Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   My Start incredibar ... noch ein Opfer (https://www.trojaner-board.de/118697-my-start-incredibar-noch-opfer.html)

chnuschti 06.07.2012 13:36
My Start incredibar ... noch ein Opfer
 
Hallo zusammen

Auch auf meinem Rechner (Win7 64 bit Home premium) kommt ab und an dieser Virus.

Ich benutze meist Firefox (13.0), aber auch IE9 (32 bit). Bei beiden Browser startet in unregelmässigen Abständen der Suchbildschirm "my Start Incredibar".

Bis jetzt habe ich keine "grossen" Probleme, also keine Abstürze. Es kann sein, das das System etwas langsamer ist, muss aber nicht. Ich habe CCleaner laufen lassen und versucht unter Systemsteuerung das "Programm" zu deinstallieren.

Ich habe Malwarebytes laufen lassen und der hat eine Bedrohung gefunden (siehe log). Ansonsten habe ich AVG 2012 Business Version. Das läuft im Hintergrund, habe aber schon lange keinen Komplettscan mehr gemacht (sry!).

Vielen Dank für Eure Unterstützung.

cosinus 11.07.2012 16:07
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

chnuschti 11.07.2012 22:50
Hallo

Vielen Dank für Deine Hilfe.

Hier das Malwarebyte log von heute.

Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.11.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
CHV :: CHV-PC [Administrator]

Schutz: Deaktiviert

11.07.2012 20:32:46
mbam-log-2012-07-11 (22-00-48).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 396898
Laufzeit: 1 Stunde(n), 27 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\CHV\Downloads\YippyAlt_downloader_by_SchriftartenFontsde.exe (PUP.BundleInstaller.BI) -> Keine Aktion durchgeführt.

(Ende)

Und das Log vom 6.7.12

Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.06.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
CHV :: CHV-PC [Administrator]

Schutz: Aktiviert

06.07.2012 13:37:17
mbam-log-2012-07-06 (13-41-39).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 211097
Laufzeit: 2 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\CHV\Downloads\YippyAlt_downloader_by_SchriftartenFontsde.exe (PUP.BundleInstaller.BI) -> Keine Aktion durchgeführt.

(Ende)
Dann noch das ESET Log

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=7c0f19cd018d2f48925323838978e294
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-11 09:40:40
# local_time=2012-07-11 11:40:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1024 16777215 100 0 8304032 8304032 0 0
# compatibility_mode=5893 16776574 100 94 29997419 93667846 0 0
# compatibility_mode=8192 67108863 100 0 106 106 0 0
# scanned=204904
# found=5
# cleaned=0
# scan_time=4844
C:\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe        Win32/Toolbar.Widgi application (unable to clean)        00000000000000000000000000000000        I
C:\Users\CHV\Downloads\PDFCreator-1_2_3_setup.exe        Win32/Toolbar.Widgi application (unable to clean)        00000000000000000000000000000000        I
C:\Users\CHV\Downloads\SweetImSetup(1).exe        a variant of Win32/SweetIM.B application (unable to clean)        00000000000000000000000000000000        I
C:\Users\CHV\Downloads\SweetImSetup.exe        a variant of Win32/SweetIM.B application (unable to clean)        00000000000000000000000000000000        I
C:\Users\CHV\Downloads\YippyAlt_downloader_by_SchriftartenFontsde.exe        a variant of Win32/Somoto.A application (unable to clean)        00000000000000000000000000000000        I
Leider habe ich vergessen zu erwähnen, dass ich vor ca 2 Wochen noch den SUISA Screen hatte. Da habe ich dann das System auf die letzte Windows Aktualisierung zurück gesetzt und alles lief wieder einwandfrei. Sorry, ist in der Hitze des Gefechtes untergegangen.

Viele Grüsse

cosinus 12.07.2012 09:41
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

chnuschti 12.07.2012 12:53
Hallo Arne

1. Windows funktioniert ohne Probleme. Nach dem SUISA Screen habe ich auch nach Viren gesucht, AVG hat aber keine gefunden.

2. So weit ich mich erinnere fehlen keine Programme und es gibt auch keine leeren Ordner unter "alle Programme".

Gruss
Chris

cosinus 12.07.2012 14:49
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

chnuschti 12.07.2012 18:25
Hallo, hier das Logfile

Code:
# AdwCleaner v1.701 - Logfile created 07/12/2012 at 19:22:52
# Updated 02/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : CHV - CHV-PC
# Running from : C:\Users\CHV\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****

Found : Web Assistant Updater

***** [Files / Folders] *****

Folder Found : C:\Users\CHV\AppData\Roaming\pdfforge
Folder Found : C:\Program Files\Web Assistant
File Found : C:\Users\CHV\AppData\Roaming\Mozilla\Firefox\Profiles\gp2is56n.default\searchplugins\MyStart Search.xml
File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml

***** [Registry] *****

Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\IM
Key Found : HKCU\Software\ImInstaller
Key Found : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Key Found : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Key Found : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Found : HKLM\SOFTWARE\Web Assistant
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
[x64] Key Found : HKCU\Software\Conduit
[x64] Key Found : HKCU\Software\IM
[x64] Key Found : HKCU\Software\ImInstaller
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
[x64] Key Found : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
[x64] Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
[x64] Key Found : HKLM\SOFTWARE\Web Assistant
[x64] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Found : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
[x64] Key Found : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
[x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default
File : C:\Users\CHV\AppData\Roaming\Mozilla\Firefox\Profiles\gp2is56n.default\prefs.js

Found : user_pref("extensions.incredibar.admin", false);
Found : user_pref("extensions.incredibar.aflt", "orgnl");
Found : user_pref("extensions.incredibar.cntry", "CH");
Found : user_pref("extensions.incredibar.dfltLng", "EN");
Found : user_pref("extensions.incredibar.dfltSrch", false);
Found : user_pref("extensions.incredibar.did", "10643");
Found : user_pref("extensions.incredibar.envrmnt", "production");
Found : user_pref("extensions.incredibar.excTlbr", false);
Found : user_pref("extensions.incredibar.hdrMd5", "3DCF4DB4FDA67DA3381C3410E17283B7");
Found : user_pref("extensions.incredibar.hmpg", false);
Found : user_pref("extensions.incredibar.id", "74a755800000000000001a4bd68d313b");
Found : user_pref("extensions.incredibar.installerproductid", "26");
Found : user_pref("extensions.incredibar.instlDay", "15487");
Found : user_pref("extensions.incredibar.instlRef", "");
Found : user_pref("extensions.incredibar.isDcmntCmplt", true);
Found : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1410:26:54");
Found : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Found : user_pref("extensions.incredibar.newTab", false);
Found : user_pref("extensions.incredibar.noFFXTlbr", false);
Found : user_pref("extensions.incredibar.ppd", "1");
Found : user_pref("extensions.incredibar.prdct", "incredibar");
Found : user_pref("extensions.incredibar.productid", "26");
Found : user_pref("extensions.incredibar.propectorlck", 77833435);
Found : user_pref("extensions.incredibar.prtkHmpg", 1);
Found : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Found : user_pref("extensions.incredibar.sg", "none");
Found : user_pref("extensions.incredibar.smplGrp", "none");
Found : user_pref("extensions.incredibar.tlbrId", "base");
Found : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQyDxVGXp&loc=IB_T[...]
Found : user_pref("extensions.incredibar.upn2", "6PQyDxVGXp");
Found : user_pref("extensions.incredibar.upn2n", "92542956060493043");
Found : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Found : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1410:26:54");
Found : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Found : user_pref("extensions.incredibar_i.aflt", "orgnl");
Found : user_pref("extensions.incredibar_i.dfltLng", "");
Found : user_pref("extensions.incredibar_i.did", "10643");
Found : user_pref("extensions.incredibar_i.excTlbr", false);
Found : user_pref("extensions.incredibar_i.id", "74a755800000000000001a4bd68d313b");
Found : user_pref("extensions.incredibar_i.installerproductid", "26");
Found : user_pref("extensions.incredibar_i.instlDay", "15487");
Found : user_pref("extensions.incredibar_i.instlRef", "");
Found : user_pref("extensions.incredibar_i.ms_url_id", "");
Found : user_pref("extensions.incredibar_i.newTab", false);
Found : user_pref("extensions.incredibar_i.ppd", "1");
Found : user_pref("extensions.incredibar_i.prdct", "incredibar");
Found : user_pref("extensions.incredibar_i.productid", "26");
Found : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Found : user_pref("extensions.incredibar_i.smplGrp", "none");
Found : user_pref("extensions.incredibar_i.tlbrId", "base");
Found : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQyDxVGXp&loc=IB[...]
Found : user_pref("extensions.incredibar_i.upn2", "6PQyDxVGXp");
Found : user_pref("extensions.incredibar_i.upn2n", "92542956060493043");
Found : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Found : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1410:26:54");
Found : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Found : user_pref("keyword.URL", "hxxp://mystart.incredibar.com/mb143/?loc=IB_DS&a=6PQyDxVGXp&&i=26&search="[...]
Found : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

*************************

AdwCleaner[R1].txt - [9020 octets] - [12/07/2012 19:22:52]

########## EOF - C:\AdwCleaner[R1].txt - [9148 octets] ##########

cosinus 12.07.2012 19:38
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

chnuschti 12.07.2012 21:44
Hallo Arne

So, alles ausgeführt. Windows hat gemeldet, dass das Programm evtl malware installieren kann. Ich habe "zulassen" gedrückt und dann wurde Windows beendet.

Code:
# AdwCleaner v1.701 - Logfile created 07/12/2012 at 22:38:56
# Updated 02/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : CHV - CHV-PC
# Running from : C:\Users\CHV\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : Web Assistant Updater

***** [Files / Folders] *****

Folder Deleted : C:\Users\CHV\AppData\Roaming\pdfforge
Folder Deleted : C:\Program Files\Web Assistant
File Deleted : C:\Users\CHV\AppData\Roaming\Mozilla\Firefox\Profiles\gp2is56n.default\searchplugins\MyStart Search.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml

***** [Registry] *****

Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Deleted : HKLM\SOFTWARE\Web Assistant
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
[x64] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
[x64] Key Deleted : HKLM\SOFTWARE\Web Assistant

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default
File : C:\Users\CHV\AppData\Roaming\Mozilla\Firefox\Profiles\gp2is56n.default\prefs.js

C:\Users\CHV\AppData\Roaming\Mozilla\Firefox\Profiles\gp2is56n.default\user.js ... Deleted !

Deleted : user_pref("extensions.incredibar.admin", false);
Deleted : user_pref("extensions.incredibar.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar.cntry", "CH");
Deleted : user_pref("extensions.incredibar.dfltLng", "EN");
Deleted : user_pref("extensions.incredibar.dfltSrch", false);
Deleted : user_pref("extensions.incredibar.did", "10643");
Deleted : user_pref("extensions.incredibar.envrmnt", "production");
Deleted : user_pref("extensions.incredibar.excTlbr", false);
Deleted : user_pref("extensions.incredibar.hdrMd5", "3DCF4DB4FDA67DA3381C3410E17283B7");
Deleted : user_pref("extensions.incredibar.hmpg", false);
Deleted : user_pref("extensions.incredibar.id", "74a755800000000000001a4bd68d313b");
Deleted : user_pref("extensions.incredibar.installerproductid", "26");
Deleted : user_pref("extensions.incredibar.instlDay", "15487");
Deleted : user_pref("extensions.incredibar.instlRef", "");
Deleted : user_pref("extensions.incredibar.isDcmntCmplt", true);
Deleted : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1410:26:54");
Deleted : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Deleted : user_pref("extensions.incredibar.newTab", false);
Deleted : user_pref("extensions.incredibar.noFFXTlbr", false);
Deleted : user_pref("extensions.incredibar.ppd", "1");
Deleted : user_pref("extensions.incredibar.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar.productid", "26");
Deleted : user_pref("extensions.incredibar.propectorlck", 77833435);
Deleted : user_pref("extensions.incredibar.prtkHmpg", 1);
Deleted : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar.sg", "none");
Deleted : user_pref("extensions.incredibar.smplGrp", "none");
Deleted : user_pref("extensions.incredibar.tlbrId", "base");
Deleted : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQyDxVGXp&loc=IB_T[...]
Deleted : user_pref("extensions.incredibar.upn2", "6PQyDxVGXp");
Deleted : user_pref("extensions.incredibar.upn2n", "92542956060493043");
Deleted : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1410:26:54");
Deleted : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar_i.dfltLng", "");
Deleted : user_pref("extensions.incredibar_i.did", "10643");
Deleted : user_pref("extensions.incredibar_i.excTlbr", false);
Deleted : user_pref("extensions.incredibar_i.id", "74a755800000000000001a4bd68d313b");
Deleted : user_pref("extensions.incredibar_i.installerproductid", "26");
Deleted : user_pref("extensions.incredibar_i.instlDay", "15487");
Deleted : user_pref("extensions.incredibar_i.instlRef", "");
Deleted : user_pref("extensions.incredibar_i.ms_url_id", "");
Deleted : user_pref("extensions.incredibar_i.newTab", false);
Deleted : user_pref("extensions.incredibar_i.ppd", "1");
Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar_i.productid", "26");
Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar_i.smplGrp", "none");
Deleted : user_pref("extensions.incredibar_i.tlbrId", "base");
Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQyDxVGXp&loc=IB[...]
Deleted : user_pref("extensions.incredibar_i.upn2", "6PQyDxVGXp");
Deleted : user_pref("extensions.incredibar_i.upn2n", "92542956060493043");
Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1410:26:54");
Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Deleted : user_pref("keyword.URL", "hxxp://mystart.incredibar.com/mb143/?loc=IB_DS&a=6PQyDxVGXp&&i=26&search="[...]
Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

*************************

AdwCleaner[R1].txt - [9101 octets] - [12/07/2012 19:22:52]
AdwCleaner[S1].txt - [8017 octets] - [12/07/2012 22:38:56]

########## EOF - C:\AdwCleaner[S1].txt - [8145 octets] ##########

cosinus 13.07.2012 11:15
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

chnuschti 13.07.2012 14:51
Hallo Arne

Hier das Log. Es ist ziemlich gross !! Vielen Dank für Deine Arbeit.

