Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Live Security Platinum 3.6.1 verweigert auf alles Zugriffe, Hilfe (https://www.trojaner-board.de/121146-live-security-platinum-3-6-1-verweigert-alles-zugriffe-hilfe.html)

Chrissilein 03.08.2012 14:15
Live Security Platinum 3.6.1 verweigert auf alles Zugriffe, Hilfe
 
Hallo,

ich bin nagelneu im Forum und leider eine IT-Niete. Mein Laptop hat sich den Live Security Platinum Virus eingefangen. Ich kann nichts mehr öffnen, alle Programme werden blockiert, also komme ich auch nicht ins Internet, um die ganzen angegebenen Programme zu downloaden (z.B. Malwarebyte).

Da ich ja zunächst keinen Zugriff auf Internet hatte, hab ich blöderweise in meiner Panik erstmal alles, was den Namen Live Security Scan im Dateinamen hatte sofort gelöscht. Hat natürlich nichts gebracht. Mein Avria konnte mir nicht helfen, hat zwar Viren entdeckt, aber konnte nicht drauf zugreifen, weil blockiert.

Jetzt habe ich den Laptop von einem Freund für kurze Zeit zur Verfügung. Was kann ich tun? Bin für Hilfe sehr dankbar, muss meine Thesis weiterschreiben und jeder Tag ohne Laptop ist ein verlorener Schreibtag :(((

mitlerweile habe ich es geschafft, malwarebyte auf einen usb-stick zu speichern und im abgesicherten modus auf meinem Laptop zu starten. da ich ja kein internet hab, schreibe ich den code jetzt per hand hier ab. traue mich nicht, den vielleicht infizierten usb-stick in den laptop von dem freund zu stecken, oder braucht man da keine bedenken zu haben? der laptop vom freund hat übrigens nicht windows sondern ubuntu, er meinte, dann ist es vielleicht noch ungefährlicher?!



Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.03.05

Windows Vista x86 NTFS (Abgesichertenmodus)
Internet Explorer 7.0.6000.16982
xxxx :: xxxx-PC [Administrator]

Schutz: Deaktiviert

03.ß8.2012 17:32:59
mbam-log-2012-08-03 (17-32-59).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 293130
Laufzeit: 27 Minute(n), 1 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCU\SOFTWARE\CLASSES\CLSID\{42AEDC87-2188-41FD-B9A3-0C966FEABEC1}\INPROCSERVER32 (Trojan.Zaccess) -> Erfolgreich gelöscht und in Quarantäne gestellt
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum (Rogue.LiveSecurityPlatinum) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32| (Trojan.Zaccess) -> Daten: C\Users\****\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\n. -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C\Users\****\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\U\800000cb.@ (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

jetzt habe ich nochmal im abgesicherten modus mit netzwerkverbindung gestartet und daher wieder internetverbindung. habe nochmal malwarebyte durchlaufen lassen und folgenden Code erhalten

Code:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.03.06

Windows Vista x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 7.0.6000.16982
Tina :: TINA-PC [Administrator]

Schutz: Deaktiviert

03.08.2012 18:47:44
mbam-log-2012-08-03 (18-47-44).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 281190
Laufzeit: 27 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce|036DFF980009BA0C02F38ABCC2E33E28 (Trojan.LameShield) -> Daten: C:\ProgramData\036DFF980009BA0C02F38ABCC2E33E28\036DFF980009BA0C02F38ABCC2E33E28.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\ProgramData\036DFF980009BA0C02F38ABCC2E33E28\036DFF980009BA0C02F38ABCC2E33E28.exe (Trojan.LameShield) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Tina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1HS6V847\soft3[1].exe (RootKit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Tina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1HS6V847\soft4[1].exe (Trojan.LameShield) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Tina\AppData\Local\Temp\msimg32.dll (RootKit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Tina\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\n (RootKit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
___________________________________________________________________________
hey super, nach dem zweiten durchlauf von malwarebyte funktioniert wieder alles. aber sicherlich ist irgendwo doch noch etwas versteckt, was mir später mal probleme machen kann, oder?

cosinus 05.08.2012 12:54
Führ bitte auch ESET aus, danach sehen wir weiter.

Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden.

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
  • Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen
  • Dein Anti-Virus-Programm während des Scans deaktivieren.

    Button http://img695.imageshack.us/img695/1599/eset1l.jpg (<< klick) drücken.
    • Firefox-User:
      Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
    • IE-User:
      müssen das Installieren eines ActiveX Elements erlauben.
  • Setze den einen Haken bei Yes, i accept the Terms of Use.
  • Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
  • Warte bis die Komponenten herunter geladen wurden.
  • Setze einen Haken bei "Scan archives".
  • Gehe sicher das bei Remove Found Threats kein Hacken gesetzt ist.
  • http://img707.imageshack.us/img707/687/starteg.jpg drücken.
  • Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.
Wenn der Scan beendet wurde
  • Klicke Finish.
  • Browser schließen.
Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und kopiere folgenden Text in das Ausführen Fenster.
Code:
"%PROGRAMFILES%\Eset\Eset Online Scanner\log.txt"
Hinweis: Falls du ein 64-Bit-Windows einsetzt, lautet der Pfad so:

Code:
"%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\log.txt"
Poste nun den Inhalt der log.txt.


Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Chrissilein 06.08.2012 17:43
Hallo Arne,
danke für deine Rückmeldung :daumenhoc. Habe wie angewiesen den ESET Online-Scanner benutzt und folgende Log.txt erhalten:

Code:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=9399512aa56b6b4686fa5fd5d349b555
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-05 08:04:46
# local_time=2012-08-05 10:04:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=1792 16777191 100 0 24826385 24826385 0 0
# compatibility_mode=5892 16776573 100 100 216827 181729030 0 0
# compatibility_mode=8192 67108863 100 0 1253 1253 0 0
# scanned=1767
# found=0
# cleaned=0
# scan_time=806
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=9399512aa56b6b4686fa5fd5d349b555
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-06 04:35:57
# local_time=2012-08-06 06:35:57 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=1792 16777191 100 0 24895378 24895378 0 0
# compatibility_mode=5892 16776574 100 100 285820 181798023 0 0
# compatibility_mode=8192 67108863 100 0 70246 70246 0 0
# scanned=114707
# found=1
# cleaned=0
# scan_time=5683
C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\U\80000000.@        a variant of Win32/Sirefef.FA trojan (unable to clean)        00000000000000000000000000000000        I

Bin gespannt und warte auf weitere Anweisungen :D
Gruß, chrissilein

cosinus 07.08.2012 11:39
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Chrissilein 07.08.2012 20:07
ok. hier kommt der text:

Code:

# AdwCleaner v1.800 - Logfile created 08/07/2012 at 21:03:11
# Updated 01/08/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium  (32 bits)
# User : ***
# Running from : C:\Users\***\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****


***** [Registre - GUID] *****

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v7.0.6000.16982

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default
File : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\bow9ol4v.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [923 octets] - [07/08/2012 21:03:11]

########## EOF - C:\AdwCleaner[R1].txt - [1050 octets] ##########
fertig. was kommt nun?
gruß, chrissilein

cosinus 08.08.2012 19:20
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Chrissilein 08.08.2012 20:12
soo, hier kommt der inhalt der text-datei:

Code:


# AdwCleaner v1.800 - Logfile created 08/08/2012 at 20:43:09
# Updated 01/08/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium  (32 bits)
# User : ***
# Running from : C:\Users\***\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****


***** [Registre - GUID] *****

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v7.0.6000.16982

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default
File : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\bow9ol4v.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1051 octets] - [07/08/2012 21:03:11]
AdwCleaner[S1].txt - [987 octets] - [08/08/2012 20:43:09]

########## EOF - C:\AdwCleaner[S1].txt - [1114 octets] ##########
was als nächstes?

Gruß, Chrissilein

cosinus 09.08.2012 15:40
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Chrissilein 09.08.2012 16:10
Hallo Arne,

ich erkenne momentan bei meinem Laptop keine Änderungen verglichen zu früher. Die Programme, die ich seit dem Virus genutzt habe, und Internet funktionieren wieder einwandfrei.

Bei den Programmen ist nur der Ordner "Autostart" leer. Aber ich kann nicht mehr sagen, ob da vorher überhaupt was drin war. Alle anderen Ordner sehen vollständig aus.

