobility Center\MobilityService.exe  (File found, but it contains no detailed information)

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"SQL Server (MSSMLBIZ)" (MSSQL$MSSMLBIZ) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

"SQL Server-Browser" (SQLBrowser) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

"SQL Server-Startdienst für Business Contact Manager" (BcmSqlStartupSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

"Symantec Lic NetConnect service" (CLTNetCnService) - ? - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

Kann ich die Daten etwa auch auf einem infizierten USB-Stick speichern? Da das Problem weiterhin besteht, möchte ich nicht meine externe Festplatte anschließen auf der ich normalerweise speichere.
Grüße Nicole

Wieso infizierter USB-Stick?
Deaktivier die automatische Wiedergabe auf allen Laufwerken! Dann kannst du das auch auf der ext. Platte speichern

Automatische Wiedergabe deaktivieren

Windows XP: Zur Vereinfachung hab ich mal die noautoplay.reg hochgeladen. Lad das auf dem Desktop herunter, führ die Datei aus und bestätige mit ja. Nach einem Neustart des Rechners ist die automatische Wiedergabe (von Datenträgern) auf allen Laufwerken deaktiviert, d.h. keine CD, kein Stick oder sonstwas startet nach dem Einstecken mehr automatisch.

Windows Vista/7: In der Systemsteuerung unter automatische Wiedergabe von CDs und anderen Medien alles deaktivieren. => siehe auch Einstellungen für automatische Wiedergabe ändern

Hallo,
habe den MBR Fix gemacht, ging sehr schnell & problemlos.

Der neue Log:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-03-22 12:42:46

-----------------------------

12:42:46.139    OS Version: Windows 6.0.6002 Service Pack 2

12:42:46.140    Number of processors: 2 586 0xF02

12:42:46.141    ComputerName: NICOLEACER  UserName: Nicole

12:43:33.188    Initialize success

12:44:16.698    AVAST engine defs: 12032000

12:45:19.702    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0

12:45:19.705    Disk 0 Vendor: Hitachi_ SBDO Size: 114473MB BusType: 3

12:45:19.741    Disk 0 MBR read successfully

12:45:19.744    Disk 0 MBR scan

12:45:20.101    Disk 0 unknown MBR code

12:45:20.120    Disk 0 Partition 1 00     27 Hidden NTFS WinRE MSDOS5.0    10000 MB offset 2048

12:45:20.175    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        55930 MB offset 20482048

12:45:20.214    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        48541 MB offset 135026688

12:45:20.266    Disk 0 scanning sectors +234438656

12:45:20.379    Disk 0 scanning C:\Windows\system32\drivers

12:45:40.957    Service scanning

12:46:12.350    Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32

12:46:22.153    Modules scanning

12:46:45.557    Disk 0 trace - called modules:

12:46:45.595    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys spro.sys 

12:46:45.601    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85a1b4e0]

12:46:45.607    3 CLASSPNP.SYS[86bb88b3] -> nt!IofCallDriver -> [0x84edaeb8]

12:46:45.613    5 acpi.sys[805c06bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x84ed9030]

12:46:46.313    AVAST engine scan C:\Windows

12:46:55.534    AVAST engine scan C:\Windows\system32

12:52:15.688    AVAST engine scan C:\Windows\system32\drivers

12:52:31.288    AVAST engine scan C:\Users\Nicole

12:58:59.351    AVAST engine scan C:\ProgramData

13:00:30.494    Scan finished successfully

13:11:28.647    Disk 0 MBR has been saved successfully to "C:\Users\Nicole\Desktop\MBR.dat"

13:11:28.670    The log file has been saved successfully to "C:\Users\Nicole\Desktop\aswMBR.txt"
 
 

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-03-24 15:36:09

-----------------------------

15:36:09.099    OS Version: Windows 6.0.6002 Service Pack 2

15:36:09.099    Number of processors: 2 586 0xF02

15:36:09.099    ComputerName: NICOLEACER  UserName: Nicole

15:36:49.051    Initialize success

15:37:03.465    AVAST engine defs: 12032400

15:37:22.560    The log file has been saved successfully to "C:\Users\Nicole\Desktop\aswMBR.txt"