OTL Logfile:
Code:
OTL logfile created on: 13.07.2012 15:22:36 - Run 2
OTL by OldTimer - Version 3.2.54.0    Folder = C:\Users\CHV\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
3,79 Gb Total Physical Memory | 2,29 Gb Available Physical Memory | 60,25% Memory free
7,59 Gb Paging File | 5,37 Gb Available in Paging File | 70,75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116,44 Gb Total Space | 45,88 Gb Free Space | 39,40% Space Free | Partition Type: NTFS
Drive D: | 334,67 Gb Total Space | 210,98 Gb Free Space | 63,04% Space Free | Partition Type: NTFS
 
Computer Name: CHV-PC | User Name: CHV | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.13 15:19:39 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\CHV\Desktop\OTL.exe
PRC - [2012.07.04 17:25:54 | 005,160,568 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe
PRC - [2012.05.26 06:32:24 | 004,327,744 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\CHV\AppData\Local\Akamai\netsession_win.exe
PRC - [2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\CHV\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012.04.05 05:12:34 | 002,587,008 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.08.22 10:01:00 | 000,593,920 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
PRC - [2011.08.12 17:13:26 | 000,087,040 | ---- | M] () -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
PRC - [2011.04.08 14:50:02 | 000,542,264 | ---- | M] (Google) -- C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe
PRC - [2010.09.30 04:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
PRC - [2010.04.03 03:22:19 | 003,058,304 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe
PRC - [2010.01.13 18:19:42 | 000,182,912 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
PRC - [2010.01.13 18:11:52 | 007,109,248 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
PRC - [2010.01.05 22:59:12 | 000,170,624 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
PRC - [2009.11.24 22:45:36 | 000,053,888 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
PRC - [2009.11.02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2009.10.21 21:12:50 | 000,106,496 | ---- | M] (NEC Electronics Corporation) -- C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.09.16 02:34:34 | 001,593,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
PRC - [2009.08.01 02:36:14 | 002,680,160 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2009.07.31 22:23:22 | 000,354,128 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosHdpProc.exe
PRC - [2009.06.19 19:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
PRC - [2009.06.19 19:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
PRC - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
PRC - [2009.06.08 23:34:58 | 000,660,808 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2009.06.04 00:33:14 | 000,308,552 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
PRC - [2009.05.19 00:58:38 | 000,305,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
PRC - [2008.12.23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
PRC - [2008.08.14 06:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
PRC - [2008.07.30 18:04:06 | 000,678,960 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\NTI Shadow for ReadyNAS\Shadow.exe
PRC - [2008.07.24 20:24:24 | 000,083,272 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
PRC - [2007.11.22 11:49:08 | 000,385,024 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.12 08:55:57 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll
MOD - [2012.05.12 08:54:33 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.05.12 08:54:27 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.05.12 08:54:26 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.05.12 08:54:16 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011.08.22 10:01:00 | 001,515,520 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\Maps\R66Api.dll
MOD - [2011.08.22 10:01:00 | 000,593,920 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
MOD - [2011.08.22 10:01:00 | 000,559,244 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.7.dll
MOD - [2011.08.22 10:01:00 | 000,516,599 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.dll
MOD - [2011.08.22 10:01:00 | 000,389,120 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\HtcDetect.dll
MOD - [2011.08.22 10:01:00 | 000,139,264 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDisk.dll
MOD - [2011.08.22 10:01:00 | 000,139,264 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDetectLegend.dll
MOD - [2011.08.22 10:01:00 | 000,094,208 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\fdHttpd.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009.11.24 22:45:36 | 000,053,888 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
MOD - [2009.11.02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2009.11.02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
MOD - [2009.09.16 02:34:34 | 001,593,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
MOD - [2008.05.26 10:52:52 | 000,217,088 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\NTI Shadow for ReadyNAS\NinjaDLL.DLL
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.10.13 15:19:00 | 000,020,480 | ---- | M] (Oki Data Corporation) [Auto | Running] -- C:\Windows\SysNative\spool\drivers\x64\3\OPHPLDCS.EXE -- (DCSLoader)
SRV:64bit: - [2009.09.17 20:36:34 | 000,359,552 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent)
SRV:64bit: - [2009.08.06 23:17:46 | 000,118,672 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012.07.12 13:25:19 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.04 17:25:54 | 005,160,568 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012.07.03 05:37:52 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai)
SRV - [2012.06.28 17:00:43 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.08.12 17:13:26 | 000,087,040 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2011.01.14 17:34:31 | 000,069,632 | ---- | M] (Macromedia) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
SRV - [2010.09.30 04:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor9.0)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) [Auto | Stopped] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2009.10.13 15:19:00 | 000,020,480 | ---- | M] (Oki Data Corporation) [Auto | Running] -- C:\Windows\system32\spool\DRIVERS\x64\3\OPHPLDCS.EXE -- (DCSLoader)
SRV - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009.07.31 06:20:36 | 000,192,368 | ---- | M] (TOSHIBA CORPORATION) [On_Demand | Running] -- C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.04.19 04:50:26 | 000,028,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:64bit: - [2012.03.19 05:17:26 | 000,383,808 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.22 05:25:32 | 000,289,872 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2012.01.31 04:46:48 | 000,036,944 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2011.12.23 13:32:14 | 000,047,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2011.12.23 13:32:04 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avgidsfiltera.sys -- (AVGIDSFilter)
DRV:64bit: - [2011.12.23 13:31:58 | 000,124,496 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:64bit: - [2011.11.24 23:23:32 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV:64bit: - [2011.11.24 23:23:28 | 000,098,616 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.08.25 20:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.06.25 16:08:10 | 000,036,928 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\htcnprot.sys -- (htcnprot)
DRV:64bit: - [2010.03.19 04:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009.12.17 04:42:07 | 000,538,136 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.11.01 19:16:50 | 000,033,736 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys -- (HTCAND64)
DRV:64bit: - [2009.10.30 00:56:33 | 000,244,736 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2009.10.27 08:19:48 | 000,176,640 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2009.10.27 08:19:46 | 000,075,264 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2009.10.26 06:39:43 | 000,151,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.10.15 11:23:19 | 000,117,760 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2009.10.05 18:33:59 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.09.17 21:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009.09.04 07:39:07 | 000,062,464 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20)
DRV:64bit: - [2009.08.20 20:41:37 | 001,800,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV:64bit: - [2009.08.06 23:17:34 | 000,013,784 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2009.07.29 05:02:10 | 000,081,768 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tosrfcom.sys -- (Tosrfcom)
DRV:64bit: - [2009.07.29 03:38:00 | 000,058,488 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosrfusb.sys -- (Tosrfusb)
DRV:64bit: - [2009.07.24 20:33:14 | 000,026,472 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosrfnds.sys -- (tosrfnds)
DRV:64bit: - [2009.07.21 03:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.07.08 06:39:08 | 000,211,432 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosrfbd.sys -- (tosrfbd)
DRV:64bit: - [2009.06.19 19:00:26 | 000,094,336 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV:64bit: - [2009.06.19 18:59:32 | 000,050,664 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV:64bit: - [2009.06.18 21:18:10 | 000,015,928 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\lullaby.sys -- (lullaby)
DRV:64bit: - [2009.06.17 21:01:04 | 000,054,664 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tosporte.sys -- (tosporte)
DRV:64bit: - [2009.06.10 22:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.13 18:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2008.12.08 17:35:52 | 000,061,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2008.05.24 02:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
 
 
IE - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
IE - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.ch/
IE - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "https://www.google.ch/"
FF - prefs.js..extensions.enabledItems: {6AC85730-7D0F-4de0-B3FA-21142DD85326}:2.2.2
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012.07.06 08:52:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.28 17:00:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.02 17:47:19 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.28 17:00:45 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.02 17:47:19 | 000,000,000 | ---D | M]
 
[2010.09.10 18:34:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\CHV\AppData\Roaming\mozilla\Extensions
[2012.06.14 15:25:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\CHV\AppData\Roaming\mozilla\Firefox\Profiles\gp2is56n.default\extensions
[2012.06.14 15:25:42 | 000,000,000 | ---D | M] (ColorZilla) -- C:\Users\CHV\AppData\Roaming\mozilla\Firefox\Profiles\gp2is56n.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
[2011.12.27 08:15:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.06.28 17:00:44 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.28 17:00:39 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.28 17:00:39 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.28 17:00:39 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.28 17:00:39 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.28 17:00:39 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.28 17:00:39 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [ITSecMng] C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
O4 - HKLM..\Run: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 File not found
O4 - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-157396543-2902838383-1951362165-1000..\Run: [Akamai NetSession Interface] C:\Users\CHV\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKU\S-1-5-21-157396543-2902838383-1951362165-1000..\Run: [Shadow] C:\Program Files (x86)\NewTech Infosystems\NTI Shadow for ReadyNAS\Shadow.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [InnoSetupRegFile.0000000001] C:\Windows\is-22ELP.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\CHV\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\CHV\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\CHV\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Medien-Prüfung.lnk = C:\Program Files (x86)\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (Sony Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{54EB1D62-D7CC-4B41-A348-A07A01F20576}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C45F7E3B-BA71-4737-A366-65694BACE913}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
 
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: ASUS Screen Saver Protector - hkey= - key= - C:\Windows\AsScrPro.exe (ASUS)
MsConfig:64bit - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
MsConfig:64bit - StartUpReg: MDS_Menu - hkey= - key= - C:\Program Files (x86)\Cyberlink\MediaShowEspresso\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: PDVD9LanguageShortcut - hkey= - key= - C:\Program Files (x86)\Cyberlink\PowerDVD9\Language\Language.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: RemoteControl9 - hkey= - key= - C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
MsConfig:64bit - StartUpReg: UpdateLBPShortCut - hkey= - key= - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: UpdateP2GoShortCut - hkey= - key= - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: UpdatePSTShortCut - hkey= - key= - C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3E9825E5-5381-BF77-5756-D3C02F3C9FD3} - Microsoft Windows Media Player 12.0
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {9751CC7C-CD13-8002-7200-0798A2AF3CF9} - Microsoft Windows Media Player
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CCC4DF9A-01BD-6421-6509-D05705CFED9F} - Themes Setup
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.13 15:20:04 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\CHV\Desktop\OTL.exe
[2012.07.11 22:18:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.07.11 20:31:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.11 20:31:30 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.11 20:31:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.07.06 14:30:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.07.06 14:30:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip
[2012.07.06 13:30:34 | 000,000,000 | ---D | C] -- C:\Users\CHV\AppData\Roaming\Malwarebytes
[2012.07.06 13:30:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.06 11:45:30 | 000,000,000 | ---D | C] -- C:\Users\CHV\AppData\Roaming\SpeedyPC Software
[2012.07.06 11:45:30 | 000,000,000 | ---D | C] -- C:\Users\CHV\AppData\Roaming\DriverCure
[2012.07.06 11:45:16 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedyPC Software
[2012.07.06 08:52:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012.07.02 21:00:23 | 000,000,000 | ---D | C] -- C:\Users\CHV\AppData\Roaming\NCH Software
[2012.06.21 19:53:40 | 000,000,000 | ---D | C] -- C:\Users\CHV\AppData\Local\IsolatedStorage
[2012.06.21 19:50:44 | 000,000,000 | ---D | C] -- C:\ProgramData\PROFFIX
[2012.06.21 19:41:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PROFFIX
[2012.06.21 19:41:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PROFFIX
[2012.06.21 19:38:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2011.05.20 13:18:07 | 000,122,880 | ---- | C] (Acresso Software Inc.) -- C:\Users\CHV\SetupNI.dll
[2008.08.12 06:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.13 15:30:04 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.13 15:25:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.13 15:19:39 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\CHV\Desktop\OTL.exe
[2012.07.13 15:17:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.13 13:23:35 | 101,418,443 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012.07.13 11:11:45 | 000,711,240 | ---- | M] () -- C:\Windows\is-22ELP.exe
[2012.07.13 11:11:45 | 000,012,842 | ---- | M] () -- C:\Windows\is-22ELP.msg
[2012.07.13 11:11:45 | 000,000,459 | ---- | M] () -- C:\Windows\is-22ELP.lst
[2012.07.13 08:41:57 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe
[2012.07.13 08:14:52 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.13 08:14:52 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.13 08:07:40 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.13 08:07:18 | 3055,706,112 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.12 13:10:26 | 000,427,550 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012.07.12 09:59:54 | 005,020,888 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.09 19:45:19 | 000,000,681 | ---- | M] () -- C:\Users\CHV\Desktop\CHVetsch - Verknüpfung.lnk
[2012.07.06 18:03:15 | 000,001,949 | ---- | M] () -- C:\Users\Public\Desktop\Sonos.lnk
[2012.07.06 14:42:12 | 000,002,336 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2012.07.06 14:42:12 | 000,001,756 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2012.07.06 13:51:31 | 000,000,000 | ---- | M] () -- C:\Users\CHV\defogger_reenable
[2012.07.06 11:41:10 | 001,655,270 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.06 11:41:10 | 000,714,880 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.06 11:41:10 | 000,665,854 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.06 11:41:10 | 000,155,016 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.06 11:41:10 | 000,125,228 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.06 08:52:04 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2012.lnk
[2012.07.05 10:20:52 | 000,002,072 | -H-- | M] () -- D:\Default.rdp
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.21 19:41:50 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\PROFFIX.lnk
[2012.06.17 17:15:23 | 000,001,342 | ---- | M] () -- C:\Users\CHV\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
 
========== Files Created - No Company Name ==========
 
[2012.07.13 11:11:45 | 000,711,240 | ---- | C] () -- C:\Windows\is-22ELP.exe
[2012.07.13 11:11:45 | 000,012,842 | ---- | C] () -- C:\Windows\is-22ELP.msg
[2012.07.13 11:11:45 | 000,000,459 | ---- | C] () -- C:\Windows\is-22ELP.lst
[2012.07.09 19:45:19 | 000,000,681 | ---- | C] () -- C:\Users\CHV\Desktop\CHVetsch - Verknüpfung.lnk
[2012.07.06 13:51:31 | 000,000,000 | ---- | C] () -- C:\Users\CHV\defogger_reenable
[2012.06.21 19:41:50 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\PROFFIX.lnk
[2011.10.19 08:05:07 | 000,000,031 | ---- | C] () -- C:\Users\CHV\AppData\Roaming\Opusbext.dat
[2011.05.20 13:37:01 | 000,000,027 | ---- | C] () -- C:\Windows\BarCode.ini
[2011.05.20 13:36:10 | 000,032,768 | ---- | C] () -- C:\Windows\SysWow64\Rydll32.dll
[2011.05.20 13:32:28 | 001,674,876 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.12.14 10:53:55 | 000,000,000 | ---- | C] () -- C:\Users\CHV\AppData\Local\prvlcl.dat
[2010.10.21 10:21:26 | 000,149,504 | ---- | C] () -- C:\Windows\Unwise32.exe
[2010.09.10 18:34:15 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.08.25 20:34:30 | 000,870,560 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin
[2010.08.25 20:34:30 | 000,127,868 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin
[2010.08.25 20:34:30 | 000,104,796 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin
[2010.04.03 02:54:07 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2009.04.08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll
[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg
 