Gruß, Chrissilein

cosinus 10.08.2012 19:00
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Chrissilein 11.08.2012 13:31
das ist der Text aus der OTL.txt

OTL Logfile:
Code:
OTL logfile created on: 11.08.2012 13:24:08 - Run 1
OTL by OldTimer - Version 3.2.56.0    Folder = C:\Users\***\Pictures\100_JD50\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,23 Gb Available Physical Memory | 61,42% Memory free
4,21 Gb Paging File | 3,22 Gb Available in Paging File | 76,54% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 147,38 Gb Total Space | 93,73 Gb Free Space | 63,60% Space Free | Partition Type: NTFS
Drive D: | 73,69 Gb Total Space | 73,60 Gb Free Space | 99,88% Space Free | Partition Type: NTFS
 
Computer Name: ***-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.11 13:21:06 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\***\Pictures\100_JD50\Desktop\OTL.exe
PRC - [2012.08.08 21:04:30 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.05.11 20:47:47 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.11 20:47:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.11 20:47:47 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.10.25 22:05:59 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2007.07.10 19:29:16 | 000,557,056 | ---- | M] (C&E) -- C:\Program Files\C&E\OSD\osd.exe
PRC - [2007.05.10 17:10:06 | 004,468,736 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe
PRC - [2006.11.22 18:31:26 | 000,630,784 | ---- | M] (Motorola Inc.) -- C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2006.11.22 18:31:30 | 000,065,536 | ---- | M] () -- C:\Program Files\Motorola\SMSERIAL\sm56ita.dll
MOD - [2006.11.22 18:31:30 | 000,065,536 | ---- | M] () -- C:\Program Files\Motorola\SMSERIAL\sm56esp.dll
MOD - [2006.11.22 18:31:30 | 000,065,536 | ---- | M] () -- C:\Program Files\Motorola\SMSERIAL\sm56brz.dll
MOD - [2006.11.22 18:31:30 | 000,053,248 | ---- | M] () -- C:\Program Files\Motorola\SMSERIAL\sm56kor.dll
MOD - [2006.11.22 18:31:28 | 000,065,536 | ---- | M] () -- C:\Program Files\Motorola\SMSERIAL\sm56ger.dll
MOD - [2006.11.22 18:31:28 | 000,065,536 | ---- | M] () -- C:\Program Files\Motorola\SMSERIAL\sm56fra.dll
MOD - [2006.11.22 18:31:28 | 000,065,536 | ---- | M] () -- C:\Program Files\Motorola\SMSERIAL\sm56dnk.dll
MOD - [2006.11.22 18:31:28 | 000,057,344 | ---- | M] () -- C:\Program Files\Motorola\SMSERIAL\sm56jpn.dll
MOD - [2006.11.22 18:31:28 | 000,053,248 | ---- | M] () -- C:\Program Files\Motorola\SMSERIAL\sm56cht.dll
MOD - [2006.11.22 18:31:28 | 000,053,248 | ---- | M] () -- C:\Program Files\Motorola\SMSERIAL\sm56chs.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService)
SRV - [2012.07.19 19:25:31 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.05.11 20:47:47 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.11 20:47:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2007.11.06 06:04:37 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.05.11 20:47:47 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.11 20:47:47 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007.07.19 01:31:00 | 007,599,776 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007.07.02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvrd32.sys -- (nvrd32)
DRV - [2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.06.13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2007.04.30 13:42:14 | 000,081,408 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007.04.04 05:57:00 | 000,046,592 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)
DRV - [2007.02.25 06:14:00 | 002,216,448 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32)
DRV - [2007.01.30 09:31:52 | 000,210,224 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\Si3531.sys -- (Si3531)
DRV - [2006.11.22 18:35:00 | 000,982,272 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2006.10.18 13:20:00 | 000,005,504 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiRemFil.sys -- (SiRemFil)
DRV - [2004.11.01 10:21:00 | 000,010,368 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiWinAcc.sys -- (SiFilter)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-568467323-724638088-875492025-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-568467323-724638088-875492025-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-568467323-724638088-875492025-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-568467323-724638088-875492025-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.facebook.com/"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.19 19:25:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.06.28 10:32:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.19 19:25:32 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.10.23 13:41:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.05.06 10:44:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\bow9ol4v.default\extensions
[2012.07.22 11:57:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.07.19 19:25:32 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.06.17 22:20:58 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.17 22:20:58 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.17 22:20:58 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.17 22:20:58 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.17 22:20:58 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.17 22:20:58 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OSD] C:\Program Files\C&E\OSD\osd.exe (C&E)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O7 - HKU\S-1-5-21-568467323-724638088-875492025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{25A2B9D4-5243-48FC-B7A0-A40C6731EADE}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.mkdmp3enc - C:\PROGRA~1\CYBERL~1\PowerDV\Kernel\Burner\MKDMP3Enc.ACM File not found
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.11 13:21:04 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\***\Pictures\100_JD50\Desktop\OTL.exe
[2012.08.05 21:30:49 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.08.05 21:28:20 | 002,322,184 | ---- | C] (ESET) -- C:\Users\***\Pictures\100_JD50\Desktop\esetsmartinstaller_enu.exe
[2012.08.03 17:10:37 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2012.08.03 17:10:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.03 17:10:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.03 17:10:30 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.03 17:10:30 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.03 13:03:03 | 000,000,000 | ---D | C] -- C:\ProgramData\036DFF980009BA0C02F38ABCC2E33E28
[2012.07.22 12:21:47 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Uni Theorie_Praxis-Transfer
[2012.07.22 12:21:21 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Rechnung Entega
[2012.07.20 09:59:11 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Kreditkartenabrechnungen
[2012.07.19 11:47:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.07.19 11:47:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012.07.13 19:27:58 | 000,000,000 | R--D | C] -- C:\Users\***\Dropbox
[2012.07.13 19:25:26 | 000,000,000 | ---D | C] -- C:\Program Files\Dropbox
[2012.07.13 19:25:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2012.07.13 19:24:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Dropbox
 
========== Files - Modified Within 30 Days ==========
 
[2024.02.05 06:00:02 | 002,355,420 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\JD500411.JPG
[2012.08.11 13:21:31 | 000,027,240 | ---- | M] () -- C:\Users\***\AppData\Roaming\nvModes.001
[2012.08.11 13:21:06 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\***\Pictures\100_JD50\Desktop\OTL.exe
[2012.08.11 13:20:50 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.11 13:20:50 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.11 12:26:23 | 000,641,344 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.08.11 12:26:23 | 000,610,142 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.08.11 12:26:23 | 000,116,706 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.08.11 12:26:23 | 000,103,924 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.08.11 12:21:01 | 000,000,312 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012.08.11 12:20:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.11 12:20:40 | 2145,837,056 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.10 22:57:12 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.08.10 22:35:23 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{DC2F8076-C24D-4EE9-B46D-B047A3BBFEF9}.job
[2012.08.09 19:13:15 | 221,056,274 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.08.06 21:22:08 | 000,027,240 | ---- | M] () -- C:\Users\***\AppData\Roaming\nvModes.dat
[2012.08.05 21:28:23 | 002,322,184 | ---- | M] (ESET) -- C:\Users\***\Pictures\100_JD50\Desktop\esetsmartinstaller_enu.exe
[2012.08.03 17:32:38 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.02 14:13:38 | 000,080,468 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\*** Kartenbestellung erfolgreich.pdf
[2012.07.31 18:19:38 | 000,000,081 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\Desktop anzeigen.scf
[2012.07.29 21:45:39 | 000,347,124 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\DSC00512.JPG
[2012.07.29 21:45:22 | 000,425,649 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\DSC00510.JPG
[2012.07.29 21:45:03 | 000,401,173 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\DSC00511.JPG
[2012.07.29 21:44:16 | 000,301,645 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\DSC00513.JPG
[2012.07.24 22:07:46 | 000,045,410 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\easyJet Buchungsnummer.eml
[2012.07.24 22:07:37 | 000,004,027 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\Confirmation for reservation ***, Berlin, 08 September..eml
[2012.07.22 11:52:29 | 000,000,810 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.07.19 11:47:00 | 000,001,880 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.07.18 09:35:10 | 000,039,208 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\Fahrinfo ***.pdf
[2012.07.18 09:33:52 | 000,039,320 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\Fahrinfo ***.pdf
[2012.07.13 19:27:58 | 000,000,958 | ---- | M] () -- C:\Users\***\Pictures\100_JD50\Desktop\Dropbox.lnk
 