Und ich habe von einem "infizierten USB-Stick" geschrieben, weil das Problem doch von dem USB-Stick ausgeht (Ordner sind nur noch Verknüpfungen und Dateien lassen sich nicht öffnen).
Die automatische Wiedergabe hatte ich auch schon deaktiviert und es hat sich dennoch ein weiterer USB-Stick infiziert, als ich ihn angeschlossen habe. Das ist aber nicht weiter schlimm, weil er sowieso leer war.
Grüße und danke für die geduldige Hilfe, Nicole : )

Das ist nicht das Log was ich sehen wollte! Nach dem Fix solltest du ein neues mit aswMBR machen!

Zitat:

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

Ich habe mich genau an deine Anleitung gehalten... wahrscheinlich meintest du mit einem neuen Log aber wohl auch einen neuen Scan?

Dann gibts folgenden Log:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-03-24 19:46:22

-----------------------------

19:46:22.245    OS Version: Windows 6.0.6002 Service Pack 2

19:46:22.245    Number of processors: 2 586 0xF02

19:46:22.245    ComputerName: NICOLEACER  UserName: Nicole

19:46:25.271    Initialize success

19:46:38.359    AVAST engine defs: 12032400

19:47:33.583    The log file has been saved successfully to "C:\Users\Nicole\Desktop\aswMBR1.txt"
 
 

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-03-24 19:50:14

-----------------------------

19:50:14.062    OS Version: Windows 6.0.6002 Service Pack 2

19:50:14.062    Number of processors: 2 586 0xF02

19:50:14.062    ComputerName: NICOLEACER  UserName: Nicole

19:50:14.748    Initialize success

19:50:25.107    AVAST engine defs: 12032400

19:50:27.041    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0

19:50:27.041    Disk 0 Vendor: Hitachi_ SBDO Size: 114473MB BusType: 3

19:50:27.088    Disk 0 MBR read successfully

19:50:27.088    Disk 0 MBR scan

19:50:27.353    Disk 0 Windows VISTA default MBR code

19:50:27.369    Disk 0 Partition 1 00     27 Hidden NTFS WinRE MSDOS5.0    10000 MB offset 2048

19:50:27.416    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        55930 MB offset 20482048

19:50:27.462    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        48541 MB offset 135026688

19:50:27.540    Disk 0 scanning sectors +234438656

19:50:27.681    Disk 0 scanning C:\Windows\system32\drivers

19:50:53.187    Service scanning

19:51:24.636    Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32

19:51:35.432    Modules scanning

19:51:47.022    Disk 0 trace - called modules:

19:51:47.038    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys spft.sys 

19:51:47.054    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x859f2578]

19:51:47.054    3 CLASSPNP.SYS[86bb88b3] -> nt!IofCallDriver -> [0x849601e8]

19:51:47.069    5 acpi.sys[805ba6bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x849a6030]

19:51:47.600    AVAST engine scan C:\Windows

19:51:57.272    AVAST engine scan C:\Windows\system32

19:56:22.060    AVAST engine scan C:\Windows\system32\drivers

19:56:36.103    AVAST engine scan C:\Users\Nicole

20:04:54.536    AVAST engine scan C:\ProgramData

20:07:00.793    Scan finished successfully

20:10:49.386    Disk 0 MBR has been saved successfully to "C:\Users\Nicole\Desktop\MBR.dat"

20:10:49.394    The log file has been saved successfully to "C:\Users\Nicole\Desktop\aswMBR1.txt"

Danke für deine geduldige Hilfe, Greetz Nicole

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Guten Morgen,

gestern habe ich erfolgreich den Vollscan mit SuperAntiSpyware durchgeführt. Als ich heute allerdings den Scan mit ESET durchführen wollte, habe ich wieder die gleiche Fehlermeldung von Web.de erhalten, wie zuvor schon bei Malewarebytes. Habe den Screenshot mal angehängt, vielleicht weißt du ja woran das liegt?

Hier also daher nur der Vollscan von SASW, der einiges gefunden hat...