========== LOP Check ==========
 
[2012.02.10 15:01:14 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Amazon
[2010.09.08 16:26:42 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Asus WebStorage
[2011.11.17 11:52:15 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\ATLAS_Ausfuhr
[2012.02.21 15:16:10 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\AusfuhrPortal
[2011.08.11 13:46:49 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Avery
[2012.04.06 19:41:13 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\AVG2012
[2011.12.29 18:34:59 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\calibre
[2011.03.20 15:34:32 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012.07.06 11:45:30 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\DriverCure
[2012.07.13 12:22:25 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Dropbox
[2011.01.28 19:08:56 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\freac
[2011.01.28 19:06:19 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\GetRightToGo
[2011.08.28 19:28:59 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\GitarreroMDemo
[2010.09.09 15:31:35 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\GoBoingo
[2011.10.14 10:56:44 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\HTC
[2011.04.22 19:19:17 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2010.10.19 14:26:47 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\ISL Online Cache
[2011.08.22 21:29:28 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Office Depot Labels Software
[2011.04.23 07:43:29 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Outlook
[2012.04.08 09:43:07 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\RavensburgerTipToi
[2012.07.06 11:45:30 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\SpeedyPC Software
[2011.01.23 14:41:46 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\TS3Client
[2012.01.22 12:10:52 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.10.14 13:14:52 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Adobe
[2012.02.10 15:01:14 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Amazon
[2010.09.08 16:26:42 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Asus WebStorage
[2011.11.17 11:52:15 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\ATLAS_Ausfuhr
[2012.02.21 15:16:10 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\AusfuhrPortal
[2011.08.11 13:46:49 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Avery
[2012.04.06 19:41:13 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\AVG2012
[2011.12.29 18:34:59 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\calibre
[2011.03.20 15:34:32 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.09.10 11:57:05 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\CyberLink
[2012.07.06 11:45:30 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\DriverCure
[2012.07.13 12:22:25 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Dropbox
[2011.01.28 19:08:56 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\freac
[2011.01.28 19:06:19 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\GetRightToGo
[2011.08.28 19:28:59 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\GitarreroMDemo
[2010.09.09 15:31:35 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\GoBoingo
[2010.09.10 11:46:33 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Google
[2011.10.14 10:56:44 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\HTC
[2011.04.22 19:19:17 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2010.09.08 16:19:22 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Identities
[2010.09.13 17:01:52 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\InstallShield
[2010.10.19 14:26:47 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\ISL Online Cache
[2011.01.14 17:35:21 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Macromedia
[2012.07.06 13:30:34 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Malwarebytes
[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Media Center Programs
[2012.06.29 02:51:57 | 000,000,000 | --SD | M] -- C:\Users\CHV\AppData\Roaming\Microsoft
[2010.09.10 18:34:22 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Mozilla
[2012.07.02 21:00:23 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\NCH Software
[2011.08.22 21:29:28 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Office Depot Labels Software
[2011.04.23 07:43:29 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Outlook
[2012.04.08 09:43:07 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\RavensburgerTipToi
[2010.10.29 09:49:11 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\Sony Corporation
[2012.07.06 11:45:30 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\SpeedyPC Software
[2011.01.23 14:41:46 | 000,000,000 | ---D | M] -- C:\Users\CHV\AppData\Roaming\TS3Client
 
< %APPDATA%\*.exe /s >
[2011.11.17 11:52:11 | 000,473,600 | ---- | M] () -- C:\Users\CHV\AppData\Roaming\AusfuhrPortal\Uninstall\uninstall.exe
[2011.06.03 16:50:06 | 002,300,272 | ---- | M] (Avery Dennison Corporation. Envel Informationssysteme GmbH.) -- C:\Users\CHV\AppData\Roaming\Avery\Avery Wizard 4.0\AZWizard.exe
[2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\CHV\AppData\Roaming\Dropbox\bin\Dropbox.exe
[2012.05.24 20:39:24 | 000,872,144 | ---- | M] (Dropbox, Inc.) -- C:\Users\CHV\AppData\Roaming\Dropbox\bin\DropboxUpdateHelper.exe
[2012.05.24 20:39:56 | 000,177,280 | ---- | M] (Dropbox, Inc.) -- C:\Users\CHV\AppData\Roaming\Dropbox\bin\Uninstall.exe
[2011.10.25 17:06:28 | 000,765,848 | ---- | M] (XLAB d.o.o.) -- C:\Users\CHV\AppData\Roaming\ISL Online Cache\ISL Network Start\1\extract_1319555188_6036_6328_22294\ISL_Light_Client_3_2_6.exe
[2012.01.10 09:44:06 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\CHV\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2011.02.13 10:44:44 | 000,117,427 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\CHV\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\digitaleditions\digitaleditions.exe
[2011.08.11 13:46:11 | 000,053,248 | R--- | M] (Flexera Software, Inc.) -- C:\Users\CHV\AppData\Roaming\Microsoft\Installer\{7196E6BD-4B65-43F9-9D30-73A8E58D0E84}\ARPPRODUCTICON.exe
[2011.05.20 13:37:08 | 000,010,134 | R--- | M] () -- C:\Users\CHV\AppData\Roaming\Microsoft\Installer\{EDEA8AB7-7683-4ED2-AA19-E6C078064C0D}\ARPPRODUCTICON.exe
[2011.05.20 13:37:08 | 000,001,078 | R--- | M] () -- C:\Users\CHV\AppData\Roaming\Microsoft\Installer\{EDEA8AB7-7683-4ED2-AA19-E6C078064C0D}\DocumentationShortcu_EDEA8AB776834ED2AA19E6C078064C0D.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2009.12.17 04:42:07 | 000,538,136 | ---- | M] (Intel Corporation) MD5=42E00996DFC13C46366689C0EA8ABC5E -- C:\eSupport\eDriver\Software\IRST\64\IASTOR.SYS
[2009.12.17 04:42:07 | 000,538,136 | ---- | M] (Intel Corporation) MD5=42E00996DFC13C46366689C0EA8ABC5E -- C:\Windows\SysNative\drivers\iaStor.sys
[2009.12.17 04:42:07 | 000,538,136 | ---- | M] (Intel Corporation) MD5=42E00996DFC13C46366689C0EA8ABC5E -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_f26ae7769ab43067\iaStor.sys
[2009.12.17 04:25:25 | 000,433,176 | ---- | M] (Intel Corporation) MD5=8CDACD4AD63D49834C6B59DB102E7CD7 -- C:\eSupport\eDriver\Software\IRST\32\IASTOR.SYS
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.04.03 02:40:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010.04.03 02:40:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.07.14 03:15:21 | 000,462,848 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\FirewallAPI.dll

< End of report >
--- --- ---


Viele Grüsse
Chris

cosinus 13.07.2012 20:55
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>
FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - user.js - File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-157396543-2902838383-1951362165-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
[2010.04.03 02:54:07 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

chnuschti 13.07.2012 21:52
Guten Abend Arne

Und noch ein Log :-). Ich habe erst beim Restart bemerkt, dass Malwarebytes noch aktiv war. AVG habe ich deaktiviert.
Vielen Dank für Deine Nachtschichten. Tolle Sache!
Gruss
Chris

Code:
All processes killed
========== OTL ==========
HKU\S-1-5-21-157396543-2902838383-1951362165-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "MyStart Search" removed from browser.search.defaultenginename
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\S-1-5-21-157396543-2902838383-1951362165-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_USERS\S-1-5-21-157396543-2902838383-1951362165-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_USERS\S-1-5-21-157396543-2902838383-1951362165-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
C:\ProgramData\FullRemove.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: CHV
->Temp folder emptied: 40937278 bytes
->Temporary Internet Files folder emptied: 4306533 bytes
->Java cache emptied: 9923880 bytes
->FireFox cache emptied: 897504523 bytes
->Flash cache emptied: 184114 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 29493 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67899 bytes
RecycleBin emptied: 1390228 bytes
 
Total Files Cleaned = 910,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: CHV
->Flash cache emptied: 0 bytes
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.54.0 log created on 07132012_224426

Files\Folders moved on Reboot...
C:\Users\CHV\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\CHV\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...