========== Files Created - No Company Name ==========
 
[2012.08.03 19:57:58 | 2145,837,056 | -HS- | C] () -- C:\hiberfil.sys
[2012.08.03 17:10:31 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.03 14:38:19 | 000,013,312 | ---- | C] () -- C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\U\80000000.@
[2012.08.03 14:12:42 | 000,001,712 | ---- | C] () -- C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\U\00000001.@
[2012.08.02 14:13:36 | 000,080,468 | ---- | C] () -- C:\Users\***\Pictures\100_JD50\Desktop\*** Kartenbestellung erfolgreich.pdf
[2012.07.31 18:19:38 | 000,000,081 | ---- | C] () -- C:\Users\***\Pictures\100_JD50\Desktop\Desktop anzeigen.scf
[2012.07.29 21:45:21 | 000,425,649 | ---- | C] () -- C:\Users\***\Pictures\100_JD50\Desktop\DSC00510.JPG
[2012.07.29 21:45:03 | 000,401,173 | ---- | C] () -- C:\Users\***\Pictures\100_JD50\Desktop\DSC00511.JPG
[2012.07.29 21:44:43 | 000,347,124 | ---- | C] () -- C:\Users\***\Pictures\100_JD50\Desktop\DSC00512.JPG
[2012.07.29 21:44:16 | 000,301,645 | ---- | C] () -- C:\Users\***\Pictures\100_JD50\Desktop\DSC00513.JPG
[2012.07.26 13:10:18 | 221,056,274 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.07.24 22:07:45 | 000,045,410 | ---- | C] () -- C:\Users\***\Pictures\100_JD50\Desktop\easyJet Buchungsnummer  ***.eml
[2012.07.24 22:07:36 | 000,004,027 | ---- | C] () -- C:\Users\***\Pictures\100_JD50\Desktop\Confirmation for reservation ***, ***, 08 September..eml
[2012.07.18 09:35:10 | 000,039,208 | ---- | C] () -- C:\Users\***\Pictures\100_JD50\Desktop\Fahrinfo ***.pdf
[2012.07.18 09:33:52 | 000,039,320 | ---- | C] () -- C:\Users\***\Pictures\100_JD50\Desktop\Fahrinfo ***.pdf
[2012.07.13 19:27:58 | 000,000,958 | ---- | C] () -- C:\Users\***\Pictures\100_JD50\Desktop\Dropbox.lnk
[2012.04.01 20:02:56 | 000,000,680 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2012.02.25 22:55:19 | 000,042,758 | ---- | C] () -- C:\Users\***\SCHUFA.pdf
[2012.01.19 21:12:46 | 000,000,165 | ---- | C] () -- C:\Windows\wiso.ini
[2012.01.15 20:57:58 | 547,092,033 | ---- | C] () -- C:\Users\***\OFFICE 2007.zip
[2011.11.27 15:33:34 | 000,000,000 | ---- | C] () -- C:\Users\***\AppData\Roaming\wklnhst.dat
[2011.10.30 18:37:54 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2011.10.30 18:37:53 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat
[2011.10.30 18:37:53 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat
[2011.10.30 18:37:53 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat
[2011.10.30 18:37:53 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat
[2011.10.30 18:37:53 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat
[2011.10.30 18:37:53 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat
[2011.10.30 18:37:53 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat
[2011.10.30 18:37:53 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat
[2011.10.30 18:37:53 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat
[2011.10.30 18:37:53 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat
[2011.10.30 18:37:53 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat
[2011.10.30 18:37:53 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat
[2011.10.30 18:37:53 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat
[2011.10.30 18:37:53 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat
[2011.10.30 18:37:53 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat
[2011.10.30 18:37:53 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat
[2011.10.30 18:37:53 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat
[2011.10.30 18:37:53 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat
[2011.10.30 18:35:16 | 000,000,025 | ---- | C] () -- C:\Windows\CSES20.ini
[2011.10.23 16:23:21 | 000,017,408 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.23 13:34:34 | 000,027,240 | ---- | C] () -- C:\Users\***\AppData\Roaming\nvModes.001
[2011.10.23 13:12:59 | 000,027,240 | ---- | C] () -- C:\Users\***\AppData\Roaming\nvModes.dat
[2006.11.02 10:31:23 | 000,002,048 | -HS- | C] () -- C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\@
 
========== LOP Check ==========
 
[2012.01.19 21:15:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Buhl Data Service
[2012.07.26 20:49:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox
[2011.12.16 09:44:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\EPSON
[2011.10.24 21:51:03 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GlarySoft
[2011.11.27 15:12:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2011.11.27 15:33:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Template
[2011.10.23 13:46:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Thunderbird
[2012.08.11 12:21:01 | 000,000,312 | ---- | M] () -- C:\Windows\Tasks\GlaryInitialize.job
[2012.08.10 22:57:11 | 000,032,574 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.08.10 22:35:23 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{DC2F8076-C24D-4EE9-B46D-B047A3BBFEF9}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.10.23 16:32:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe
[2012.02.28 10:31:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ahead
[2011.10.23 13:39:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Avira
[2012.01.19 21:15:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Buhl Data Service
[2012.07.26 20:49:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox
[2011.12.16 09:44:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\EPSON
[2011.10.24 21:51:03 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GlarySoft
[2011.10.23 13:11:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities
[2011.10.30 18:37:52 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InstallShield
[2011.10.23 13:33:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia
[2012.08.03 17:10:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs
[2012.03.13 20:56:09 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft
[2011.10.23 13:41:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mozilla
[2011.11.27 15:12:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2012.07.22 11:51:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Skype
[2011.11.27 15:33:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Template
[2011.10.23 13:46:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Thunderbird
 
< %APPDATA%\*.exe /s >
[2012.07.03 03:21:38 | 026,868,192 | ---- | M] (Dropbox, Inc.) -- C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe
[2012.07.03 03:21:40 | 000,874,424 | ---- | M] (Dropbox, Inc.) -- C:\Users\***\AppData\Roaming\Dropbox\bin\DropboxUpdateHelper.exe
[2012.07.03 03:21:46 | 000,181,784 | ---- | M] (Dropbox, Inc.) -- C:\Users\***\AppData\Roaming\Dropbox\bin\Uninstall.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2011.10.25 22:06:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\drivers\atapi.sys
[2011.10.25 22:06:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2011.10.25 22:06:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2011.10.25 22:06:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_ec8a8d1b\iaStor.sys
[2007.02.12 14:36:54 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\DRIVER\SATA\INTEL\iaStor.sys
[2007.02.12 14:36:54 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\Windows\System32\drivers\iaStor.sys
[2007.02.12 14:36:54 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1cb29a96\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=703E3A7093B0FAC0EEBADBB8E931ECAF -- C:\Windows\System32\drivers\nvstor32.sys
[2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=703E3A7093B0FAC0EEBADBB8E931ECAF -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_bbf77119\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.11.06 05:56:47 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2007.11.06 05:56:47 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2007.11.06 05:56:47 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: VIAMRAID.SYS  >
[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\drivers\viamraid.sys
[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\DriverStore\FileRepository\viamraid.inf_74a36694\viamraid.sys
 
< MD5 for: WININIT.EXE  >
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\System32\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\System32\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\System32\drivers\ws2ifsl.sys
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2007.11.06 14:47:09 | 006,664,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2007.11.06 14:47:07 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2007.11.06 14:47:09 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2007.11.06 14:47:17 | 015,720,448 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2007.11.06 14:47:18 | 006,021,120 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2011.10.25 22:34:09 | 000,347,136 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll
[2011.10.25 22:34:09 | 000,214,528 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 901 bytes -> C:\Users\***\Pictures\100_JD50\Desktop\easyJet Buchungsnummer .eml:OECustomProperty
@Alternate Data Stream - 1191 bytes -> C:\Users\***\Pictures\100_JD50\Desktop\Confirmation for reservation ***, Berlin, 08 September..eml:OECustomProperty

< End of report >
--- --- ---




[/code]

cosinus 11.08.2012 18:34
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
FF - user.js - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
:Files
C:\ProgramData\036DFF980009BA0C02F38ABCC2E33E28
C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\U
C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\L
C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\n
C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\@
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Chrissilein 12.08.2012 10:44
ok, hier das neue logfile:

Code:

All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
========== FILES ==========
C:\ProgramData\036DFF980009BA0C02F38ABCC2E33E28 folder moved successfully.
C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\U folder moved successfully.
C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\L folder moved successfully.
File\Folder C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\n not found.
File\Folder C:\Users\***\AppData\Local\{e8122383-0afc-be9c-a7c7-4af6c6897fe0}\@ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: ***
->Temp folder emptied: 22224394 bytes
->Temporary Internet Files folder emptied: 27975664 bytes
->Java cache emptied: 1797581 bytes
->FireFox cache emptied: 138330057 bytes
->Flash cache emptied: 6053 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 8233761 bytes
RecycleBin emptied: 596480 bytes
 
Total Files Cleaned = 190,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: ***
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.57.0 log created on 08122012_113405

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

cosinus 12.08.2012 14:03
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Chrissilein 12.08.2012 19:31
done! hier der report:

Code:

20:24:41.0431 3956        TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32
20:24:41.0711 3956        ============================================================
20:24:41.0712 3956        Current date / time: 2012/08/12 20:24:41.0711
20:24:41.0712 3956        SystemInfo:
20:24:41.0712 3956       
20:24:41.0712 3956        OS Version: 6.0.6000 ServicePack: 0.0
20:24:41.0712 3956        Product type: Workstation
20:24:41.0712 3956        ComputerName: ***-PC
20:24:41.0713 3956        UserName: ***
20:24:41.0713 3956        Windows directory: C:\Windows
20:24:41.0713 3956        System windows directory: C:\Windows
20:24:41.0713 3956        Processor architecture: Intel x86
20:24:41.0713 3956        Number of processors: 2
20:24:41.0713 3956        Page size: 0x1000
20:24:41.0713 3956        Boot type: Normal boot
20:24:41.0713 3956        ============================================================
20:24:42.0502 3956        Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
20:24:42.0507 3956        ============================================================
20:24:42.0507 3956        \Device\Harddisk0\DR0:
20:24:42.0507 3956        MBR partitions:
20:24:42.0507 3956        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x17A3800, BlocksNum 0x126C1800
20:24:42.0507 3956        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x13E65000, BlocksNum 0x9360000
20:24:42.0508 3956        ============================================================
20:24:42.0557 3956        C: <-> \Device\Harddisk0\DR0\Partition0
20:24:42.0608 3956        D: <-> \Device\Harddisk0\DR0\Partition1
20:24:42.0608 3956        ============================================================
20:24:42.0608 3956        Initialize success
20:24:42.0608 3956        ============================================================
20:25:40.0544 3832        ============================================================
20:25:40.0544 3832        Scan started
20:25:40.0544 3832        Mode: Manual; SigCheck; TDLFS;
20:25:40.0544 3832        ============================================================
20:25:41.0266 3832        ACPI            (84fc6df81212d16be5c4f441682feccc) C:\Windows\system32\drivers\acpi.sys
20:25:41.0501 3832        ACPI - ok
20:25:41.0584 3832        adp94xx        (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
20:25:41.0636 3832        adp94xx - ok
20:25:41.0686 3832        adpahci        (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
20:25:41.0725 3832        adpahci - ok
20:25:41.0742 3832        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
20:25:41.0765 3832        adpu160m - ok
20:25:41.0796 3832        adpu320        (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
20:25:41.0829 3832        adpu320 - ok
20:25:41.0881 3832        AeLookupSvc    (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll
20:25:42.0127 3832        AeLookupSvc - ok
20:25:42.0176 3832        AFD            (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys
20:25:42.0319 3832        AFD - ok
20:25:42.0367 3832        agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
20:25:42.0387 3832        agp440 - ok
20:25:42.0411 3832        aic78xx        (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
20:25:42.0433 3832        aic78xx - ok
20:25:42.0460 3832        ALG            (e69fb0e3112c40fdc0ef7d21a52dc951) C:\Windows\System32\alg.exe
20:25:42.0513 3832        ALG - ok
20:25:42.0522 3832        aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
20:25:42.0542 3832        aliide - ok
20:25:42.0555 3832        amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
20:25:42.0576 3832        amdagp - ok
20:25:42.0585 3832        amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
20:25:42.0605 3832        amdide - ok
20:25:42.0619 3832        AmdK7          (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
20:25:42.0731 3832        AmdK7 - ok
20:25:42.0742 3832        AmdK8          (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
20:25:42.0867 3832        AmdK8 - ok
20:25:42.0974 3832        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Program Files\Avira\AntiVir Desktop\sched.exe
20:25:43.0000 3832        AntiVirSchedulerService - ok
20:25:43.0047 3832        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
20:25:43.0067 3832        AntiVirService - ok
20:25:43.0121 3832        Appinfo        (cfa455816879f06f1c4e5bbf9e8aef7d) C:\Windows\System32\appinfo.dll
20:25:43.0252 3832        Appinfo - ok
20:25:43.0276 3832        arc            (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
20:25:43.0299 3832        arc - ok
20:25:43.0337 3832        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
20:25:43.0359 3832        arcsas - ok
20:25:43.0375 3832        AsyncMac        (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys
20:25:43.0509 3832        AsyncMac - ok
20:25:43.0539 3832        atapi          (b35cfcef838382ab6490b321c87edf17) C:\Windows\system32\drivers\atapi.sys
20:25:43.0561 3832        atapi - ok
20:25:43.0636 3832        AudioEndpointBuilder (e760fc1bd68f7f6f1b17eb4e8d9480b0) C:\Windows\System32\Audiosrv.dll
20:25:43.0767 3832        AudioEndpointBuilder - ok
20:25:43.0779 3832        Audiosrv        (e760fc1bd68f7f6f1b17eb4e8d9480b0) C:\Windows\System32\Audiosrv.dll
20:25:43.0909 3832        Audiosrv - ok
20:25:44.0022 3832        avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\Windows\system32\DRIVERS\avgntflt.sys
20:25:44.0100 3832        avgntflt - ok
20:25:44.0135 3832        avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\Windows\system32\DRIVERS\avipbb.sys
20:25:44.0168 3832        avipbb - ok
20:25:44.0203 3832        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys
20:25:44.0224 3832        avkmgr - ok
20:25:44.0269 3832        Beep            (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys
20:25:44.0389 3832        Beep - ok
20:25:44.0464 3832        BFE            (96b73cc64bd905ea6cc4e44384abd8c9) C:\Windows\System32\bfe.dll
20:25:44.0525 3832        BFE - ok
20:25:44.0644 3832        BITS            (da551697e34d2b9943c8b1c8eaffe89a) C:\Windows\System32\qmgr.dll
20:25:44.0775 3832        BITS - ok
20:25:44.0782 3832        blbdrive - ok
20:25:44.0829 3832        bowser          (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys
20:25:44.0959 3832        bowser - ok
20:25:45.0008 3832        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
20:25:45.0129 3832        BrFiltLo - ok
20:25:45.0137 3832        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
20:25:45.0256 3832        BrFiltUp - ok
20:25:45.0295 3832        Browser        (beb6470532b7461d7bb426e3facb424f) C:\Windows\System32\browser.dll
20:25:45.0433 3832        Browser - ok
20:25:45.0477 3832        Brserid        (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
20:25:45.0606 3832        Brserid - ok