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 03/25/2012 at 08:56 PM
 

Application Version : 5.0.1146
 

Core Rules Database Version : 8377

Trace Rules Database Version: 6189
 

Scan type       : Complete Scan

Total Scan Time : 02:36:23
 

Operating System Information

Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)

UAC On - Administrator
 

Memory items scanned      : 624

Memory threats detected   : 0

Registry items scanned    : 34619

Registry threats detected : 0

File items scanned        : 460349

File threats detected     : 409
 

Adware.Tracking Cookie

        C:\Users\Nicole\AppData\Roaming\Microsoft\Windows\Cookies\nicole@ad.yieldmanager[1].txt [ /ad.yieldmanager ]

        C:\Users\Nicole\AppData\Roaming\Microsoft\Windows\Cookies\nicole@adx.chip[2].txt [ /adx.chip ]

        C:\Users\Nicole\AppData\Roaming\Microsoft\Windows\Cookies\nicole@apmebf[1].txt [ /apmebf ]

        C:\Users\Nicole\AppData\Roaming\Microsoft\Windows\Cookies\nicole@atdmt[2].txt [ /atdmt ]

        C:\Users\Nicole\AppData\Roaming\Microsoft\Windows\Cookies\nicole@content.yieldmanager[1].txt [ /content.yieldmanager ]

        C:\Users\Nicole\AppData\Roaming\Microsoft\Windows\Cookies\J102OA0Y.txt [ /doubleclick.net ]

        C:\Users\Nicole\AppData\Roaming\Microsoft\Windows\Cookies\5HTN1FV0.txt [ /mediaplex.com ]

        C:\Users\Nicole\AppData\Roaming\Microsoft\Windows\Cookies\LXQP8XL0.txt [ /smartadserver.com ]

        C:\USERS\NICOLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\nicole@doubleclick[2].txt [ Cookie:nicole@doubleclick.net/ ]

        C:\USERS\NICOLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\nicole@serving-sys[2].txt [ Cookie:nicole@serving-sys.com/ ]

        C:\USERS\NICOLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\nicole@kaspersky.122.2o7[1].txt [ Cookie:nicole@kaspersky.122.2o7.net/ ]

        C:\USERS\NICOLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\nicole@mediaplex[2].txt [ Cookie:nicole@mediaplex.com/ ]

        C:\USERS\NICOLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\nicole@ad.yieldmanager[2].txt [ Cookie:nicole@ad.yieldmanager.com/ ]

        C:\USERS\NICOLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\nicole@ad2.adfarm1.adition[1].txt [ Cookie:nicole@ad2.adfarm1.adition.com/ ]

        C:\USERS\NICOLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\nicole@content.yieldmanager[1].txt [ Cookie:nicole@content.yieldmanager.com/ ]

        C:\USERS\NICOLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\nicole@adfarm1.adition[1].txt [ Cookie:nicole@adfarm1.adition.com/ ]

        C:\USERS\NICOLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\nicole@imrworldwide[2].txt [ Cookie:nicole@imrworldwide.com/cgi-bin ]

        C:\USERS\NICOLE\Cookies\J102OA0Y.txt [ Cookie:nicole@doubleclick.net/ ]

        C:\USERS\NICOLE\Cookies\5HTN1FV0.txt [ Cookie:nicole@mediaplex.com/ ]

        C:\USERS\NICOLE\Cookies\nicole@ad.yieldmanager[1].txt [ Cookie:nicole@ad.yieldmanager.com/ ]

        C:\USERS\NICOLE\Cookies\nicole@atdmt[2].txt [ Cookie:nicole@atdmt.com/ ]

        C:\USERS\NICOLE\Cookies\nicole@content.yieldmanager[1].txt [ Cookie:nicole@content.yieldmanager.com/ ]

        C:\USERS\NICOLE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\NICOLE@REVSCI[1].TXT [ /REVSCI ]

        C:\USERS\NICOLE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\NICOLE@APMEBF[1].TXT [ /APMEBF ]

        C:\USERS\NICOLE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\NICOLE@GOOGLEADS.G.DOUBLECLICK[2].TXT [ /GOOGLEADS.G.DOUBLECLICK ]