cosinus 13.07.2012 22:12
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

chnuschti 14.07.2012 00:15
Hallo

Hier das Log. Besten Dank und gute Nacht


Code:
01:10:23.0863 3716        TDSS rootkit removing tool 2.7.45.0 Jul  9 2012 12:46:35
01:10:23.0988 3716        ============================================================
01:10:23.0988 3716        Current date / time: 2012/07/14 01:10:23.0988
01:10:23.0988 3716        SystemInfo:
01:10:23.0988 3716       
01:10:23.0988 3716        OS Version: 6.1.7601 ServicePack: 1.0
01:10:23.0988 3716        Product type: Workstation
01:10:23.0988 3716        ComputerName: CHV-PC
01:10:23.0988 3716        UserName: CHV
01:10:23.0988 3716        Windows directory: C:\Windows
01:10:23.0988 3716        System windows directory: C:\Windows
01:10:23.0988 3716        Running under WOW64
01:10:23.0988 3716        Processor architecture: Intel x64
01:10:23.0988 3716        Number of processors: 4
01:10:23.0988 3716        Page size: 0x1000
01:10:23.0988 3716        Boot type: Normal boot
01:10:23.0988 3716        ============================================================
01:10:24.0768 3716        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
01:10:24.0783 3716        ============================================================
01:10:24.0783 3716        \Device\Harddisk0\DR0:
01:10:24.0783 3716        MBR partitions:
01:10:24.0783 3716        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1D4B178, BlocksNum 0xE8E0360
01:10:24.0799 3716        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1062B517, BlocksNum 0x29D5972A
01:10:24.0799 3716        ============================================================
01:10:24.0846 3716        C: <-> \Device\Harddisk0\DR0\Partition0
01:10:24.0877 3716        D: <-> \Device\Harddisk0\DR0\Partition1
01:10:24.0877 3716        ============================================================
01:10:24.0877 3716        Initialize success
01:10:24.0877 3716        ============================================================
01:11:00.0008 2556        ============================================================
01:11:00.0008 2556        Scan started
01:11:00.0008 2556        Mode: Manual; SigCheck; TDLFS;
01:11:00.0008 2556        ============================================================
01:11:01.0225 2556        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
01:11:01.0366 2556        1394ohci - ok
01:11:01.0444 2556        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
01:11:01.0475 2556        ACPI - ok
01:11:01.0537 2556        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
01:11:01.0631 2556        AcpiPmi - ok
01:11:01.0771 2556        AdobeActiveFileMonitor9.0 (1474f121c3df1232d3e7239c03691ee6) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
01:11:01.0787 2556        AdobeActiveFileMonitor9.0 - ok
01:11:01.0927 2556        AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
01:11:01.0958 2556        AdobeFlashPlayerUpdateSvc - ok
01:11:02.0036 2556        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
01:11:02.0083 2556        adp94xx - ok
01:11:02.0161 2556        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
01:11:02.0192 2556        adpahci - ok
01:11:02.0224 2556        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
01:11:02.0255 2556        adpu320 - ok
01:11:02.0286 2556        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
01:11:02.0458 2556        AeLookupSvc - ok
01:11:02.0536 2556        AFBAgent        (fb2be0bae9b3f248080cdbf91ef16c7f) C:\Windows\system32\FBAgent.exe
01:11:02.0567 2556        AFBAgent - ok
01:11:02.0645 2556        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
01:11:02.0723 2556        AFD - ok
01:11:02.0770 2556        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
01:11:02.0785 2556        agp440 - ok
01:11:03.0222 2556        Akamai          (29584f02a43e427c4227e3b1d9ff1b22) c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll
01:11:03.0222 2556        Suspicious file (Hidden): c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll. md5: 29584f02a43e427c4227e3b1d9ff1b22
01:11:03.0238 2556        Akamai ( HiddenFile.Multi.Generic ) - warning
01:11:03.0238 2556        Akamai - detected HiddenFile.Multi.Generic (1)
01:11:03.0362 2556        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
01:11:03.0394 2556        ALG - ok
01:11:03.0456 2556        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
01:11:03.0472 2556        aliide - ok
01:11:03.0487 2556        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
01:11:03.0503 2556        amdide - ok
01:11:03.0550 2556        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
01:11:03.0596 2556        AmdK8 - ok
01:11:03.0628 2556        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
01:11:03.0659 2556        AmdPPM - ok
01:11:03.0690 2556        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
01:11:03.0721 2556        amdsata - ok
01:11:03.0768 2556        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
01:11:03.0799 2556        amdsbs - ok
01:11:03.0815 2556        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
01:11:03.0846 2556        amdxata - ok
01:11:03.0893 2556        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
01:11:03.0986 2556        AppID - ok
01:11:04.0018 2556        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
01:11:04.0111 2556        AppIDSvc - ok
01:11:04.0189 2556        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
01:11:04.0267 2556        Appinfo - ok
01:11:04.0330 2556        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
01:11:04.0345 2556        arc - ok
01:11:04.0361 2556        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
01:11:04.0392 2556        arcsas - ok
01:11:04.0501 2556        ASLDRService    (18e5c2f937f9deb8c282df66a3761925) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
01:11:04.0517 2556        ASLDRService - ok
01:11:04.0548 2556        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
01:11:04.0626 2556        AsyncMac - ok
01:11:04.0688 2556        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
01:11:04.0704 2556        atapi - ok
01:11:04.0829 2556        athr            (0acc06fcf46f64ed4f11e57ee461c1f4) C:\Windows\system32\DRIVERS\athrx.sys
01:11:04.0985 2556        athr - ok
01:11:05.0078 2556        ATKGFNEXSrv    (7910158929571214a959d5a6d16dd9c0) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
01:11:05.0094 2556        ATKGFNEXSrv - ok
01:11:05.0266 2556        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
01:11:05.0359 2556        AudioEndpointBuilder - ok
01:11:05.0375 2556        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
01:11:05.0453 2556        AudioSrv - ok
01:11:05.0531 2556        AVG Security Toolbar Service - ok
01:11:05.0952 2556        AVGIDSAgent    (d67719bcfde5798f5c30d14efed3bcaf) C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe
01:11:06.0139 2556        AVGIDSAgent - ok
01:11:06.0389 2556        AVGIDSDriver    (1b2e9fcdc26dc7c81d4131430e2dc936) C:\Windows\system32\DRIVERS\avgidsdrivera.sys
01:11:06.0404 2556        AVGIDSDriver - ok
01:11:06.0420 2556        AVGIDSFilter    (0f293406f64b48d5d2f0d3a1117f3a83) C:\Windows\system32\DRIVERS\avgidsfiltera.sys
01:11:06.0436 2556        AVGIDSFilter - ok
01:11:06.0482 2556        AVGIDSHA        (cffc3a4a638f462e0561cb368b9a7a3a) C:\Windows\system32\DRIVERS\avgidsha.sys
01:11:06.0498 2556        AVGIDSHA - ok
01:11:06.0560 2556        Avgldx64        (59955b4c288dd2a8b9fd2cd5158355c5) C:\Windows\system32\DRIVERS\avgldx64.sys
01:11:06.0576 2556        Avgldx64 - ok
01:11:06.0607 2556        Avgmfx64        (a6aec362aae5e2dda7445e7690cb0f33) C:\Windows\system32\DRIVERS\avgmfx64.sys
01:11:06.0623 2556        Avgmfx64 - ok
01:11:06.0670 2556        Avgrkx64        (645c7f0a0e39758a0024a9b1748273c0) C:\Windows\system32\DRIVERS\avgrkx64.sys
01:11:06.0685 2556        Avgrkx64 - ok
01:11:06.0732 2556        Avgtdia        (1bee674ad792b1c63bb0dac5fa724b23) C:\Windows\system32\DRIVERS\avgtdia.sys
01:11:06.0748 2556        Avgtdia - ok
01:11:06.0888 2556        avgwd          (ea1145debcd508fd25bd1e95c4346929) C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
01:11:06.0904 2556        avgwd - ok
01:11:06.0966 2556        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
01:11:07.0060 2556        AxInstSV - ok
01:11:07.0153 2556        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
01:11:07.0231 2556        b06bdrv - ok
01:11:07.0278 2556        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
01:11:07.0340 2556        b57nd60a - ok
01:11:07.0481 2556        BBSvc          (01a24b415926bb5f772dbe12459d97de) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
01:11:07.0496 2556        BBSvc - ok
01:11:07.0574 2556        BBUpdate        (785de7abda13309d6065305542829e76) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
01:11:07.0590 2556        BBUpdate - ok
01:11:07.0637 2556        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
01:11:07.0684 2556        BDESVC - ok
01:11:07.0715 2556        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
01:11:07.0808 2556        Beep - ok
01:11:07.0902 2556        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
01:11:08.0027 2556        BFE - ok
01:11:08.0105 2556        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
01:11:08.0214 2556        BITS - ok
01:11:08.0276 2556        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
01:11:08.0308 2556        blbdrive - ok
01:11:08.0354 2556        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
01:11:08.0401 2556        bowser - ok
01:11:08.0432 2556        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
01:11:08.0495 2556        BrFiltLo - ok
01:11:08.0526 2556        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
01:11:08.0542 2556        BrFiltUp - ok
01:11:08.0604 2556        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
01:11:08.0698 2556        Browser - ok
01:11:08.0744 2556        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
01:11:08.0822 2556        Brserid - ok
01:11:08.0838 2556        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
01:11:08.0885 2556        BrSerWdm - ok
01:11:08.0916 2556        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
01:11:08.0947 2556        BrUsbMdm - ok
01:11:08.0963 2556        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
01:11:08.0978 2556        BrUsbSer - ok
01:11:09.0025 2556        BthEnum        (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys
01:11:09.0056 2556        BthEnum - ok
01:11:09.0103 2556        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
01:11:09.0134 2556        BTHMODEM - ok
01:11:09.0181 2556        BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
01:11:09.0228 2556        BthPan - ok
01:11:09.0306 2556        BTHPORT        (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys
01:11:09.0400 2556        BTHPORT - ok
01:11:09.0431 2556        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
01:11:09.0524 2556        bthserv - ok
01:11:09.0556 2556        BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys
01:11:09.0587 2556        BTHUSB - ok
01:11:09.0634 2556        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
01:11:09.0727 2556        cdfs - ok
01:11:09.0774 2556        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
01:11:09.0805 2556        cdrom - ok
01:11:09.0868 2556        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
01:11:09.0961 2556        CertPropSvc - ok
01:11:10.0008 2556        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
01:11:10.0039 2556        circlass - ok
01:11:10.0086 2556        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
01:11:10.0117 2556        CLFS - ok
01:11:10.0180 2556        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
01:11:10.0195 2556        clr_optimization_v2.0.50727_32 - ok
01:11:10.0242 2556        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
01:11:10.0273 2556        clr_optimization_v2.0.50727_64 - ok
01:11:10.0351 2556        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
01:11:10.0367 2556        clr_optimization_v4.0.30319_32 - ok
01:11:10.0414 2556        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
01:11:10.0445 2556        clr_optimization_v4.0.30319_64 - ok
01:11:10.0460 2556        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
01:11:10.0492 2556        CmBatt - ok
01:11:10.0538 2556        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
01:11:10.0554 2556        cmdide - ok
01:11:10.0632 2556        CNG            (9ac4f97c2d3e93367e2148ea940cd2cd) C:\Windows\system32\Drivers\cng.sys
01:11:10.0679 2556        CNG - ok
01:11:10.0741 2556        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
01:11:10.0757 2556        Compbatt - ok
01:11:10.0788 2556        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
01:11:10.0835 2556        CompositeBus - ok
01:11:10.0850 2556        COMSysApp - ok
01:11:10.0882 2556        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
01:11:10.0897 2556        crcdisk - ok
01:11:10.0944 2556        CryptSvc        (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
01:11:10.0975 2556        CryptSvc - ok
01:11:11.0053 2556        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
01:11:11.0147 2556        DcomLaunch - ok
01:11:11.0209 2556        DCSLoader      (d7c3889835416bf79aec987713f15310) C:\Windows\system32\spool\DRIVERS\x64\3\OPHPLDCS.EXE
01:11:11.0209 2556        DCSLoader ( UnsignedFile.Multi.Generic ) - warning
01:11:11.0209 2556        DCSLoader - detected UnsignedFile.Multi.Generic (1)
01:11:11.0272 2556        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
01:11:11.0381 2556        defragsvc - ok
01:11:11.0428 2556        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
01:11:11.0521 2556        DfsC - ok
01:11:11.0568 2556        dg_ssudbus      (388039f99ce8769024ee0438352aca99) C:\Windows\system32\DRIVERS\ssudbus.sys
01:11:11.0584 2556        dg_ssudbus - ok
01:11:11.0646 2556        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
01:11:11.0724 2556        Dhcp - ok
01:11:11.0740 2556        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
01:11:11.0833 2556        discache - ok
01:11:11.0880 2556        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
01:11:11.0896 2556        Disk - ok
01:11:11.0942 2556        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
01:11:12.0005 2556        Dnscache - ok
01:11:12.0036 2556        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
01:11:12.0145 2556        dot3svc - ok
01:11:12.0192 2556        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
01:11:12.0286 2556        DPS - ok
01:11:12.0332 2556        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
01:11:12.0364 2556        drmkaud - ok
01:11:12.0457 2556        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
01:11:12.0504 2556        DXGKrnl - ok
01:11:12.0535 2556        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
01:11:12.0629 2556        EapHost - ok
01:11:12.0878 2556        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
01:11:13.0034 2556        ebdrv - ok
01:11:13.0159 2556        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
01:11:13.0175 2556        EFS - ok
01:11:13.0300 2556        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
01:11:13.0378 2556        ehRecvr - ok
01:11:13.0424 2556        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
01:11:13.0471 2556        ehSched - ok
01:11:13.0565 2556        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
01:11:13.0627 2556        elxstor - ok
01:11:13.0643 2556        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
01:11:13.0674 2556        ErrDev - ok
01:11:13.0721 2556        ETD            (3c38648375b7f3988691f53a7aae10a9) C:\Windows\system32\DRIVERS\ETD.sys
01:11:13.0783 2556        ETD - ok
01:11:13.0846 2556        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
01:11:13.0939 2556        EventSystem - ok
01:11:14.0002 2556        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
01:11:14.0111 2556        exfat - ok
01:11:14.0142 2556        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
01:11:14.0220 2556        fastfat - ok
01:11:14.0329 2556        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
01:11:14.0423 2556        Fax - ok
01:11:14.0470 2556        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
01:11:14.0501 2556        fdc - ok
01:11:14.0516 2556        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
01:11:14.0594 2556        fdPHost - ok
01:11:14.0610 2556        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
01:11:14.0704 2556        FDResPub - ok
01:11:14.0735 2556        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
01:11:14.0750 2556        FileInfo - ok
01:11:14.0782 2556        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
01:11:14.0875 2556        Filetrace - ok
01:11:14.0891 2556        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
01:11:14.0938 2556        flpydisk - ok
01:11:14.0984 2556        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
01:11:15.0000 2556        FltMgr - ok
01:11:15.0109 2556        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
01:11:15.0203 2556        FontCache - ok
01:11:15.0281 2556        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
01:11:15.0296 2556        FontCache3.0.0.0 - ok
01:11:15.0359 2556        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
01:11:15.0374 2556        FsDepends - ok
01:11:15.0421 2556        fssfltr        (5814011b2f6e088e29d689b5fcd49b8f) C:\Windows\system32\DRIVERS\fssfltr.sys
01:11:15.0452 2556        fssfltr - ok
01:11:15.0562 2556        fsssvc          (f6717211c1ec2cddaa81b97b0727c2e9) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
01:11:15.0608 2556        fsssvc - ok
01:11:15.0640 2556        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
01:11:15.0655 2556        Fs_Rec - ok
01:11:15.0718 2556        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
01:11:15.0764 2556        fvevol - ok
01:11:15.0811 2556        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
01:11:15.0827 2556        gagp30kx - ok
01:11:15.0905 2556        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
01:11:15.0998 2556        gpsvc - ok
01:11:16.0108 2556        gupdate        (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
01:11:16.0123 2556        gupdate - ok
01:11:16.0139 2556        gupdatem        (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
01:11:16.0154 2556        gupdatem - ok
01:11:16.0201 2556        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
01:11:16.0264 2556        hcw85cir - ok
01:11:16.0326 2556        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
01:11:16.0388 2556        HdAudAddService - ok
01:11:16.0435 2556        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
01:11:16.0482 2556        HDAudBus - ok
01:11:16.0529 2556        HECIx64        (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys
01:11:16.0544 2556        HECIx64 - ok
01:11:16.0591 2556        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
01:11:16.0638 2556        HidBatt - ok
01:11:16.0654 2556        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
01:11:16.0700 2556        HidBth - ok
01:11:16.0747 2556        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
01:11:16.0794 2556        HidIr - ok
01:11:16.0825 2556        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
01:11:16.0919 2556        hidserv - ok
01:11:16.0950 2556        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys
01:11:16.0966 2556        HidUsb - ok
01:11:17.0012 2556        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
01:11:17.0106 2556        hkmsvc - ok
01:11:17.0168 2556        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
01:11:17.0231 2556        HomeGroupListener - ok
01:11:17.0278 2556        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
01:11:17.0324 2556        HomeGroupProvider - ok
01:11:17.0371 2556        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
01:11:17.0387 2556        HpSAMD - ok