20:25:45.0667 3832        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
20:25:45.0804 3832        BrSerWdm - ok
20:25:45.0827 3832        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
20:25:45.0928 3832        BrUsbMdm - ok
20:25:45.0961 3832        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
20:25:46.0064 3832        BrUsbSer - ok
20:25:46.0100 3832        BthEnum        (cf97c2d6a011ee9403b42191b5f95ba8) C:\Windows\system32\DRIVERS\BthEnum.sys
20:25:46.0169 3832        BthEnum - ok
20:25:46.0193 3832        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
20:25:46.0317 3832        BTHMODEM - ok
20:25:46.0352 3832        BthPan          (b8c3d9ddf85fd197c3e5f849fef71144) C:\Windows\system32\DRIVERS\bthpan.sys
20:25:46.0472 3832        BthPan - ok
20:25:46.0534 3832        BTHPORT        (b4ce8000aab30a9ab16cd0fb3db4d7cf) C:\Windows\system32\Drivers\BTHport.sys
20:25:46.0603 3832        BTHPORT - ok
20:25:46.0630 3832        BthServ        (58ee7f5e68310bc8d4e7cebd8358c12e) C:\Windows\System32\bthserv.dll
20:25:46.0747 3832        BthServ - ok
20:25:46.0829 3832        BTHUSB          (9a4ddc8544c1459aa2a118a8858dade3) C:\Windows\system32\Drivers\BTHUSB.sys
20:25:46.0862 3832        BTHUSB - ok
20:25:46.0913 3832        cdfs            (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys
20:25:47.0028 3832        cdfs - ok
20:25:47.0071 3832        cdrom          (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys
20:25:47.0176 3832        cdrom - ok
20:25:47.0231 3832        CertPropSvc    (0600e04315fe543802a379d5d23c8be0) C:\Windows\System32\certprop.dll
20:25:47.0343 3832        CertPropSvc - ok
20:25:47.0369 3832        circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\DRIVERS\circlass.sys
20:25:47.0471 3832        circlass - ok
20:25:47.0539 3832        CLFS            (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys
20:25:47.0567 3832        CLFS - ok
20:25:47.0671 3832        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:25:47.0730 3832        clr_optimization_v2.0.50727_32 - ok
20:25:47.0791 3832        CLTNetCnService - ok
20:25:47.0822 3832        CmBatt          (ed97ad3df1b9005989eaf149bf06c821) C:\Windows\system32\DRIVERS\CmBatt.sys
20:25:47.0857 3832        CmBatt - ok
20:25:47.0890 3832        cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
20:25:47.0910 3832        cmdide - ok
20:25:47.0919 3832        Compbatt        (722936afb75a7f509662b69b5632f48a) C:\Windows\system32\DRIVERS\compbatt.sys
20:25:47.0940 3832        Compbatt - ok
20:25:47.0947 3832        COMSysApp - ok
20:25:47.0963 3832        crcdisk        (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
20:25:47.0983 3832        crcdisk - ok
20:25:48.0009 3832        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
20:25:48.0126 3832        Crusoe - ok
20:25:48.0202 3832        CryptSvc        (1c26fb097170a2a91066d1e3a24366e3) C:\Windows\system32\cryptsvc.dll
20:25:48.0307 3832        CryptSvc - ok
20:25:48.0426 3832        DcomLaunch      (7b981222a257d076885bffb66f19b7ce) C:\Windows\system32\rpcss.dll
20:25:48.0513 3832        DcomLaunch - ok
20:25:48.0540 3832        DfsC            (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys
20:25:48.0678 3832        DfsC - ok
20:25:48.0956 3832        DFSR            (e0d584aa76c7d845ba9f3a788260528f) C:\Windows\system32\DFSR.exe
20:25:49.0137 3832        DFSR - ok
20:25:49.0318 3832        Dhcp            (dc45739bc22d528d2b3e50d3f6761750) C:\Windows\System32\dhcpcsvc.dll
20:25:49.0395 3832        Dhcp - ok
20:25:49.0440 3832        disk            (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys
20:25:49.0460 3832        disk - ok
20:25:49.0508 3832        Dnscache        (eecba1dd142bf8693c476be8f32fe253) C:\Windows\System32\dnsrslvr.dll
20:25:49.0554 3832        Dnscache - ok
20:25:49.0602 3832        dot3svc        (1f795d214820e496bf1124434a6db546) C:\Windows\System32\dot3svc.dll
20:25:49.0729 3832        dot3svc - ok
20:25:49.0776 3832        DPS            (032c90ad677bf7b7a8013d6087c7a921) C:\Windows\system32\dps.dll
20:25:49.0837 3832        DPS - ok
20:25:49.0888 3832        drmkaud        (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys
20:25:50.0015 3832        drmkaud - ok
20:25:50.0102 3832        DXGKrnl        (b95202efd0464d226e7542c1e319c028) C:\Windows\System32\drivers\dxgkrnl.sys
20:25:50.0210 3832        DXGKrnl - ok
20:25:50.0245 3832        E1G60          (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
20:25:50.0374 3832        E1G60 - ok
20:25:50.0452 3832        EapHost        (90a0a875642e18618010645311b4e89e) C:\Windows\System32\eapsvc.dll
20:25:50.0569 3832        EapHost - ok
20:25:50.0651 3832        Ecache          (0efc7531b936ee57fdb4e837664c509f) C:\Windows\system32\drivers\ecache.sys
20:25:50.0673 3832        Ecache - ok
20:25:50.0848 3832        ehRecvr        (b4580122b0a7b263b6ee9acba69c8013) C:\Windows\ehome\ehRecvr.exe
20:25:50.0924 3832        ehRecvr - ok
20:25:50.0960 3832        ehSched        (ad1870c8e5d6dd340c829e6074bf3c3f) C:\Windows\ehome\ehsched.exe
20:25:51.0038 3832        ehSched - ok
20:25:51.0060 3832        ehstart        (c27c4ee8926e74aa72efcab24c5242c3) C:\Windows\ehome\ehstart.dll
20:25:51.0102 3832        ehstart - ok
20:25:51.0160 3832        elxstor        (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
20:25:51.0193 3832        elxstor - ok
20:25:51.0284 3832        EMDMgmt        (3226fda08988526e819e364e8cce4cee) C:\Windows\system32\emdmgmt.dll
20:25:51.0386 3832        EMDMgmt - ok
20:25:51.0522 3832        EventSystem    (7b4971c3d43525175a4ea0d143e0412e) C:\Windows\system32\es.dll
20:25:51.0594 3832        EventSystem - ok
20:25:51.0635 3832        fastfat        (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys
20:25:51.0786 3832        fastfat - ok
20:25:51.0817 3832        fdc            (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
20:25:51.0940 3832        fdc - ok
20:25:53.0049 3832        fdPHost        (e43bce1a77d6fd4ed5f8e0482b9e7df1) C:\Windows\system32\fdPHost.dll
20:25:53.0157 3832        fdPHost - ok
20:25:53.0176 3832        FDResPub        (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll
20:25:53.0314 3832        FDResPub - ok
20:25:53.0387 3832        FileInfo        (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys
20:25:53.0407 3832        FileInfo - ok
20:25:53.0431 3832        Filetrace      (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys
20:25:53.0545 3832        Filetrace - ok
20:25:53.0555 3832        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
20:25:53.0676 3832        flpydisk - ok
20:25:53.0784 3832        FltMgr          (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys
20:25:53.0851 3832        FltMgr - ok
20:25:53.0989 3832        FontCache3.0.0.0 (c9be08664611ddaf98e2331e9288b00b) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
20:25:54.0008 3832        FontCache3.0.0.0 - ok
20:25:54.0033 3832        Fs_Rec          (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys
20:25:54.0077 3832        Fs_Rec - ok
20:25:54.0111 3832        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
20:25:54.0132 3832        gagp30kx - ok
20:25:54.0211 3832        gpsvc          (bcf6589c42d8f6a20f33ef133ffe0524) C:\Windows\System32\gpsvc.dll
20:25:54.0363 3832        gpsvc - ok
20:25:54.0415 3832        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
20:25:54.0545 3832        HdAudAddService - ok
20:25:54.0578 3832        HDAudBus        (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys
20:25:54.0640 3832        HDAudBus - ok
20:25:54.0670 3832        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
20:25:54.0821 3832        HidBth - ok
20:25:54.0846 3832        HidIr          (f24393c44fdfe2e5e9f416fd3bdf98e2) C:\Windows\system32\DRIVERS\hidir.sys
20:25:54.0892 3832        HidIr - ok
20:25:54.0923 3832        hidserv        (8fa640195279ace21bea91396a0054fc) C:\Windows\system32\hidserv.dll
20:25:55.0044 3832        hidserv - ok
20:25:55.0074 3832        HidUsb          (3c64042b95e583b366ba4e5d2450235e) C:\Windows\system32\drivers\hidusb.sys