        C:\USERS\NICOLE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\NICOLE@SPECIFICCLICK[1].TXT [ /SPECIFICCLICK ]

        .statcounter.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .mmotraffic.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .mmotraffic.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .libri.112.2o7.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        tracking.sim-technik.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.netdebit-counter.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .gostats.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .gostats.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        7.rotator.wigetmedia.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        7.rotator.wigetmedia.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        7.rotator.wigetmedia.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .insightexpressai.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .insightexpressai.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tribalfusion.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .ad-emea.doubleclick.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .ad-emea.doubleclick.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .ad-emea.doubleclick.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .unister-adservices.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .unister-adservices.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .unister-adservices.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .lfstmedia.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .lfstmedia.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .guj.122.2o7.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        server.adform.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        server.adform.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .clickfuse.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .qnsr.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        o1.qnsr.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        e1.cdn.qnsr.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        e1.cdn.qnsr.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        e1.cdn.qnsr.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        e1.cdn.qnsr.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.qsstats.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.qsstats.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .at.atwola.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tacoda.at.atwola.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tacoda.at.atwola.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tacoda.at.atwola.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tacoda.at.atwola.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .at.atwola.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tacoda.at.atwola.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tacoda.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .ar.atwola.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .atwola.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .questionmarket.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .questionmarket.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        servestats.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        servestats.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        keyword-advertising.web.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        keyword-advertising.web.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        keyword-advertising.web.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        keyword-advertising.web.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        banner.testberichte.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .2o7.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .kontera.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        track.prd1.netshelter.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .de.partypoker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        s06.flagcounter.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad3.adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad1.adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.etracker.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad4.adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        track.effiliation.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .dyntracker.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .zanox-affiliate.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.zanox-affiliate.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adform.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        a.visualrevenue.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ww251.smartadserver.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .clickfuse.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\NICOLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D88WYTYQ.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        studivz.adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        eas.apm.emediate.eu [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .statcounter.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad4.adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad3.adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad3.adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad.adition.net [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        adfarm1.adition.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        www.googleadservices.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\SURFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D2RQ1DAI.DEFAULT\COOKIES.SQLITE ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD.ADSERVER01[2].TXT [ /AD.ADSERVER01 ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ATDMT[2].TXT [ /ATDMT ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@BIZZCLICK[2].TXT [ /BIZZCLICK ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADMARKETPLACE[1].TXT [ /ADMARKETPLACE ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADTECH[1].TXT [ /ADTECH ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@APMEBF[1].TXT [ /APMEBF ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADVERTISE[1].TXT [ /ADVERTISE ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@INVITEMEDIA[1].TXT [ /INVITEMEDIA ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@MEDIA6DEGREES[1].TXT [ /MEDIA6DEGREES ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@CLICKPAYZ7.91469.INFORMATION-SEEKING[1].TXT [ /CLICKPAYZ7.91469.INFORMATION-SEEKING ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADS.PUBMATIC[1].TXT [ /ADS.PUBMATIC ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@CONTENT.YIELDMANAGER[1].TXT [ /CONTENT.YIELDMANAGER ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@FASTCLICK[2].TXT [ /FASTCLICK ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ZANOX[1].TXT [ /ZANOX ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@ADVERTISING.GOSSIPCENTER[2].TXT [ /ADVERTISING.GOSSIPCENTER ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRIBALFUSION[2].TXT [ /TRIBALFUSION ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRADEDOUBLER[1].TXT [ /TRADEDOUBLER ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@WWW.SELLMEYOURTRAFFIC[1].TXT [ /WWW.SELLMEYOURTRAFFIC ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@TRAFFICTRACK[2].TXT [ /TRAFFICTRACK ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@AD.ADITION[2].TXT [ /AD.ADITION ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@BRIDGE1.ADMARKETPLACE[1].TXT [ /BRIDGE1.ADMARKETPLACE ]

        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\SYSTEM@CLICKS.FASTGETONLINE[1].TXT [ /CLICKS.FASTGETONLINE ]
 

Trojan.Service

        C:\USERS\NICOLE\SETUP-DATEIEN\MICROSOFT MONEY\SYSTEM\SERVICE.EXE

Grüße, Nicole

Das sind nur Cookies bei den Funden von SASW das harmlos.