01:11:17.0434 2556        HTCAND64        (f47cec45fb85791d4ab237563ad0fa8f) C:\Windows\system32\Drivers\ANDROIDUSB.sys
01:11:17.0480 2556        HTCAND64 - ok
01:11:17.0543 2556        htcnprot        (b8b1b284362e1d8135112573395d5da5) C:\Windows\system32\DRIVERS\htcnprot.sys
01:11:17.0558 2556        htcnprot - ok
01:11:17.0652 2556        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
01:11:17.0746 2556        HTTP - ok
01:11:17.0792 2556        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
01:11:17.0808 2556        hwpolicy - ok
01:11:17.0870 2556        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
01:11:17.0886 2556        i8042prt - ok
01:11:17.0964 2556        iaStor          (42e00996dfc13c46366689c0ea8abc5e) C:\Windows\system32\DRIVERS\iaStor.sys
01:11:17.0995 2556        iaStor - ok
01:11:18.0058 2556        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
01:11:18.0089 2556        iaStorV - ok
01:11:18.0214 2556        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
01:11:18.0276 2556        idsvc - ok
01:11:19.0025 2556        igfx            (677aa5991026a65ada128c4b59cf2bad) C:\Windows\system32\DRIVERS\igdkmd64.sys
01:11:19.0477 2556        igfx - ok
01:11:19.0602 2556        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
01:11:19.0633 2556        iirsp - ok
01:11:19.0711 2556        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
01:11:19.0836 2556        IKEEXT - ok
01:11:19.0883 2556        Impcd          (36fdf367a1dabff903e2214023d71368) C:\Windows\system32\DRIVERS\Impcd.sys
01:11:19.0930 2556        Impcd - ok
01:11:20.0101 2556        IntcAzAudAddService (53019327813ff5ab2964b33b2c61307c) C:\Windows\system32\drivers\RTKVHD64.sys
01:11:20.0195 2556        IntcAzAudAddService - ok
01:11:20.0351 2556        IntcDAud        (408b401cd7cdb075c7470b0ff7ba8d0b) C:\Windows\system32\DRIVERS\IntcDAud.sys
01:11:20.0398 2556        IntcDAud - ok
01:11:20.0429 2556        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
01:11:20.0444 2556        intelide - ok
01:11:20.0491 2556        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
01:11:20.0522 2556        intelppm - ok
01:11:20.0569 2556        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
01:11:20.0663 2556        IPBusEnum - ok
01:11:20.0710 2556        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
01:11:20.0803 2556        IpFilterDriver - ok
01:11:20.0897 2556        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
01:11:20.0990 2556        iphlpsvc - ok
01:11:21.0037 2556        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
01:11:21.0068 2556        IPMIDRV - ok
01:11:21.0100 2556        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
01:11:21.0178 2556        IPNAT - ok
01:11:21.0209 2556        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
01:11:21.0287 2556        IRENUM - ok
01:11:21.0334 2556        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
01:11:21.0349 2556        isapnp - ok
01:11:21.0380 2556        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
01:11:21.0427 2556        iScsiPrt - ok
01:11:21.0458 2556        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
01:11:21.0474 2556        kbdclass - ok
01:11:21.0505 2556        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
01:11:21.0536 2556        kbdhid - ok
01:11:21.0583 2556        kbfiltr        (e63ef8c3271d014f14e2469ce75fecb4) C:\Windows\system32\DRIVERS\kbfiltr.sys
01:11:21.0583 2556        kbfiltr - ok
01:11:21.0614 2556        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
01:11:21.0646 2556        KeyIso - ok
01:11:21.0677 2556        KSecDD          (97a7070aea4c058b6418519e869a63b4) C:\Windows\system32\Drivers\ksecdd.sys
01:11:21.0692 2556        KSecDD - ok
01:11:21.0724 2556        KSecPkg        (26c43a7c2862447ec59deda188d1da07) C:\Windows\system32\Drivers\ksecpkg.sys
01:11:21.0755 2556        KSecPkg - ok
01:11:21.0786 2556        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
01:11:21.0864 2556        ksthunk - ok
01:11:21.0926 2556        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
01:11:22.0051 2556        KtmRm - ok
01:11:22.0082 2556        L1C            (b4a3a05b0f9c81d098b96ab6aa915042) C:\Windows\system32\DRIVERS\L1C62x64.sys
01:11:22.0129 2556        L1C - ok
01:11:22.0192 2556        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
01:11:22.0301 2556        LanmanServer - ok
01:11:22.0348 2556        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
01:11:22.0426 2556        LanmanWorkstation - ok
01:11:22.0472 2556        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
01:11:22.0550 2556        lltdio - ok
01:11:22.0597 2556        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
01:11:22.0706 2556        lltdsvc - ok
01:11:22.0738 2556        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
01:11:22.0831 2556        lmhosts - ok
01:11:22.0940 2556        LMS            (a1c148801b4af64847aeb9f3ad9594ef) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
01:11:22.0956 2556        LMS ( UnsignedFile.Multi.Generic ) - warning
01:11:22.0956 2556        LMS - detected UnsignedFile.Multi.Generic (1)
01:11:22.0987 2556        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
01:11:23.0018 2556        LSI_FC - ok
01:11:23.0050 2556        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
01:11:23.0081 2556        LSI_SAS - ok
01:11:23.0096 2556        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
01:11:23.0128 2556        LSI_SAS2 - ok
01:11:23.0143 2556        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
01:11:23.0174 2556        LSI_SCSI - ok
01:11:23.0206 2556        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
01:11:23.0284 2556        luafv - ok
01:11:23.0330 2556        lullaby        (085435ae1a124361304044029b5cc644) C:\Windows\system32\DRIVERS\lullaby.sys
01:11:23.0346 2556        lullaby - ok
01:11:23.0408 2556        Macromedia Licensing Service (51c75f9291d2e3700b4da8f2fd974e66) C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
01:11:23.0424 2556        Macromedia Licensing Service ( UnsignedFile.Multi.Generic ) - warning
01:11:23.0424 2556        Macromedia Licensing Service - detected UnsignedFile.Multi.Generic (1)
01:11:23.0486 2556        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
01:11:23.0518 2556        Mcx2Svc - ok
01:11:23.0549 2556        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
01:11:23.0564 2556        megasas - ok
01:11:23.0611 2556        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
01:11:23.0658 2556        MegaSR - ok
01:11:23.0689 2556        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
01:11:23.0798 2556        MMCSS - ok
01:11:23.0814 2556        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
01:11:23.0892 2556        Modem - ok
01:11:23.0939 2556        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
01:11:23.0954 2556        monitor - ok
01:11:24.0001 2556        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
01:11:24.0017 2556        mouclass - ok
01:11:24.0032 2556        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
01:11:24.0064 2556        mouhid - ok
01:11:24.0095 2556        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
01:11:24.0110 2556        mountmgr - ok
01:11:24.0204 2556        MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
01:11:24.0235 2556        MozillaMaintenance - ok
01:11:24.0266 2556        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
01:11:24.0282 2556        mpio - ok
01:11:24.0329 2556        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
01:11:24.0407 2556        mpsdrv - ok
01:11:24.0485 2556        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
01:11:24.0594 2556        MpsSvc - ok
01:11:24.0641 2556        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
01:11:24.0688 2556        MRxDAV - ok
01:11:24.0719 2556        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
01:11:24.0766 2556        mrxsmb - ok
01:11:24.0797 2556        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
01:11:24.0844 2556        mrxsmb10 - ok
01:11:24.0875 2556        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
01:11:24.0906 2556        mrxsmb20 - ok
01:11:24.0937 2556        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
01:11:24.0953 2556        msahci - ok
01:11:25.0000 2556        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
01:11:25.0031 2556        msdsm - ok
01:11:25.0062 2556        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
01:11:25.0109 2556        MSDTC - ok
01:11:25.0140 2556        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
01:11:25.0234 2556        Msfs - ok
01:11:25.0265 2556        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
01:11:25.0358 2556        mshidkmdf - ok
01:11:25.0374 2556        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
01:11:25.0390 2556        msisadrv - ok
01:11:25.0436 2556        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
01:11:25.0530 2556        MSiSCSI - ok
01:11:25.0546 2556        msiserver - ok
01:11:25.0577 2556        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
01:11:25.0670 2556        MSKSSRV - ok
01:11:25.0686 2556        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
01:11:25.0780 2556        MSPCLOCK - ok
01:11:25.0795 2556        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
01:11:25.0873 2556        MSPQM - ok
01:11:25.0936 2556        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
01:11:25.0951 2556        MsRPC - ok
01:11:25.0982 2556        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
01:11:26.0014 2556        mssmbios - ok
01:11:26.0123 2556        MSSQL$GREENSQL2005 - ok
01:11:26.0170 2556        MSSQLServerADHelper (1d89eb4e2a99cabd4e81225f4f4c4b25) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqladhlp90.exe
01:11:26.0185 2556        MSSQLServerADHelper - ok
01:11:26.0216 2556        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
01:11:26.0310 2556        MSTEE - ok
01:11:26.0326 2556        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
01:11:26.0357 2556        MTConfig - ok
01:11:26.0404 2556        MTsensor        (032d35c996f21d19a205a7c8f0b76f3c) C:\Windows\system32\DRIVERS\ATK64AMD.sys
01:11:26.0419 2556        MTsensor - ok
01:11:26.0435 2556        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
01:11:26.0450 2556        Mup - ok
01:11:26.0513 2556        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
01:11:26.0606 2556        napagent - ok
01:11:26.0669 2556        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
01:11:26.0731 2556        NativeWifiP - ok
01:11:26.0825 2556        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
01:11:26.0872 2556        NDIS - ok
01:11:26.0903 2556        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
01:11:26.0965 2556        NdisCap - ok
01:11:26.0996 2556        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
01:11:27.0074 2556        NdisTapi - ok
01:11:27.0137 2556        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
01:11:27.0215 2556        Ndisuio - ok
01:11:27.0262 2556        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
01:11:27.0355 2556        NdisWan - ok
01:11:27.0402 2556        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
01:11:27.0464 2556        NDProxy - ok
01:11:27.0496 2556        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
01:11:27.0589 2556        NetBIOS - ok
01:11:27.0636 2556        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
01:11:27.0745 2556        NetBT - ok
01:11:27.0776 2556        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
01:11:27.0792 2556        Netlogon - ok
01:11:27.0854 2556        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
01:11:27.0964 2556        Netman - ok
01:11:28.0010 2556        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
01:11:28.0104 2556        netprofm - ok
01:11:28.0182 2556        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
01:11:28.0198 2556        NetTcpPortSharing - ok
01:11:28.0229 2556        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
01:11:28.0244 2556        nfrd960 - ok
01:11:28.0307 2556        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
01:11:28.0400 2556        NlaSvc - ok
01:11:28.0416 2556        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
01:11:28.0494 2556        Npfs - ok
01:11:28.0525 2556        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
01:11:28.0603 2556        nsi - ok
01:11:28.0634 2556        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
01:11:28.0712 2556        nsiproxy - ok
01:11:28.0868 2556        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
01:11:28.0931 2556        Ntfs - ok
01:11:29.0056 2556        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
01:11:29.0134 2556        Null - ok
01:11:29.0180 2556        nusb3hub        (f5bc2345e8c89d4e90fafd23a2239935) C:\Windows\system32\DRIVERS\nusb3hub.sys
01:11:29.0212 2556        nusb3hub - ok
01:11:29.0243 2556        nusb3xhc        (5d42578241bc2a9b4a64837077436d5f) C:\Windows\system32\DRIVERS\nusb3xhc.sys
01:11:29.0290 2556        nusb3xhc - ok
01:11:30.0116 2556        nvlddmkm        (1001d089e679adc6a208cefbdd2bff5a) C:\Windows\system32\DRIVERS\nvlddmkm.sys
01:11:30.0460 2556        nvlddmkm - ok
01:11:30.0678 2556        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
01:11:30.0709 2556        nvraid - ok
01:11:30.0756 2556        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
01:11:30.0787 2556        nvstor - ok
01:11:30.0850 2556        nvsvc          (dcad177b32e7d976e449983dfccade67) C:\Windows\system32\nvvsvc.exe
01:11:30.0881 2556        nvsvc - ok
01:11:30.0912 2556        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
01:11:30.0943 2556        nv_agp - ok
01:11:30.0974 2556        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
01:11:31.0006 2556        ohci1394 - ok
01:11:31.0115 2556        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
01:11:31.0146 2556        ose - ok
01:11:31.0536 2556        osppsvc        (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
01:11:31.0708 2556        osppsvc - ok
01:11:31.0848 2556        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
01:11:31.0895 2556        p2pimsvc - ok
01:11:31.0942 2556        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
01:11:31.0988 2556        p2psvc - ok
01:11:32.0035 2556        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
01:11:32.0066 2556        Parport - ok
01:11:32.0098 2556        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
01:11:32.0129 2556        partmgr - ok
01:11:32.0222 2556        PassThru Service (68139940b5ac84affb7eb1b713be66e7) C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
01:11:32.0222 2556        PassThru Service ( UnsignedFile.Multi.Generic ) - warning
01:11:32.0222 2556        PassThru Service - detected UnsignedFile.Multi.Generic (1)
01:11:32.0254 2556        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
01:11:32.0300 2556        PcaSvc - ok
01:11:32.0347 2556        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
01:11:32.0363 2556        pci - ok
01:11:32.0394 2556        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
01:11:32.0410 2556        pciide - ok
01:11:32.0456 2556        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
01:11:32.0488 2556        pcmcia - ok
01:11:32.0503 2556        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
01:11:32.0534 2556        pcw - ok
01:11:32.0581 2556        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
01:11:32.0675 2556        PEAUTH - ok
01:11:32.0768 2556        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
01:11:32.0815 2556        PerfHost - ok
01:11:32.0940 2556        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
01:11:33.0080 2556        pla - ok
01:11:33.0143 2556        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
01:11:33.0205 2556        PlugPlay - ok
01:11:33.0236 2556        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
01:11:33.0268 2556        PNRPAutoReg - ok
01:11:33.0314 2556        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
01:11:33.0346 2556        PNRPsvc - ok
01:11:33.0408 2556        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
01:11:33.0517 2556        PolicyAgent - ok
01:11:33.0564 2556        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
01:11:33.0658 2556        Power - ok
01:11:33.0720 2556        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
01:11:33.0814 2556        PptpMiniport - ok
01:11:33.0845 2556        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
01:11:33.0892 2556        Processor - ok
01:11:33.0938 2556        ProfSvc        (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll
01:11:33.0985 2556        ProfSvc - ok
01:11:34.0032 2556        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
01:11:34.0048 2556        ProtectedStorage - ok
01:11:34.0110 2556        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
01:11:34.0188 2556        Psched - ok
01:11:34.0235 2556        PxHlpa64        (87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys
01:11:34.0250 2556        PxHlpa64 - ok
01:11:34.0406 2556        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
01:11:34.0484 2556        ql2300 - ok
01:11:34.0640 2556        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
01:11:34.0656 2556        ql40xx - ok
01:11:34.0703 2556        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
01:11:34.0750 2556        QWAVE - ok
01:11:34.0765 2556        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
01:11:34.0812 2556        QWAVEdrv - ok
01:11:34.0843 2556        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
01:11:34.0921 2556        RasAcd - ok
01:11:34.0968 2556        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
01:11:35.0030 2556        RasAgileVpn - ok
01:11:35.0077 2556        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
01:11:35.0155 2556        RasAuto - ok
01:11:35.0186 2556        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
01:11:35.0264 2556        Rasl2tp - ok
01:11:35.0311 2556        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
01:11:35.0405 2556        RasMan - ok
01:11:35.0452 2556        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
01:11:35.0545 2556        RasPppoe - ok
01:11:35.0576 2556        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
01:11:35.0654 2556        RasSstp - ok
01:11:35.0701 2556        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
01:11:35.0795 2556        rdbss - ok
01:11:35.0810 2556        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
01:11:35.0842 2556        rdpbus - ok
01:11:35.0873 2556        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
01:11:35.0951 2556        RDPCDD - ok
01:11:35.0982 2556        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
01:11:36.0060 2556        RDPENCDD - ok
01:11:36.0091 2556        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
01:11:36.0169 2556        RDPREFMP - ok
01:11:36.0216 2556        RDPWD          (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
01:11:36.0278 2556        RDPWD - ok
01:11:36.0325 2556        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
01:11:36.0356 2556        rdyboost - ok
01:11:36.0388 2556        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
01:11:36.0481 2556        RemoteAccess - ok
01:11:36.0512 2556        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
01:11:36.0606 2556        RemoteRegistry - ok
01:11:36.0653 2556        RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
01:11:36.0700 2556        RFCOMM - ok
01:11:36.0840 2556        RichVideo      (f12a68ed55053940cadd59ca5e3468dd) C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
01:11:36.0856 2556        RichVideo ( UnsignedFile.Multi.Generic ) - warning
01:11:36.0856 2556        RichVideo - detected UnsignedFile.Multi.Generic (1)
01:11:36.0902 2556        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
01:11:36.0980 2556        RpcEptMapper - ok