20:25:55.0189 3832        HidUsb - ok
20:25:55.0245 3832        hkmsvc          (d40aa05e29bf6ed29b139f044b461e9b) C:\Windows\system32\kmsvc.dll
20:25:55.0359 3832        hkmsvc - ok
20:25:55.0399 3832        HpCISSs        (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
20:25:55.0419 3832        HpCISSs - ok
20:25:55.0510 3832        HTTP            (ea24fe637d974a8a31bc650f478e3533) C:\Windows\system32\drivers\HTTP.sys
20:25:55.0656 3832        HTTP - ok
20:25:55.0700 3832        i2omp          (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
20:25:55.0721 3832        i2omp - ok
20:25:55.0768 3832        i8042prt        (1c9ee072baa3abb460b91d7ee9152660) C:\Windows\system32\DRIVERS\i8042prt.sys
20:25:55.0821 3832        i8042prt - ok
20:25:55.0881 3832        iaStor          (fd7f9d74c2b35dbda400804a3f5ed5d8) C:\Windows\system32\DRIVERS\iaStor.sys
20:25:55.0907 3832        iaStor - ok
20:25:55.0954 3832        iaStorV        (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
20:25:55.0986 3832        iaStorV - ok
20:25:56.0125 3832        idsvc          (7b630acaed64fef0c3e1cf255cb56686) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:25:56.0233 3832        idsvc - ok
20:25:56.0300 3832        iirsp          (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
20:25:56.0320 3832        iirsp - ok
20:25:56.0421 3832        IKEEXT          (4456e314e60177b03e5cbe64cd6a337e) C:\Windows\System32\ikeext.dll
20:25:56.0511 3832        IKEEXT - ok
20:25:56.0742 3832        IntcAzAudAddService (5d854cbac8b7b4b964406f9808c95fae) C:\Windows\system32\drivers\RTKVHDA.sys
20:25:56.0950 3832        IntcAzAudAddService - ok
20:25:57.0295 3832        intelide        (988981c840084f480ba9e3319cebde1b) C:\Windows\system32\drivers\intelide.sys
20:25:57.0316 3832        intelide - ok
20:25:57.0379 3832        intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
20:25:57.0501 3832        intelppm - ok
20:25:57.0630 3832        IPBusEnum      (88cf5281ed9880d74dc9011cf8b5262d) C:\Windows\system32\ipbusenum.dll
20:25:57.0742 3832        IPBusEnum - ok
20:25:57.0771 3832        IpFilterDriver  (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:25:57.0903 3832        IpFilterDriver - ok
20:25:57.0943 3832        iphlpsvc        (ecc9ad72cfc4ab41cf6a9bcc11f9fef6) C:\Windows\System32\iphlpsvc.dll
20:25:57.0979 3832        iphlpsvc - ok
20:25:57.0986 3832        IpInIp - ok
20:25:58.0030 3832        IPMIDRV        (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
20:25:58.0161 3832        IPMIDRV - ok
20:25:58.0186 3832        IPNAT          (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys
20:25:58.0318 3832        IPNAT - ok
20:25:58.0399 3832        IRENUM          (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys
20:25:58.0517 3832        IRENUM - ok
20:25:58.0536 3832        isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
20:25:58.0556 3832        isapnp - ok
20:25:58.0636 3832        iScsiPrt        (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys
20:25:58.0661 3832        iScsiPrt - ok
20:25:58.0692 3832        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
20:25:58.0715 3832        iteatapi - ok
20:25:58.0770 3832        itecir          (e4b04a0d8b237ecf026d849439f1bcce) C:\Windows\system32\DRIVERS\itecir.sys
20:25:58.0812 3832        itecir - ok
20:25:58.0832 3832        iteraid        (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
20:25:58.0851 3832        iteraid - ok
20:25:58.0863 3832        JRAID          (c1632fe31d1824a43dea29725312e3fa) C:\Windows\system32\drivers\jraid.sys
20:25:58.0909 3832        JRAID - ok
20:25:58.0938 3832        kbdclass        (b076b2ab806b3f696dab21375389101c) C:\Windows\system32\DRIVERS\kbdclass.sys
20:25:58.0959 3832        kbdclass - ok
20:25:59.0060 3832        kbdhid          (ed61dbc6603f612b7338283edbacbc4b) C:\Windows\system32\DRIVERS\kbdhid.sys
20:25:59.0085 3832        kbdhid - ok
20:25:59.0118 3832        KeyIso          (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
20:25:59.0181 3832        KeyIso - ok
20:25:59.0240 3832        KSecDD          (0a829977b078dea11641fc2af87ceade) C:\Windows\system32\Drivers\ksecdd.sys
20:25:59.0281 3832        KSecDD - ok
20:25:59.0350 3832        KtmRm          (45c537fe5dde9a0146aeff76e615737d) C:\Windows\system32\msdtckrm.dll
20:25:59.0471 3832        KtmRm - ok
20:25:59.0561 3832        LanmanServer    (53d1482fc1aa36ac015a85e6cf2146bd) C:\Windows\system32\srvsvc.dll
20:25:59.0671 3832        LanmanServer - ok
20:25:59.0796 3832        LanmanWorkstation (435f0f6dc87a4b5da78f1fa309884189) C:\Windows\System32\wkssvc.dll
20:25:59.0852 3832        LanmanWorkstation - ok
20:25:59.0920 3832        lltdio          (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys
20:26:00.0044 3832        lltdio - ok
20:26:00.0148 3832        lltdsvc        (7450dbcf754391dd6363fffd5ef0e789) C:\Windows\System32\lltdsvc.dll
20:26:00.0288 3832        lltdsvc - ok
20:26:00.0325 3832        lmhosts        (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll
20:26:00.0443 3832        lmhosts - ok
20:26:00.0501 3832        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
20:26:00.0523 3832        LSI_FC - ok
20:26:00.0544 3832        LSI_SAS        (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
20:26:00.0567 3832        LSI_SAS - ok
20:26:00.0591 3832        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
20:26:00.0613 3832        LSI_SCSI - ok
20:26:00.0653 3832        luafv          (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys
20:26:00.0778 3832        luafv - ok
20:26:00.0838 3832        MBAMProtector  (6dfe7f2e8e8a337263aa5c92a215f161) C:\Windows\system32\drivers\mbam.sys
20:26:00.0859 3832        MBAMProtector - ok
20:26:01.0053 3832        MBAMService    (43683e970f008c93c9429ef428147a54) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
20:26:01.0100 3832        MBAMService - ok
20:26:01.0134 3832        Mcx2Svc        (bf8426a8e3f3856389e26e94a8f1b588) C:\Windows\system32\Mcx2Svc.dll
20:26:01.0179 3832        Mcx2Svc - ok
20:26:01.0230 3832        megasas        (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
20:26:01.0251 3832        megasas - ok
20:26:01.0398 3832        Microsoft Office Groove Audit Service (fafe367d032ed82e9332b4c741a20216) C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
20:26:01.0419 3832        Microsoft Office Groove Audit Service - ok
20:26:01.0470 3832        MMCSS          (9dfa3a459af0954aa85b4f7622ad87bb) C:\Windows\system32\mmcss.dll
20:26:01.0583 3832        MMCSS - ok
20:26:01.0625 3832        Modem          (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys
20:26:01.0727 3832        Modem - ok
20:26:01.0764 3832        monitor        (7446e104a5fe5987ca9e4983fbac4f97) C:\Windows\system32\DRIVERS\monitor.sys
20:26:01.0820 3832        monitor - ok
20:26:01.0832 3832        mouclass        (5fba13c1a1841b0885d316ed3589489d) C:\Windows\system32\DRIVERS\mouclass.sys
20:26:01.0856 3832        mouclass - ok
20:26:01.0875 3832        mouhid          (b569b5c5d3bde545df3a6af512cccdba) C:\Windows\system32\DRIVERS\mouhid.sys
20:26:01.0908 3832        mouhid - ok
20:26:01.0942 3832        MountMgr        (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys
20:26:01.0962 3832        MountMgr - ok
20:26:02.0048 3832        MozillaMaintenance (46297fa8e30a6007f14118fc2b942fbc) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
20:26:02.0083 3832        MozillaMaintenance - ok
20:26:02.0113 3832        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
20:26:02.0135 3832        mpio - ok
20:26:02.0160 3832        mpsdrv          (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys
20:26:02.0206 3832        mpsdrv - ok
20:26:02.0278 3832        MpsSvc          (563ed845885c6a7c09a7715d8bd0585c) C:\Windows\system32\mpssvc.dll
20:26:02.0338 3832        MpsSvc - ok
20:26:02.0378 3832        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
20:26:02.0399 3832        Mraid35x - ok
20:26:02.0441 3832        MRxDAV          (1d8828b98ee309d65e006f0829e280e5) C:\Windows\system32\drivers\mrxdav.sys