Wegen MBAM Und ESET hast du das schon geprüft?

Falsche Proxy Einstellungen entfernen

Klicke im Start-Menü unter "Einstellungen" auf "Systemsteuerung" -> "Internetoptionen".
Wähle die Karteikarte "Verbindungen->Lan-Einstellungen“ und überprüfe ob bei Proxyserver ein Häkchen steht,
wenn ja -> Entfernen, dann -> OK (sofern nicht richtige Eintragung)

Also bei den Proxy Einstellungen habe ich keinen Haken an der entsprechenden Stelle. Auch die offiziellen Seiten von Malewarebytes und ESET funktionieren nicht.
Habe beide Programme aber auch bei CHIP gefunden:
hxxp://www.chip.de/downloads/Malwarebytes-Anti-Malware_27322637.html
und
hxxp://www.chip.de/downloads/Eset-Smart-Security-32-Bit_49139264.html

Passt das auch?

Zitat:

Passt das auch?

Nur Malwarebytes. ESET ist ein OnlineScanner, den kann man so nicht über Chip ausführen
Mach erstmal nur Malwarebytes

Hier der Log von Malewarebytes, die gefundenen Viren habe ich noch nicht entfernt.

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.03.28.03
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Nicole :: NICOLEACER [Administrator]
 

Schutz: Aktiviert
 

28.03.2012 15:58:56

mbam-log-2012-03-28 (18-11-58).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 426197

Laufzeit: 1 Stunde(n), 41 Minute(n), 53 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 4

C:\Qoobox\Quarantine\C\Users\Nicole\AppData\Roaming\2E32.tmp.vir (Trojan.Inject) -> Keine Aktion durchgeführt.

C:\Qoobox\Quarantine\C\Users\Nicole\AppData\Roaming\8343.tmp.vir (Trojan.Inject) -> Keine Aktion durchgeführt.

C:\Qoobox\Quarantine\C\Users\Nicole\AppData\Roaming\Temqmj.exe.vir (Trojan.Inject) -> Keine Aktion durchgeführt.

C:\_OTL\MovedFiles\03202012_141948\C_Users\Nicole\AppData\Roaming\Temqmj.exe (Trojan.Inject) -> Keine Aktion durchgeführt.
 

(Ende)

Grüße Nicole : )

Das ist ok. In C:\Qoobox bzw. C:\_OTL (Q-Ordner von CF und OTL) sind die Schädlinge isoliert und gut aufgehoben.

Probier ESET nochmal aus

Mit derm InternetExplorer hat ESET jetzt doch noch gekalppt. Hier der Log:

Code:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=a1cb4e0a2a969d4092dedf6ea293f365

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-03-29 10:18:28

# local_time=2012-03-29 12:18:28 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=1797 16775165 100 94 2153 69546163 0 0

# compatibility_mode=5892 16776574 100 100 2480935 170542070 0 0

# compatibility_mode=8192 67108863 100 0 91 91 0 0

# scanned=201104

# found=9

# cleaned=0

# scan_time=6964

C:\Qoobox\Quarantine\C\Users\Nicole\AppData\Roaming\2E32.tmp.vir        Win32/Dorkbot.B worm (unable to clean)        00000000000000000000000000000000        I

C:\Qoobox\Quarantine\C\Users\Nicole\AppData\Roaming\8343.tmp.vir        Win32/Dorkbot.B worm (unable to clean)        00000000000000000000000000000000        I

C:\Qoobox\Quarantine\C\Users\Nicole\AppData\Roaming\C3F9.tmp.vir        a variant of Win32/Injector.OZK trojan (unable to clean)        00000000000000000000000000000000        I

C:\Qoobox\Quarantine\C\Users\Nicole\AppData\Roaming\Temqmj.exe.vir        Win32/Dorkbot.B worm (unable to clean)        00000000000000000000000000000000        I