01:11:37.0012 2556        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
01:11:37.0043 2556        RpcLocator - ok
01:11:37.0105 2556        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
01:11:37.0183 2556        RpcSs - ok
01:11:37.0230 2556        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
01:11:37.0308 2556        rspndr - ok
01:11:37.0355 2556        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
01:11:37.0386 2556        SamSs - ok
01:11:37.0402 2556        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
01:11:37.0433 2556        sbp2port - ok
01:11:37.0464 2556        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
01:11:37.0558 2556        SCardSvr - ok
01:11:37.0620 2556        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
01:11:37.0698 2556        scfilter - ok
01:11:37.0807 2556        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
01:11:37.0901 2556        Schedule - ok
01:11:37.0948 2556        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
01:11:38.0010 2556        SCPolicySvc - ok
01:11:38.0072 2556        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
01:11:38.0135 2556        SDRSVC - ok
01:11:38.0182 2556        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
01:11:38.0275 2556        secdrv - ok
01:11:38.0291 2556        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
01:11:38.0369 2556        seclogon - ok
01:11:38.0400 2556        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
01:11:38.0494 2556        SENS - ok
01:11:38.0525 2556        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
01:11:38.0572 2556        SensrSvc - ok
01:11:38.0603 2556        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
01:11:38.0634 2556        Serenum - ok
01:11:38.0665 2556        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
01:11:38.0696 2556        Serial - ok
01:11:38.0743 2556        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
01:11:38.0774 2556        sermouse - ok
01:11:38.0837 2556        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
01:11:38.0915 2556        SessionEnv - ok
01:11:38.0946 2556        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
01:11:38.0993 2556        sffdisk - ok
01:11:39.0024 2556        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
01:11:39.0055 2556        sffp_mmc - ok
01:11:39.0086 2556        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
01:11:39.0118 2556        sffp_sd - ok
01:11:39.0164 2556        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
01:11:39.0211 2556        sfloppy - ok
01:11:39.0258 2556        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
01:11:39.0352 2556        SharedAccess - ok
01:11:39.0414 2556        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
01:11:39.0492 2556        ShellHWDetection - ok
01:11:39.0523 2556        SiSGbeLH        (1bc348cf6baa90ec8e533ef6e6a69933) C:\Windows\system32\DRIVERS\SiSG664.sys
01:11:39.0554 2556        SiSGbeLH - ok
01:11:39.0617 2556        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
01:11:39.0632 2556        SiSRaid2 - ok
01:11:39.0664 2556        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
01:11:39.0695 2556        SiSRaid4 - ok
01:11:39.0710 2556        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
01:11:39.0804 2556        Smb - ok
01:11:39.0851 2556        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
01:11:39.0882 2556        SNMPTRAP - ok
01:11:40.0069 2556        SNP2UVC        (2114518e55b380a3acc28b2c27fd499a) C:\Windows\system32\DRIVERS\snp2uvc.sys
01:11:40.0210 2556        SNP2UVC - ok
01:11:40.0366 2556        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
01:11:40.0381 2556        spldr - ok
01:11:40.0459 2556        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
01:11:40.0537 2556        Spooler - ok
01:11:40.0818 2556        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
01:11:41.0021 2556        sppsvc - ok
01:11:41.0146 2556        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
01:11:41.0239 2556        sppuinotify - ok
01:11:41.0380 2556        SQLBrowser      (86ebd8b1f23e743aad21f4d5b4d40985) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
01:11:41.0395 2556        SQLBrowser - ok
01:11:41.0489 2556        SQLWriter      (3c432a96363097870995e2a3c8b66abd) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
01:11:41.0504 2556        SQLWriter - ok
01:11:41.0582 2556        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
01:11:41.0660 2556        srv - ok
01:11:41.0707 2556        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
01:11:41.0754 2556        srv2 - ok
01:11:41.0785 2556        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
01:11:41.0832 2556        srvnet - ok
01:11:41.0894 2556        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
01:11:42.0004 2556        SSDPSRV - ok
01:11:42.0035 2556        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
01:11:42.0113 2556        SstpSvc - ok
01:11:42.0175 2556        ssudmdm        (ad42ca614e086bcadbd53fffc404ac24) C:\Windows\system32\DRIVERS\ssudmdm.sys
01:11:42.0206 2556        ssudmdm - ok
01:11:42.0222 2556        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
01:11:42.0253 2556        stexstor - ok
01:11:42.0331 2556        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
01:11:42.0394 2556        stisvc - ok
01:11:42.0409 2556        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
01:11:42.0425 2556        swenum - ok
01:11:42.0503 2556        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
01:11:42.0596 2556        swprv - ok
01:11:42.0752 2556        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
01:11:42.0877 2556        SysMain - ok
01:11:43.0002 2556        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
01:11:43.0033 2556        TabletInputService - ok
01:11:43.0080 2556        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
01:11:43.0174 2556        TapiSrv - ok
01:11:43.0205 2556        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
01:11:43.0298 2556        TBS - ok
01:11:43.0470 2556        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
01:11:43.0548 2556        Tcpip - ok
01:11:43.0798 2556        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
01:11:43.0876 2556        TCPIP6 - ok
01:11:43.0969 2556        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
01:11:44.0047 2556        tcpipreg - ok
01:11:44.0078 2556        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
01:11:44.0125 2556        TDPIPE - ok
01:11:44.0141 2556        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
01:11:44.0156 2556        TDTCP - ok
01:11:44.0203 2556        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
01:11:44.0281 2556        tdx - ok
01:11:44.0312 2556        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
01:11:44.0328 2556        TermDD - ok
01:11:44.0390 2556        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
01:11:44.0500 2556        TermService - ok
01:11:44.0531 2556        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
01:11:44.0578 2556        Themes - ok
01:11:44.0609 2556        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
01:11:44.0671 2556        THREADORDER - ok
01:11:44.0812 2556        TOSHIBA Bluetooth Service (ab2d61a032a01bf9e84f03caa9d22932) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
01:11:44.0827 2556        TOSHIBA Bluetooth Service - ok
01:11:44.0858 2556        tosporte        (8021f63311797085949fa387f7c83583) C:\Windows\system32\DRIVERS\tosporte.sys
01:11:44.0874 2556        tosporte - ok
01:11:44.0905 2556        tosrfbd        (71bb669bfcade1580fdce010abc76310) C:\Windows\system32\DRIVERS\tosrfbd.sys
01:11:44.0936 2556        tosrfbd - ok
01:11:44.0952 2556        tosrfbnp        (62512b5277d88600f8bd4b7aec43569d) C:\Windows\system32\Drivers\tosrfbnp.sys
01:11:44.0968 2556        tosrfbnp - ok
01:11:44.0983 2556        Tosrfcom        (c523a9186c39d65cc9adebb2e1b93ccd) C:\Windows\system32\Drivers\tosrfcom.sys
01:11:44.0999 2556        Tosrfcom - ok
01:11:45.0030 2556        Tosrfhid        (451b8c1815c6cc39650af916c2a382cd) C:\Windows\system32\DRIVERS\Tosrfhid.sys
01:11:45.0046 2556        Tosrfhid - ok
01:11:45.0077 2556        tosrfnds        (b6fdc3c76ffe9c5171eea9c37ea367c2) C:\Windows\system32\DRIVERS\tosrfnds.sys
01:11:45.0092 2556        tosrfnds - ok
01:11:45.0124 2556        Tosrfusb        (463785c39f247580e16daef760e7ea86) C:\Windows\system32\DRIVERS\tosrfusb.sys
01:11:45.0139 2556        Tosrfusb - ok
01:11:45.0170 2556        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
01:11:45.0280 2556        TrkWks - ok
01:11:45.0358 2556        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
01:11:45.0436 2556        TrustedInstaller - ok
01:11:45.0451 2556        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
01:11:45.0545 2556        tssecsrv - ok
01:11:45.0607 2556        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
01:11:45.0654 2556        TsUsbFlt - ok
01:11:45.0701 2556        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
01:11:45.0779 2556        tunnel - ok
01:11:45.0810 2556        TurboB          (c45a3e051c65106a28982caed125f855) C:\Windows\system32\DRIVERS\TurboB.sys
01:11:45.0826 2556        TurboB - ok
01:11:45.0888 2556        TurboBoost      (baef86ebeaece76573fa822dea256f6c) C:\Program Files\Intel\TurboBoost\TurboBoost.exe
01:11:45.0919 2556        TurboBoost - ok
01:11:45.0935 2556        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
01:11:45.0966 2556        uagp35 - ok
01:11:46.0028 2556        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
01:11:46.0138 2556        udfs - ok
01:11:46.0169 2556        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
01:11:46.0216 2556        UI0Detect - ok
01:11:46.0262 2556        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
01:11:46.0294 2556        uliagpkx - ok
01:11:46.0340 2556        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
01:11:46.0356 2556        umbus - ok
01:11:46.0387 2556        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
01:11:46.0418 2556        UmPass - ok
01:11:46.0652 2556        UNS            (41118d920b2b268c0adc36421248cdcf) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
01:11:46.0715 2556        UNS ( UnsignedFile.Multi.Generic ) - warning
01:11:46.0715 2556        UNS - detected UnsignedFile.Multi.Generic (1)
01:11:46.0855 2556        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
01:11:46.0964 2556        upnphost - ok
01:11:47.0042 2556        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
01:11:47.0074 2556        usbaudio - ok
01:11:47.0120 2556        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
01:11:47.0167 2556        usbccgp - ok
01:11:47.0198 2556        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
01:11:47.0245 2556        usbcir - ok
01:11:47.0292 2556        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
01:11:47.0308 2556        usbehci - ok
01:11:47.0370 2556        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
01:11:47.0417 2556        usbhub - ok
01:11:47.0448 2556        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
01:11:47.0464 2556        usbohci - ok
01:11:47.0510 2556        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
01:11:47.0557 2556        usbprint - ok
01:11:47.0604 2556        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
01:11:47.0666 2556        USBSTOR - ok
01:11:47.0682 2556        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
01:11:47.0698 2556        usbuhci - ok
01:11:47.0744 2556        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
01:11:47.0791 2556        usbvideo - ok
01:11:47.0822 2556        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
01:11:47.0900 2556        UxSms - ok
01:11:47.0947 2556        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
01:11:47.0963 2556        VaultSvc - ok
01:11:48.0010 2556        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
01:11:48.0025 2556        vdrvroot - ok
01:11:48.0103 2556        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
01:11:48.0212 2556        vds - ok
01:11:48.0244 2556        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
01:11:48.0275 2556        vga - ok
01:11:48.0290 2556        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
01:11:48.0368 2556        VgaSave - ok
01:11:48.0415 2556        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
01:11:48.0446 2556        vhdmp - ok
01:11:48.0478 2556        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
01:11:48.0493 2556        viaide - ok
01:11:48.0524 2556        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
01:11:48.0556 2556        volmgr - ok
01:11:48.0602 2556        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
01:11:48.0634 2556        volmgrx - ok
01:11:48.0680 2556        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
01:11:48.0727 2556        volsnap - ok
01:11:48.0774 2556        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
01:11:48.0805 2556        vsmraid - ok
01:11:48.0946 2556        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
01:11:49.0102 2556        VSS - ok
01:11:49.0226 2556        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
01:11:49.0273 2556        vwifibus - ok
01:11:49.0289 2556        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
01:11:49.0336 2556        vwififlt - ok
01:11:49.0382 2556        vwifimp        (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
01:11:49.0398 2556        vwifimp - ok
01:11:49.0460 2556        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
01:11:49.0554 2556        W32Time - ok
01:11:49.0585 2556        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
01:11:49.0616 2556        WacomPen - ok
01:11:49.0663 2556        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
01:11:49.0741 2556        WANARP - ok
01:11:49.0741 2556        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
01:11:49.0804 2556        Wanarpv6 - ok
01:11:49.0944 2556        WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
01:11:50.0022 2556        WatAdminSvc - ok
01:11:50.0147 2556        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
01:11:50.0225 2556        wbengine - ok
01:11:50.0350 2556        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
01:11:50.0396 2556        WbioSrvc - ok
01:11:50.0474 2556        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
01:11:50.0521 2556        wcncsvc - ok
01:11:50.0552 2556        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
01:11:50.0599 2556        WcsPlugInService - ok
01:11:50.0646 2556        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
01:11:50.0662 2556        Wd - ok
01:11:50.0724 2556        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
01:11:50.0755 2556        Wdf01000 - ok
01:11:50.0786 2556        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
01:11:50.0911 2556        WdiServiceHost - ok
01:11:50.0911 2556        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
01:11:50.0942 2556        WdiSystemHost - ok
01:11:51.0005 2556        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
01:11:51.0052 2556        WebClient - ok
01:11:51.0083 2556        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
01:11:51.0192 2556        Wecsvc - ok
01:11:51.0223 2556        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
01:11:51.0301 2556        wercplsupport - ok
01:11:51.0348 2556        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
01:11:51.0426 2556        WerSvc - ok
01:11:51.0504 2556        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
01:11:51.0566 2556        WfpLwf - ok
01:11:51.0613 2556        WimFltr        (52ded146e4797e6ccf94799e8e22bb2a) C:\Windows\system32\DRIVERS\wimfltr.sys
01:11:51.0660 2556        WimFltr - ok
01:11:51.0676 2556        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
01:11:51.0691 2556        WIMMount - ok
01:11:51.0738 2556        WinDefend - ok
01:11:51.0754 2556        WinHttpAutoProxySvc - ok
01:11:51.0816 2556        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
01:11:51.0910 2556        Winmgmt - ok
01:11:52.0081 2556        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
01:11:52.0268 2556        WinRM - ok
01:11:52.0424 2556        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
01:11:52.0456 2556        WinUsb - ok
01:11:52.0549 2556        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
01:11:52.0612 2556        Wlansvc - ok
01:11:52.0643 2556        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
01:11:52.0674 2556        WmiAcpi - ok
01:11:52.0752 2556        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
01:11:52.0783 2556        wmiApSrv - ok
01:11:52.0846 2556        WMPNetworkSvc - ok
01:11:52.0877 2556        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
01:11:52.0924 2556        WPCSvc - ok
01:11:52.0955 2556        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
01:11:52.0986 2556        WPDBusEnum - ok
01:11:53.0017 2556        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
01:11:53.0095 2556        ws2ifsl - ok
01:11:53.0126 2556        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
01:11:53.0158 2556        wscsvc - ok
01:11:53.0189 2556        WSDPrintDevice  (8d918b1db190a4d9b1753a66fa8c96e8) C:\Windows\system32\DRIVERS\WSDPrint.sys
01:11:53.0236 2556        WSDPrintDevice - ok
01:11:53.0236 2556        WSearch - ok
01:11:53.0423 2556        wuauserv        (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll
01:11:53.0563 2556        wuauserv - ok
01:11:53.0704 2556        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
01:11:53.0782 2556        WudfPf - ok
01:11:53.0797 2556        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
01:11:53.0875 2556        WUDFRd - ok
01:11:53.0922 2556        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
01:11:53.0984 2556        wudfsvc - ok
01:11:54.0031 2556        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
01:11:54.0078 2556        WwanSvc - ok
01:11:54.0140 2556        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
01:11:55.0388 2556        \Device\Harddisk0\DR0 - ok
01:11:55.0420 2556        Boot (0x1200)  (1b19d2285fd0c8c86ea0a798696eab5e) \Device\Harddisk0\DR0\Partition0
01:11:55.0435 2556        \Device\Harddisk0\DR0\Partition0 - ok
01:11:55.0435 2556        Boot (0x1200)  (533c6e2018bf6458beac93d23e923c80) \Device\Harddisk0\DR0\Partition1
01:11:55.0435 2556        \Device\Harddisk0\DR0\Partition1 - ok
01:11:55.0435 2556        ============================================================
01:11:55.0435 2556        Scan finished
01:11:55.0435 2556        ============================================================
01:11:55.0451 2884        Detected object count: 7
01:11:55.0451 2884        Actual detected object count: 7
01:12:17.0166 2884        Akamai ( HiddenFile.Multi.Generic ) - skipped by user
01:12:17.0166 2884        Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip
01:12:17.0166 2884        DCSLoader ( UnsignedFile.Multi.Generic ) - skipped by user
01:12:17.0166 2884        DCSLoader ( UnsignedFile.Multi.Generic ) - User select action: Skip
01:12:17.0166 2884        LMS ( UnsignedFile.Multi.Generic ) - skipped by user
01:12:17.0166 2884        LMS ( UnsignedFile.Multi.Generic ) - User select action: Skip
01:12:17.0166 2884        Macromedia Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
01:12:17.0166 2884        Macromedia Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
01:12:17.0166 2884        PassThru Service ( UnsignedFile.Multi.Generic ) - skipped by user
01:12:17.0166 2884        PassThru Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
01:12:17.0182 2884        RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
01:12:17.0182 2884        RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip
01:12:17.0182 2884        UNS ( UnsignedFile.Multi.Generic ) - skipped by user
01:12:17.0182 2884        UNS ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 14.07.2012 13:41
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