20:26:02.0497 3832        MRxDAV - ok
20:26:02.0543 3832        mrxsmb          (8af705ce1bb907932157fab821170f27) C:\Windows\system32\DRIVERS\mrxsmb.sys
20:26:02.0629 3832        mrxsmb - ok
20:26:02.0672 3832        mrxsmb10        (47e13ab23371be3279eef22bbfa2c1be) C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:26:02.0745 3832        mrxsmb10 - ok
20:26:02.0779 3832        mrxsmb20        (90b3fc7bd6b3d7ee7635debba2187f66) C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:26:02.0841 3832        mrxsmb20 - ok
20:26:02.0887 3832        msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
20:26:02.0906 3832        msahci - ok
20:26:02.0938 3832        msdsm          (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
20:26:02.0960 3832        msdsm - ok
20:26:03.0006 3832        MSDTC          (bc64a92d821efea8bab8e8caf1b668bc) C:\Windows\System32\msdtc.exe
20:26:03.0048 3832        MSDTC - ok
20:26:03.0075 3832        Msfs            (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys
20:26:03.0195 3832        Msfs - ok
20:26:03.0221 3832        msisadrv        (5f454a16a5146cd91a176d70f0cfa3ec) C:\Windows\system32\drivers\msisadrv.sys
20:26:03.0240 3832        msisadrv - ok
20:26:03.0286 3832        MSiSCSI        (8acf956d9154e893e789881430c12632) C:\Windows\system32\iscsiexe.dll
20:26:03.0401 3832        MSiSCSI - ok
20:26:03.0409 3832        msiserver - ok
20:26:03.0512 3832        MSKSSRV        (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys
20:26:03.0625 3832        MSKSSRV - ok
20:26:03.0657 3832        MSPCLOCK        (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys
20:26:03.0783 3832        MSPCLOCK - ok
20:26:03.0806 3832        MSPQM          (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys
20:26:03.0923 3832        MSPQM - ok
20:26:03.0963 3832        MsRPC          (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys
20:26:03.0989 3832        MsRPC - ok
20:26:04.0014 3832        mssmbios        (4385c80ede885e25492d408cad91bd6f) C:\Windows\system32\DRIVERS\mssmbios.sys
20:26:04.0037 3832        mssmbios - ok
20:26:04.0053 3832        MSTEE          (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys
20:26:04.0162 3832        MSTEE - ok
20:26:04.0180 3832        Mup            (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys
20:26:04.0200 3832        Mup - ok
20:26:04.0334 3832        napagent        (1cdbb5d002fe2bc5300aa20550d8a52e) C:\Windows\system32\qagentRT.dll
20:26:04.0446 3832        napagent - ok
20:26:04.0508 3832        NativeWifiP    (6da4a0fc7c0e83df0cb3cfd0a514c3bc) C:\Windows\system32\DRIVERS\nwifi.sys
20:26:04.0574 3832        NativeWifiP - ok
20:26:04.0666 3832        NDIS            (227c11e1e7cf6ef8afb2a238d209760c) C:\Windows\system32\drivers\ndis.sys
20:26:04.0747 3832        NDIS - ok
20:26:04.0810 3832        NdisTapi        (81659cdcbd0f9a9e07e6878ad8c78d3f) C:\Windows\system32\DRIVERS\ndistapi.sys
20:26:04.0872 3832        NdisTapi - ok
20:26:04.0890 3832        Ndisuio        (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys
20:26:04.0992 3832        Ndisuio - ok
20:26:05.0022 3832        NdisWan        (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys
20:26:05.0128 3832        NdisWan - ok
20:26:05.0163 3832        NDProxy        (1b24fa907af283199a81b3bb37e5e526) C:\Windows\system32\drivers\NDProxy.sys
20:26:05.0263 3832        NDProxy - ok
20:26:05.0296 3832        NetBIOS        (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys
20:26:05.0401 3832        NetBIOS - ok
20:26:05.0471 3832        netbt          (e3a168912e7eefc3bd3b814720d68b41) C:\Windows\system32\DRIVERS\netbt.sys
20:26:05.0590 3832        netbt - ok
20:26:05.0705 3832        Netlogon        (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
20:26:05.0736 3832        Netlogon - ok
20:26:05.0839 3832        Netman          (90a4dae28b94497f83bea0f2a3b77092) C:\Windows\System32\netman.dll
20:26:05.0964 3832        Netman - ok
20:26:06.0001 3832        netprofm        (7c5c3d9ceee838856b828ab6f98a2857) C:\Windows\System32\netprofm.dll
20:26:06.0130 3832        netprofm - ok
20:26:06.0354 3832        NetTcpPortSharing (0ad5876ef4e9eb77c8f93eb5b2fff386) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:26:06.0376 3832        NetTcpPortSharing - ok
20:26:06.0666 3832        NETw4v32        (1d73499a6664b4da05d750ff83fdb274) C:\Windows\system32\DRIVERS\NETw4v32.sys
20:26:06.0859 3832        NETw4v32 - ok
20:26:07.0111 3832        nfrd960        (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
20:26:07.0133 3832        nfrd960 - ok
20:26:07.0173 3832        NlaSvc          (c424117a562f2de37a42266894c79aeb) C:\Windows\System32\nlasvc.dll
20:26:07.0284 3832        NlaSvc - ok
20:26:07.0424 3832        NMIndexingService (7b273501c59d52978b761f82bebadb06) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
20:26:07.0461 3832        NMIndexingService - ok
20:26:07.0481 3832        Npfs            (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys
20:26:07.0596 3832        Npfs - ok
20:26:07.0646 3832        nsi            (23b8201a363de0e649fc75ee9874dee2) C:\Windows\system32\nsisvc.dll
20:26:07.0752 3832        nsi - ok
20:26:07.0846 3832        nsiproxy        (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys
20:26:07.0976 3832        nsiproxy - ok
20:26:08.0138 3832        Ntfs            (37430aa7a66d7a63407adc2c0d05e9f6) C:\Windows\system32\drivers\Ntfs.sys
20:26:08.0230 3832        Ntfs - ok
20:26:08.0290 3832        ntrigdigi      (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
20:26:08.0422 3832        ntrigdigi - ok
20:26:08.0444 3832        Null            (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys
20:26:08.0562 3832        Null - ok
20:26:09.0534 3832        nvlddmkm        (fe6bebb8fc2a1e50426624025d7c30d6) C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:26:10.0101 3832        nvlddmkm - ok
20:26:10.0507 3832        nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
20:26:10.0530 3832        nvraid - ok
20:26:10.0598 3832        nvrd32          (ed399014a8029de02ba5ae01da8cc9ee) C:\Windows\system32\drivers\nvrd32.sys
20:26:10.0652 3832        nvrd32 - ok
20:26:10.0680 3832        nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
20:26:10.0700 3832        nvstor - ok
20:26:10.0730 3832        nvstor32        (703e3a7093b0fac0eebadbb8e931ecaf) C:\Windows\system32\drivers\nvstor32.sys
20:26:10.0759 3832        nvstor32 - ok
20:26:10.0810 3832        nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
20:26:10.0834 3832        nv_agp - ok
20:26:10.0842 3832        NwlnkFlt - ok
20:26:10.0855 3832        NwlnkFwd - ok
20:26:11.0007 3832        odserv          (84de1dd996b48b05ace31ad015fa108a) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:26:11.0100 3832        odserv - ok
20:26:11.0242 3832        ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\DRIVERS\ohci1394.sys
20:26:11.0376 3832        ohci1394 - ok
20:26:11.0441 3832        ose            (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:26:11.0465 3832        ose - ok
20:26:11.0561 3832        p2pimsvc        (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
20:26:11.0657 3832        p2pimsvc - ok
20:26:11.0675 3832        p2psvc          (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
20:26:11.0725 3832        p2psvc - ok
20:26:11.0760 3832        Parport        (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
20:26:11.0871 3832        Parport - ok
20:26:11.0978 3832        partmgr        (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys
20:26:11.0998 3832        partmgr - ok
20:26:12.0007 3832        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
20:26:12.0141 3832        Parvdm - ok
20:26:12.0168 3832        PcaSvc          (d8c5c215c932233a4f1d7f368f4e4e65) C:\Windows\System32\pcasvc.dll
20:26:12.0220 3832        PcaSvc - ok
20:26:12.0256 3832        pci            (1085d75657807e0e8b32f9e19a1647c3) C:\Windows\system32\drivers\pci.sys
20:26:12.0280 3832        pci - ok