C:\Users\Nicole\Desktop\SoftonicDownloader_fuer_kaspersky-tdsskiller - Kopie.exe        Win32/SoftonicDownloader.D application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Nicole\Desktop\SoftonicDownloader_fuer_kaspersky-tdsskiller.exe        Win32/SoftonicDownloader.D application (unable to clean)        00000000000000000000000000000000        I

C:\_OTL\MovedFiles\03202012_141948\C_Users\Nicole\AppData\Roaming\Temqmj.exe        Win32/Dorkbot.B worm (unable to clean)        00000000000000000000000000000000        I

D:\Uni\Uni MATHE\Mathe-Didaktik\6.Semeser\SoftonicDownloader69372.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

${Memory}        a variant of Win32/Dorkbot.B worm        00000000000000000000000000000000        I

Grüße, Nicole

Wie gesagt, Finger weg von dem Softonic-Müll! Der Rest ist die Q von OTL und Combofix

Rechner soweit wieder ohne Probleme?

Hmm, also das Problem war ja eigentlich der USB-Stick und das ich keinen Zugriff mehr auf die Daten habe. Es geht eigentlich nur um einige Pdf-Dateien, die sich nach wie vor nicht öffnen lassen bzw. als Fehlermeldung erhalte ich, dass der Dateityp nicht unterstützt wird oder die Datei beschädigt ist.

Die Dateien sind gescannte Buchkapitel, die das Kopiergerät automatisch auf meinem USB-Stick als .pdf gespeichert hat. Einige wenige lassen sich auch noch ganz normal öffnen.

Ebenso sind die Ordner auf meine USB-Stick nach wie vor Verknüpfungen mit dem Ziel "system32"...

Meinst du denn, dass da überhaupt noch eine Chance besteht die Datein zu retten/reparieren ?

Grüße, Nicole

Lass dir zuerst mal alle Dateien anzeigen => http://www.trojaner-board.de/59624-a...-sichtbar.html
Danach sollte auch alle Ordner wieder angezeigt werden - halbtransparent, da sie noch die Atrribute "versteckt" und "system" tragen

Starte anschließend die Eingabeaufforderung über Start, Alle Programme, Zubehör

Musst in der Eingabeauforderung jeweils für jeden versteckten Ordner diesen Befehl ausführen:

Code:

attrib -s -h "x:\ordner" /s /d

x: => Muss angepasst werden, den passenden Buchstaben verwenden
"ordner" muss dann der jew. richtige Ordnername sein

Vgl. diesen Strang => http://www.trojaner-board.de/102950-...traeger-2.html

Hallo Cosinus,

das hat super geklappt und alle Ordner sind wieder da. Allerdings kann ich immer noch nicht auf alle Dateien in den Ordnern zugreifen. Es kommt die gleiche Fehlermeldung wie vorher.
Als das Problem aufgetreten ist, habe ich erstmal alle Dateien aus den Ordnern, die ich noch öffnen konnte aus den Ordnern raus kopiert,sowie teilweise umbenannt (nach funktioniert/funktioniert nicht). Hängt das vielleicht damit zusammen?

Danke weiterhin für deine Hilfe!! Grüße, Nicole

Zitat:

Allerdings kann ich immer noch nicht auf alle Dateien in den Ordnern zugreifen. Es kommt die gleiche Fehlermeldung wie vorher.

Die Fake-Verknüpfungen musst du ja auch löschen! Die restlichen Ordner sind dann "deine"

Habe die Fake-Verknüpfungen gelöscht, aber das Problem bleibt das gleiche : (

Was für ein Problem bleibt das gleiche?! Bitte genauer beschreiben!!
ich hab hier auch noch andere Leute die Hilfe wollen und ich kann nicht bei jedem Strang erstmal wieder alle Antworten durchlesen um zu wissen was für ein Problem du noch haben könntest :(

Hallo Cosinus,

Zitat:

Es geht eigentlich nur um einige Pdf-Dateien, die sich nach wie vor nicht öffnen lassen bzw. als Fehlermeldung erhalte ich:

"Adobe Reader konnte "Titel des Textes.pdf" nicht öffnen, da der Dateityp nicht unterstützt wird oder die Datei beschädigt ist (z.B. wenn sie als E-Mail-Anhang geschickt und nicht korrekt dekodiert wurde)."