chnuschti 14.07.2012 19:49
Hallo Arne

Hier das Combofix Log. Vielen Dank für Deine Überstunden. Es lief problemlos und ohne Neustart.
Viele Grüsse
Chris

Code:
Combofix Logfile:

       
Code:

       
ComboFix 12-07-14.01 - CHV 14.07.2012  20:34:19.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.41.1031.18.3886.2231 [GMT 2:00]
ausgeführt von:: c:\users\CHV\Desktop\ComboFix.exe
AV: AVG Anti-Virus Business Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Business Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\ASPG_icon.ico
c:\users\CHV\AppData\Local\assembly\tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-06-14 bis 2012-07-14  ))))))))))))))))))))))))))))))
.
.
2012-07-14 18:41 . 2012-07-14 18:41        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-07-13 20:44 . 2012-07-13 20:44        --------        d-----w-        C:\_OTL
2012-07-11 22:02 . 2012-06-12 03:08        3148800        ----a-w-        c:\windows\system32\win32k.sys
2012-07-11 21:55 . 2012-06-02 12:03        304640        ----a-w-        c:\program files\Internet Explorer\IEShims.dll
2012-07-11 20:18 . 2012-07-11 20:18        --------        d-----w-        c:\program files (x86)\ESET
2012-07-11 06:23 . 2012-06-06 06:06        2004480        ----a-w-        c:\windows\system32\msxml6.dll
2012-07-11 06:23 . 2012-06-06 06:06        1881600        ----a-w-        c:\windows\system32\msxml3.dll
2012-07-11 06:23 . 2012-06-06 05:05        1390080        ----a-w-        c:\windows\SysWow64\msxml6.dll
2012-07-11 06:23 . 2012-06-06 05:05        1236992        ----a-w-        c:\windows\SysWow64\msxml3.dll
2012-07-11 06:23 . 2010-06-26 03:55        2048        ----a-w-        c:\windows\system32\msxml3r.dll
2012-07-11 06:23 . 2010-06-26 03:24        2048        ----a-w-        c:\windows\SysWow64\msxml3r.dll
2012-07-06 12:30 . 2012-07-06 12:30        --------        d-----w-        c:\program files (x86)\7-Zip
2012-07-06 11:30 . 2012-07-06 11:30        --------        d-----w-        c:\users\CHV\AppData\Roaming\Malwarebytes
2012-07-06 11:30 . 2012-07-06 11:30        --------        d-----w-        c:\programdata\Malwarebytes
2012-07-06 09:45 . 2012-07-06 09:45        --------        d-----w-        c:\users\CHV\AppData\Roaming\SpeedyPC Software
2012-07-06 09:45 . 2012-07-06 09:45        --------        d-----w-        c:\users\CHV\AppData\Roaming\DriverCure
2012-07-06 09:45 . 2012-07-06 11:16        --------        d-----w-        c:\programdata\SpeedyPC Software
2012-07-02 19:00 . 2012-07-02 19:00        --------        d-----w-        c:\users\CHV\AppData\Roaming\NCH Software
2012-06-25 14:04 . 2012-06-25 14:04        1394248        ----a-w-        c:\windows\SysWow64\msxml4.dll
2012-06-21 17:53 . 2012-06-21 17:53        --------        d-----w-        c:\users\CHV\AppData\Local\IsolatedStorage
2012-06-21 17:50 . 2012-07-11 20:17        --------        d-----w-        c:\programdata\PROFFIX
2012-06-21 17:41 . 2012-06-21 17:41        --------        d-----w-        c:\program files (x86)\PROFFIX
2012-06-21 17:38 . 2012-06-21 17:38        --------        d-----w-        c:\program files (x86)\Common Files\Wise Installation Wizard
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-14 08:25 . 2012-02-10 07:53        45056        ----a-w-        c:\windows\system32\acovcnt.exe
2012-07-12 11:25 . 2012-04-04 06:23        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-12 11:25 . 2011-05-18 06:19        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-04 11:06 . 2012-06-13 17:11        5559664        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-13 17:11        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-13 17:11        3913072        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2012-05-04 09:17 . 2010-11-15 13:56        48648        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2012-05-04 09:17 . 2010-10-24 09:22        2155344        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-05-01 05:40 . 2012-06-13 17:11        209920        ----a-w-        c:\windows\system32\profsvc.dll
2012-04-28 03:55 . 2012-06-13 17:11        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-13 17:11        77312        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-13 17:11        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-13 17:11        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-04-24 05:37 . 2012-06-13 17:11        184320        ----a-w-        c:\windows\system32\cryptsvc.dll
2012-04-24 05:37 . 2012-06-13 17:11        140288        ----a-w-        c:\windows\system32\cryptnet.dll
2012-04-24 05:37 . 2012-06-13 17:11        1462272        ----a-w-        c:\windows\system32\crypt32.dll
2012-04-24 04:36 . 2012-06-13 17:11        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll
2012-04-24 04:36 . 2012-06-13 17:11        1158656        ----a-w-        c:\windows\SysWow64\crypt32.dll
2012-04-24 04:36 . 2012-06-13 17:11        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll
2012-04-19 02:50 . 2012-04-19 02:50        28480        ----a-w-        c:\windows\system32\drivers\avgidsha.sys
2009-04-08 17:31 . 2009-04-08 17:31        106496        ----a-w-        c:\program files (x86)\Common Files\CPInstallAction.dll
2008-08-12 04:45 . 2008-08-12 04:45        155648        ----a-w-        c:\program files (x86)\Common Files\MSIactionall.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        94208        ----a-w-        c:\users\CHV\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        94208        ----a-w-        c:\users\CHV\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        94208        ----a-w-        c:\users\CHV\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Shadow"="c:\program files (x86)\NewTech Infosystems\NTI Shadow for ReadyNAS\Shadow.exe" [2008-07-30 678960]
"Akamai NetSession Interface"="c:\users\CHV\AppData\Local\Akamai\netsession_win.exe" [2012-05-26 4327744]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-01-13 7109248]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-01-05 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-10-21 106496]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"HTC Sync Loader"="c:\program files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2011-08-22 593920]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start hxxp://www.avg.de/de.special-uninstallation-feedback-app?lic=OUFTTUItSksyS04tNzI2VTgtSlJUUUEtSlJWWUctV1czWTM&inst=NzYtNjM1Mjk1NzM4LVhPMzYrMS1OMUQrMS1QTCs5LVFJWDErNC1YMjAxMCsyLVZJUCsxLVNQMSsxLVRVRyszLUREVCs1MjUtU1QxMEFQUCsxLUREMTArMS1QMTBUQisy&prod=96&ver=10.0.1424" [?]
.
c:\users\CHV\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\CHV\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712]
Picture Motion Browser Medien-Prüfung.lnk - c:\program files (x86)\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2010-10-29 385024]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2009-8-1 2680160]
Google Calendar Sync.lnk - c:\program files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe [2011-4-8 542264]
SRS Premium Sound.lnk - c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe [2010-4-3 156952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ           autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\avgidsagent.exe [2012-07-04 5160568]
R2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-03 135664]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 250056]
R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2011-11-24 98616]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-03 135664]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-11-01 33736]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [2010-06-25 36928]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-28 113120]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2011-11-24 203320]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-10 1255736]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-04-19 28480]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-01-31 36944]
S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys [2009-06-18 15928]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-02-22 289872]
S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-12-23 47696]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-03-19 383808]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-30 169408]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2009-09-17 359552]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]
S2 MSSQL$GREENSQL2005;SQL Server (GREENSQL2005);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-08-12 87040]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-08-06 13784]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-10-01 2314240]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2011-12-23 124496]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfiltera.sys [2011-12-23 29776]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2009-10-15 117760]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-10-29 244736]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [2009-09-04 62464]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2009-10-27 75264]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2009-10-27 176640]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai        REG_MULTI_SZ           Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 11:25]
.
2012-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-03 00:37]
.
2012-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-03 00:37]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        97792        ----a-w-        c:\users\CHV\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        97792        ----a-w-        c:\users\CHV\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        97792        ----a-w-        c:\users\CHV\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        97792        ----a-w-        c:\users\CHV\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-15 17398376]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-01 323584]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-09-30 621440]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-29 497648]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.ch/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\CHV\AppData\Roaming\Mozilla\Firefox\Profiles\gp2is56n.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.google.ch/
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-Setwallpaper - c:\programdata\SetWallpaper.cmd
Wow6432Node-HKLM-Run-ROC_roc_dec12 - c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe
AddRemove-Amazon MP3-Downloader - m:\music\Jeannine\Uninstall.exe
AddRemove-ASUS_N_Series_Screensaver - c:\windows\system32\ASUS_N_Series_Screensaver.scr
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-07-14  20:45:55
ComboFix-quarantined-files.txt  2012-07-14 18:45
.
Vor Suchlauf: 11 Verzeichnis(se), 43'386'388'480 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 43'280'687'104 Bytes frei
.
- - End Of File - - 4500FCEABF68F4DC5BF79AE72B4FD560

--- --- ---

cosinus 14.07.2012 22:15
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

chnuschti 15.07.2012 07:57
Hallo Arne

Ich bin erst ab Montag wieder am PC.

GMER habe ich 2 oder 3 mal gestartet. Meist ist er schon nach ein paar Sekunden hängen geblieben. Einmal erst nach mehreren Minuten.

Ich machen mit OSRM weiter. Bis bald und vielen Dank.

Gruss
Chris

chnuschti 16.07.2012 16:36
Hallo Arne

Hier das OSRM Log. Das nächste Log folgt bald.

Vielen Dank und Gruss
Chris

Code:
OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 17:21:36 on 16.07.2012

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 64-bit
Default Browser: Mozilla Corporation Firefox 13.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - "AVG Technologies CZ, s.r.o." - C:\PROGRA~2\AVG\AVG2012\avgrsa.exe

[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\MLCFG32.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AVG Anti-Rootkit Driver" (Avgrkx64) - "AVG Technologies CZ, s.r.o." - C:\Windows\System32\DRIVERS\avgrkx64.sys
"AVG AVI Loader Driver" (Avgldx64) - "AVG Technologies CZ, s.r.o." - C:\Windows\System32\DRIVERS\avgldx64.sys
"AVG Mini-Filter Resident Anti-Virus Shield" (Avgmfx64) - "AVG Technologies CZ, s.r.o." - C:\Windows\System32\DRIVERS\avgmfx64.sys
"AVG TDI Driver" (Avgtdia) - "AVG Technologies CZ, s.r.o." - C:\Windows\System32\DRIVERS\avgtdia.sys
"AVGIDSDriver" (AVGIDSDriver) - "AVG Technologies CZ, s.r.o. " - C:\Windows\System32\DRIVERS\avgidsdrivera.sys
"AVGIDSFilter" (AVGIDSFilter) - "AVG Technologies CZ, s.r.o. " - C:\Windows\System32\DRIVERS\avgidsfiltera.sys
"AVGIDSHA" (AVGIDSHA) - "AVG Technologies CZ, s.r.o. " - C:\Windows\System32\DRIVERS\avgidsha.sys
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\fssfltr.sys
"lullaby" (lullaby) - "Windows (R) Win 7 DDK provider" - C:\Windows\System32\DRIVERS\lullaby.sys
"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\wimfltr.sys

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{45C6AFA5-2C13-402f-BC5D-45CC8172EF6B} "Bluetooth" - ? -   (File not found | COM-object registry key not found)
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)
{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
{F274614C-63F8-47D5-A4D1-FBDDE494F8D1} "XPLPPFilter Class" - "AVG Technologies CZ, s.r.o." - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files (x86)\7-Zip\7-zip.dll
{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} "AVG Find Extension" - ? -   (File not found | COM-object registry key not found)
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} "AVG Shell Extension Class" - "AVG Technologies CZ, s.r.o." - C:\Program Files (x86)\AVG\AVG2012\avgse.dll
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
{9DED7A30-D572-4D21-8D82-6945EA697400} "FlashPaperContextHandler Class" - ? - C:\Program Files (x86)\Macromedia\FlashPaper 2\FlashPaperContextMenu.dll
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\MLSHEXT.DLL
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
Shadow restore extension "{641D52A5-F996-4901" - ? -   (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
ITBar7Height64 "ITBar7Height64" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{8dcb7100-df86-4384-8842-8fa844297b3f} "Bing Bar" - "Microsoft Corporation." - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} "AVG Safe Search" - "AVG Technologies CZ, s.r.o." - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
{d2ce3e00-f94a-4740-988e-03dc2f38c34f} "Bing Bar Helper" - "Microsoft Corporation." - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Users\CHV\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Dropbox.lnk" - "Dropbox, Inc." - C:\Users\CHV\AppData\Roaming\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)
"Picture Motion Browser Medien-Prüfung.lnk" - "Sony Corporation" - C:\Program Files (x86)\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe  (Shortcut exists | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Bluetooth Manager.lnk" - "TOSHIBA CORPORATION." - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Google Calendar Sync.lnk" - "Google" - C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe  (Shortcut exists | File exists)
"SRS Premium Sound.lnk" - "SRS Labs, Inc." - C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"Akamai NetSession Interface" - "Akamai Technologies, Inc" - "C:\Users\CHV\AppData\Local\Akamai\netsession_win.exe"
"Shadow" - "NewTech Infosystems, Inc." - C:\Program Files (x86)\NewTech Infosystems\NTI Shadow for ReadyNAS\Shadow.exe --minimize
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"ATKMEDIA" - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
"ATKOSD2" - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
"AVG_TRAY" - "AVG Technologies CZ, s.r.o." - "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
"HControlUser" - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
"HTC Sync Loader" - ? - "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
"ITSecMng" - "TOSHIBA CORPORATION" - %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
"NUSB3MON" - "NEC Electronics Corporation" - "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"OKI HiperC Language Monitor7 x64" - "Oki Data Corporation" - C:\Windows\system32\OPDMN075.DLL
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
"Toshiba Bluetooth Monitor" - "TOSHIBA CORPORATION." - C:\Windows\system32\tbtmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"Adobe Active File Monitor V9" (AdobeActiveFileMonitor9.0) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
"AFBAgent" (AFBAgent) - "ASUSTeK Computer Inc." - C:\Windows\system32\FBAgent.exe
"Akamai NetSession Interface" (Akamai) - "Akamai Technologies, Inc" - c:\program files (x86)\common files\akamai\netsession_win_4f7fccd.dll
"ASLDR Service" (ASLDRService) - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
"ATKGFNEX Service" (ATKGFNEXSrv) - "ASUS" - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
"AVG Security Toolbar Service" (AVG Security Toolbar Service) - ? - C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe  (File not found)
"AVG WatchDog" (avgwd) - "AVG Technologies CZ, s.r.o." - C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
"AVGIDSAgent" (AVGIDSAgent) - "AVG Technologies CZ, s.r.o." - C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe
"BBUpdate" (BBUpdate) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
"Bing Bar Update Service" (BBSvc) - "Microsoft Corporation." - C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
"DCS Loader" (DCSLoader) - "Oki Data Corporation" - C:\Windows\system32\spool\DRIVERS\x64\3\OPHPLDCS.EXE
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
"Internet Pass-Through Service" (PassThru Service) - ? - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
"Macromedia Licensing Service" (Macromedia Licensing Service) - "Macromedia" - C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"SQL Server (GREENSQL2005)" (MSSQL$GREENSQL2005) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"SQL Server-Browser" (SQLBrowser) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
"TOSHIBA Bluetooth Service" (TOSHIBA Bluetooth Service) - "TOSHIBA CORPORATION" - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
"TurboBoost" (TurboBoost) - "Intel(R) Corporation" - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
"Windows Live Family Safety" (fsssvc) - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

chnuschti 17.07.2012 20:04
Guten Abend Arne

So, leider hatte ich grad ziemlich viel um die Ohren. Aber hier ist das Logfile. Ich musste AV Scan auf NONE setzen. AVG war ausgeschaltet.

Vielen Dank und schöne Grüsse
Chris

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-07-17 20:54:45
-----------------------------
20:54:45.703    OS Version: Windows x64 6.1.7601 Service Pack 1
20:54:45.703    Number of processors: 4 586 0x2502
20:54:45.719    ComputerName: CHV-PC  UserName: CHV
20:54:46.405    Initialize success
20:54:54.861    AVAST engine defs: 12071700
20:55:11.677    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
20:55:11.693    Disk 0 Vendor: ST950032 0002 Size: 476940MB BusType: 3
20:55:11.755    Disk 0 MBR read successfully
20:55:11.755    Disk 0 MBR scan
20:55:11.771    Disk 0 Windows VISTA default MBR code
20:55:11.771    Disk 0 Partition 1 00    1C Hidd FAT32 LBA MSDOS5.0    14997 MB offset 2048
20:55:11.787    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      119232 MB offset 30716280
20:55:11.802    Disk 0 Partition - 00    0F Extended LBA            342706 MB offset 274904280
20:55:11.833    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      342706 MB offset 274904343
20:55:11.865    Disk 0 scanning C:\Windows\system32\drivers
20:55:27.948    Service scanning
20:56:00.646    Modules scanning
20:56:00.646    Disk 0 trace - called modules:
20:56:01.223    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
20:56:01.223    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004c8c060]
20:56:01.239    3 CLASSPNP.SYS[fffff88001b6543f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80049a6050]
20:56:01.239    Scan finished successfully
21:01:51.709    Disk 0 MBR has been saved successfully to "Z:\Geschäft\EDV\MBR.dat"
21:01:51.740    The log file has been saved successfully to "Z:\Geschäft\EDV\aswMBR.txt"

cosinus 18.07.2012 15:54
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

chnuschti 19.07.2012 20:57
Hallo Arne

Hat leider etwas gedauert. Hier das Malwarebytes Log. Gestern musste ich meinen PC zwei Mal kalt starten da er extrem langsam wurde und selbst beim erzwungenen Abschalten nicht innert 3 min aus war. Heute lief es aber problemlos. Das andere Log kommt gleich.

Besten Dank und viele Grüsse
Chris

Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.19.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
CHV :: CHV-PC [Administrator]

Schutz: Deaktiviert

19.07.2012 20:36:13
mbam-log-2012-07-19 (21-53-43).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 379228
Laufzeit: 1 Stunde(n), 17 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\CHV\Downloads\YippyAlt_downloader_by_SchriftartenFontsde.exe (PUP.BundleInstaller.BI) -> Keine Aktion durchgeführt.

(Ende)

cosinus 20.07.2012 08:44
Was ist mit Superantispyware?

chnuschti 20.07.2012 16:18
Hallo Arne

So, endlich ist es vollbracht. hier das Logfile vom Super Antispyware.

Besten Dank und sorry, dass es so lange gedauert hat.
Greencube ist ein kostenloses ERP Programm von Europa 3000. Ich brauche das Prgramm aber nicht. Ist als Demo Version gedacht. Wenn es also starkt verseucht sein sollte, kann es weg.
und Yippi ist eine Schriftart... keine Ahnung warum da ein Bug drin sein soll...
Gruss
Chris

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 07/20/2012 at 05:15 PM

Application Version : 5.5.1006

Core Rules Database Version : 8932
Trace Rules Database Version: 6744

Scan type      : Complete Scan
Total Scan Time : 01:54:30

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 702
Memory threats detected  : 0
Registry items scanned    : 67677
Registry threats detected : 0
File items scanned        : 178157
File threats detected    : 455

Adware.Tracking Cookie
        C:\USERS\CHV\AppData\Roaming\Microsoft\Windows\Cookies\Low\IU3Y46NU.txt [ Cookie:chv@adfarm1.adition.com/ ]
        C:\USERS\CHV\AppData\Roaming\Microsoft\Windows\Cookies\Low\AOCZ5RNU.txt [ Cookie:chv@ad1.adfarm1.adition.com/ ]
        .mediaplex.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adserver.local.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .soundmedia.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .112.2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        fr.sitestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        fr.sitestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adserver.adtechus.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .thomascookag.122.2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad.zanox.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad.zanox.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .advertstream.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .burstnet.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .bubblestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad.dc2.adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad.dc2.adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .aka-cdn-ns.adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .aka-cdn-ns.adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .anet.tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .anet.tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        s07.flagcounter.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ads.gamersmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ads.gamersmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .myroitracking.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ads.clicksor.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ads.clicksor.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .clicksor.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .wownewmedia.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .wownewmedia.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .discountbargain.org [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .discountbargain.org [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .serw.clicksor.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .serw.clicksor.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .static.unister-adservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .static.unister-adservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .unister-adservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .skydeutschland.122.2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .realmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .realmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .realmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .realmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .conrad.122.2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        tracking.sim-technik.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .d2.zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .d2.zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .account.dyn.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .yieldmanager.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        server.adformdsp.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adformdsp.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .pm.eu.dp.yieldmanager.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .pm.eu.dp.yieldmanager.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .impde.tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .impde.tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ads.lfstmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ads.lfstmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ads.falkemedia.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .sonyeurope.112.2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .soundmedia.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .soundmedia.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .multimedia.wuffli.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .multimedia.wuffli.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .nikonjp.112.2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .c1.atdmt.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ads2.medianord.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        stat.onestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        stat.onestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .click.couponshop24.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .click.couponshop24.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        img-cdn.mediaplex.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ads20.wwe-media.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .img.mediaplex.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .img.mediaplex.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.mediamarkt.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .anetch.tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .anetch.tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        partners.webmasterplan.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .partners.webmasterplan.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .partners.webmasterplan.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .bubblestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .bubblestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .oc3.opticlick-ads2.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .oc3.opticlick-ads2.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .bubblestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .bubblestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .bubblestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www4.smartadserver.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .advertstream.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .dg.specificclick.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .dg.specificclick.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tracking2.interweave.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tracking2.interweave.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .mediamarkt.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .mediamarkt.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        shop.mediamarkt.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .mediacdn.disqus.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .mediacdn.disqus.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adserver1.mythings.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adserver1.mythings.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .cdn.mythingsmedia.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .cdn.mythingsmedia.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        openx.examedia.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .d8.zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .d8.zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .avgtechnologies.112.2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .img-cdn.mediaplex.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .img-cdn.mediaplex.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .media.fastclick.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .media.fastclick.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        banner.testberichte.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adserving.cpxinteractive.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adserving.cpxinteractive.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .edsa.122.2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad.yieldmanager.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad.yieldmanager.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .s0.2mdn.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .s0.2mdn.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .shop.mediamarkt.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .shop.mediamarkt.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .track.pubmatic.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .track.pubmatic.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        insight.torbit.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        in.getclicky.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad1.adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad1.adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .advertstream.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        wstat.wibiya.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .pixel.invitemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .pixel.invitemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .www.burstnet.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .impch.tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .impch.tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad2.adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .ad2.adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .api.zanox.ws [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .api.zanox.ws [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        api.zanox.ws [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .mm.chitika.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        adserver.datenwerk.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .aax-eu.amazon-adsystem.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .aax-eu.amazon-adsystem.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .burstnet.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .burstnet.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .track.adform.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .track.adform.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wfl4kkdjeco.stats.esomniture.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wjliagajifo.stats.esomniture.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.counter-go.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .quartermedia.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .cs.specificclick.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .cs.specificclick.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .view.atdmt.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .view.atdmt.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .imagesrv.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .imagesrv.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .77tracking.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .77tracking.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tracker.vinsight.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .webmap2.trafficmap.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .webmap2.trafficmap.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        webmap2.trafficmap.ch [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .trackalyzer.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        t1.trackalyzer.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        sales.liveperson.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .guj.122.2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        stats-eurex.six-group.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .c.gigcount.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.counter-go.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        stats.computecmedia.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .stats.paypal.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        www.counter-go.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\CHV\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GP2IS56N.DEFAULT\COOKIES.SQLITE ]

Trojan.Agent/Gen-Koobface[Bonkers]
        C:\PROGRAM FILES (X86)\GREENCUBE\PROC26.EXE

Adware.Somoto
        C:\USERS\CHV\DOWNLOADS\YIPPYALT_DOWNLOADER_BY_SCHRIFTARTENFONTSDE.EXE

cosinus 21.07.2012 14:12
Code:
Trojan.Agent/Gen-Koobface[Bonkers]
        C:\PROGRAM FILES (X86)\GREENCUBE\PROC26.EXE
Kennst du das Teil? Notfalls mal die Datei bei Virustotal auswerten und am besten auch bei uns hochladen => Trojaner-Board Upload Channel

Code:
Adware.Somoto
        C:\USERS\CHV\DOWNLOADS\YIPPYALT_DOWNLOADER_BY_SCHRIFTARTENFONTSDE.EXE
Einfach löschen, das Teil ist oder enthält Adware (nervige Werbung)

Ansonsten wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

chnuschti 21.07.2012 15:05
Hallo Arne

Vielen Dank für Deine tolle Hilfe. So wie es aussieht, funktioniert alles einwandfrei. Trotz mehreren Versuchen ist die Incredible Toolbar nicht mehr erschienen. Das System läuft soweit stabil und ohne Probleme.

Die Proc26.exe Datei habe ich hochgeladen. Vielleicht findet sich da etwas.
Die andere Datei werde ich löschen und die Cookies gleich mit, damit das System wieder einmal frisch beginnen kann.

Ein zweiter Browser für das rumgesurfe ist eine gute Idee. Muss es unbedingt Linux sein? Kann ich die auch einfach unter Windows starten und dafür gleich alles Löschen was sie runterladen?

Euer Service ist toll. Ich hab den "Schulungsthread" gelesen, aber da ich Selbstständig bin und auch eine Familie habe, fehlt mir die Zeit um regelmässig soviel Zeit zu reservieren. Aber es hört sich sehr spannend an und ich bin sicher Euch wird die "Arbeit" so schnell nicht ausgehen.

Ich wünsche Euch weiterhin viel Spass und gutes Gelingen. Vielen Dank.

PS: Kann ich die ganzen Programme einfach "deinstallieren" (beim Programm uninstall oder Systemsteuerung/Programme deinstallieren)?
Viele Grüsse
Chris

cosinus 23.07.2012 13:38
Die proc26.exe ist ein Fehlalarm!

Zitat:
Ein zweiter Browser für das rumgesurfe ist eine gute Idee. Muss es unbedingt Linux sein?
Wo bitte war von Linux die Rede?! :confused:
Nur weil ich Linux verwende ist das keine Aufforderung, dass du das auch umgehend nutzt! :wtf:


Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => http://www.adobe.com/products/flashp...ribution3.html

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

chnuschti 25.07.2012 20:56
Hallo Arne

Ich dachte nur, weil Du Linux geschrieben hast. Wenn natürlich schon ein Linux System da ist, ist das sicher weniger anfällig!

Vielen Dank für Deine Tipps. Ich werde sie beherzigen und hoffe, dass ich Euch keine "Arbeit" mehr bereiten muss.

Alles Gute und vielen Dank nochmals. Ich wünsche Dir/Euch weiterhin viel Freude am Vieren killen! :-). Alles Gute.

Viele Grüsse
Chris


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:45 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131