Auch mit einem weiteren pdf-Reader kann ich die Dateien nicht öffnen.

Zitat:

Die Dateien sind gescannte Buchkapitel, die das Kopiergerät automatisch auf meinem USB-Stick als .pdf gespeichert hat. Einige wenige lassen sich auch noch ganz normal öffnen.

Zitat:

Als das Problem aufgetreten ist, habe ich erstmal alle Dateien aus den Ordnern, die ich noch öffnen konnte aus den Ordnern raus kopiert,sowie teilweise umbenannt (nach funktioniert/funktioniert nicht). Hängt das vielleicht damit zusammen?

Ich hoffe jetzt hast du alle Infos, die du brauchst! Grüße, Nicole

Zitat:

Auch mit einem weiteren pdf-Reader kann ich die Dateien nicht öffnen.

Du hast natürlich keine Backups (Sicherheitskopien) dieser PDFs, stimmts :pfeiff:
Wenn die PDFs vorher zu öffnen waren, dann sind die Dateien wohl jetzt korrupt
Man darf halt eben wichtiges Zeug nicht ständig nur auf einem Stick gespeichert lassen, v.a. wenn da nur FAT32 als Dateisystem verwendet wird. Dieses FAT-Dateisystem stammt aus längst vergangenen DOS-Zeiten und wird sehr schnell inkonsistent was zu Datenverlusten führt
Wichtige Dateien lässt man NIEMALS nur auf einen Datenträger, es ist viel zu unsicher die wichtigsten Daten von einem einzigen Datenträger abhängig zu machen!!:kloppen:

Mit Glück hilft noch eine Überprüfung des Sticks mit chkdsk

1. Klick mit rechts auf einen freien Bereich auf dem Desktop und sag "Neu, Verknüpfung erstellen"
2. Tipp als Ziel cmd.exe ein und bestätige mit OK, eine neue Verknüpfung zur Konsole auf dem Desktop müsste sich nun befinden
3. Falls dem so ist, diese neue Verknüpfung rechtsklicken => Als Administrator ausführen => Sicherheitsabfrage von Vista Benutzerkontensteuerung ggf. bestätigen => schwarze Eingabeaufforderung öffnet sich
4. Tipp dort ein: chkdsk x: /f /r /v und bestätige mit enter. => statt x tippst du den Laufwerksbuchstaben deines Sticks ein!
5. Die folgende Abfrage mit j bestätigen und enter drücken.
6. Abwarten bis der Vorgang abgeschlossen ist. Bei großen Partitionen kann es u.U. recht lange dauern. Windows bootet automatisch neu.

Hallo Cosinus,
also die Überprüfung hat leider nichts ergeben. Schade, das heißt dann wohl dass die Dateien weg sind. :heulen:

Und übrigends mache ich regelmäßig Sicherungen meiner Daten, auch von diesem USB-Stick. Die Daten, die mir fehlen habe ich nur einige Tage vor dem Virus auf dem USB-Stick bekommen...

Naja, so ist das eben. Vielen Dank trotzdem für deine Hilfe und weiterhin viel Erfolg mit dem Board. MfG Nicole

Naja abgesehen davon wären wir durch. Was deine PDFs zerstört hat werden wir wohl nicht mehr erfahren

Welche anderen PDF-Reader hast du denn probiert? Da gibt es außer Adobe noch: Sumatra, PDF-X-Change, FoxitReader, auch IrfanView kann PDF lesen

Auch ein Versuch wert: Lad dir mal PDFsam (PDF Split & Merge) von hier => http://www.chip.de/downloads/PDF-Spl..._29495960.html

Vllt kannst du damit zwei kaputte PDF in eine funktionierende wieder gießen (Funktion "merge", mit split kannst du aus einer PDF zB seitenweise mehrere PDF-Dateien wieder machen)

Arbeite bei PDFsam unbedingt mit Sicherheitskopien falls was schiefgeht!