20:26:12.0291 3832        pciide          (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys
20:26:12.0320 3832        pciide - ok
20:26:12.0369 3832        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
20:26:12.0403 3832        pcmcia - ok
20:26:12.0520 3832        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
20:26:12.0696 3832        PEAUTH - ok
20:26:13.0083 3832        pla            (cd05a38d166beade18030bafc0c0a939) C:\Windows\system32\pla.dll
20:26:13.0294 3832        pla - ok
20:26:13.0537 3832        PlugPlay        (747bb4c31f3b6e8d1b5ed0ad61518cb5) C:\Windows\system32\umpnpmgr.dll
20:26:13.0589 3832        PlugPlay - ok
20:26:13.0672 3832        PNRPAutoReg    (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
20:26:13.0726 3832        PNRPAutoReg - ok
20:26:13.0745 3832        PNRPsvc        (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
20:26:13.0811 3832        PNRPsvc - ok
20:26:13.0882 3832        PolicyAgent    (5ebdec613bd377ce9a85382be5c6b83b) C:\Windows\System32\ipsecsvc.dll
20:26:13.0952 3832        PolicyAgent - ok
20:26:14.0087 3832        PptpMiniport    (c04dec5ace67c5247b150c4223970bb7) C:\Windows\system32\DRIVERS\raspptp.sys
20:26:14.0132 3832        PptpMiniport - ok
20:26:14.0152 3832        Processor      (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
20:26:14.0254 3832        Processor - ok
20:26:14.0406 3832        ProfSvc        (213112e152e68f0e4705e36f052a2880) C:\Windows\system32\profsvc.dll
20:26:14.0524 3832        ProfSvc - ok
20:26:14.0640 3832        ProtectedStorage (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
20:26:14.0668 3832        ProtectedStorage - ok
20:26:14.0702 3832        PSched          (2c8bae55247c4e09352e870292e4d1ab) C:\Windows\system32\DRIVERS\pacer.sys
20:26:14.0748 3832        PSched - ok
20:26:14.0930 3832        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
20:26:15.0078 3832        ql2300 - ok
20:26:15.0159 3832        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
20:26:15.0195 3832        ql40xx - ok
20:26:15.0241 3832        QWAVE          (ca61bdfd3713a7ce75f2812afc431594) C:\Windows\system32\qwave.dll
20:26:15.0300 3832        QWAVE - ok
20:26:15.0329 3832        QWAVEdrv        (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys
20:26:15.0371 3832        QWAVEdrv - ok
20:26:15.0406 3832        RasAcd          (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys
20:26:15.0510 3832        RasAcd - ok
20:26:15.0568 3832        RasAuto        (f14f4aab9f54d099fe99192bdb100ac9) C:\Windows\System32\rasauto.dll
20:26:15.0685 3832        RasAuto - ok
20:26:15.0810 3832        Rasl2tp        (68b0019fee429ec49d29017af937e482) C:\Windows\system32\DRIVERS\rasl2tp.sys
20:26:15.0841 3832        Rasl2tp - ok
20:26:15.0894 3832        RasMan          (11d65e29bc9d1e4114d18fe68194394c) C:\Windows\System32\rasmans.dll
20:26:16.0019 3832        RasMan - ok
20:26:16.0110 3832        RasPppoe        (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys
20:26:16.0214 3832        RasPppoe - ok
20:26:16.0386 3832        rdbss          (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys
20:26:16.0536 3832        rdbss - ok
20:26:16.0562 3832        RDPCDD          (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys
20:26:16.0668 3832        RDPCDD - ok
20:26:16.0717 3832        rdpdr          (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
20:26:16.0839 3832        rdpdr - ok
20:26:16.0863 3832        RDPENCDD        (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys
20:26:16.0969 3832        RDPENCDD - ok
20:26:17.0012 3832        RDPWD          (e2afac98fc6ca2ad2d09f2de1bc71ad9) C:\Windows\system32\drivers\RDPWD.sys
20:26:17.0088 3832        RDPWD - ok
20:26:17.0138 3832        RemoteAccess    (6c1a43c589ee8011a1ebfd51c01b77ce) C:\Windows\System32\mprdim.dll
20:26:17.0243 3832        RemoteAccess - ok
20:26:17.0306 3832        RemoteRegistry  (9a043808667c8c1893da7275af373f0e) C:\Windows\system32\regsvc.dll
20:26:17.0450 3832        RemoteRegistry - ok
20:26:17.0490 3832        RFCOMM          (7ec90c316177ba3f1bce92005264b447) C:\Windows\system32\DRIVERS\rfcomm.sys
20:26:17.0595 3832        RFCOMM - ok
20:26:17.0710 3832        RichVideo      (c1c132455200ad4704142442c89d0fa4) C:\Program Files\CyberLink\Shared Files\RichVideo.exe
20:26:17.0734 3832        RichVideo ( UnsignedFile.Multi.Generic ) - warning
20:26:17.0734 3832        RichVideo - detected UnsignedFile.Multi.Generic (1)
20:26:17.0771 3832        RpcLocator      (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe
20:26:17.0840 3832        RpcLocator - ok
20:26:17.0933 3832        RpcSs          (7b981222a257d076885bffb66f19b7ce) C:\Windows\system32\rpcss.dll
20:26:17.0982 3832        RpcSs - ok
20:26:18.0024 3832        rspndr          (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys
20:26:18.0138 3832        rspndr - ok
20:26:18.0183 3832        RTL8169        (b8b159fa669c6386a458fcd468ebb1e6) C:\Windows\system32\DRIVERS\Rtlh86.sys
20:26:18.0254 3832        RTL8169 - ok
20:26:18.0289 3832        SamSs          (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
20:26:18.0319 3832        SamSs - ok
20:26:18.0363 3832        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
20:26:18.0386 3832        sbp2port - ok
20:26:18.0450 3832        SCardSvr        (565b4b9e5ad2f2f18a4f8aafa6c06bbb) C:\Windows\System32\SCardSvr.dll
20:26:18.0581 3832        SCardSvr - ok
20:26:18.0691 3832        Schedule        (886cec884b5be29ab9828b8ab46b11f7) C:\Windows\system32\schedsvc.dll
20:26:18.0758 3832        Schedule - ok
20:26:18.0829 3832        SCPolicySvc    (0600e04315fe543802a379d5d23c8be0) C:\Windows\System32\certprop.dll
20:26:18.0934 3832        SCPolicySvc - ok
20:26:18.0974 3832        SDRSVC          (f7b6bf02240d0a764adf8c8966735552) C:\Windows\System32\SDRSVC.dll
20:26:19.0022 3832        SDRSVC - ok
20:26:19.0041 3832        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
20:26:19.0160 3832        secdrv - ok
20:26:19.0198 3832        seclogon        (8388c4133ddbe62ad7bc3ec9f14271ed) C:\Windows\system32\seclogon.dll
20:26:19.0305 3832        seclogon - ok
20:26:19.0331 3832        SENS            (34350ae2c1d33d21c7305f861bd8dad8) C:\Windows\System32\sens.dll
20:26:19.0466 3832        SENS - ok
20:26:19.0600 3832        Serenum        (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
20:26:19.0719 3832        Serenum - ok
20:26:19.0739 3832        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
20:26:19.0856 3832        Serial - ok
20:26:19.0888 3832        sermouse        (450accd77ec5cea720c1cdb9e26b953b) C:\Windows\system32\drivers\sermouse.sys
20:26:19.0926 3832        sermouse - ok
20:26:19.0991 3832        SessionEnv      (78878235da4df0d116e86837a0a21df8) C:\Windows\system32\sessenv.dll
20:26:20.0113 3832        SessionEnv - ok
20:26:20.0130 3832        sffdisk        (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
20:26:20.0249 3832        sffdisk - ok
20:26:20.0272 3832        sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
20:26:20.0401 3832        sffp_mmc - ok
20:26:20.0427 3832        sffp_sd        (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
20:26:20.0532 3832        sffp_sd - ok
20:26:20.0542 3832        sfloppy        (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
20:26:20.0649 3832        sfloppy - ok
20:26:20.0760 3832        SharedAccess    (9a82bf4c90b00a63150a606a1e2fd82b) C:\Windows\System32\ipnathlp.dll
20:26:20.0801 3832        SharedAccess - ok
20:26:20.0843 3832        ShellHWDetection (b264dfa21677728613267fe63802b332) C:\Windows\System32\shsvcs.dll
20:26:20.0894 3832        ShellHWDetection - ok
20:26:20.0955 3832        Si3531          (8613e8fe6c190f377240a3989fad5d5e) C:\Windows\system32\DRIVERS\Si3531.sys
20:26:21.0017 3832        Si3531 - ok
20:26:21.0045 3832        SiFilter        (72cf151fb410e544904dbc7d7f29b796) C:\Windows\system32\DRIVERS\SiWinAcc.sys
20:26:21.0088 3832        SiFilter - ok
20:26:21.0098 3832        SiRemFil        (41a59f484188be629087ba391ff60d74) C:\Windows\system32\DRIVERS\SiRemFil.sys
20:26:21.0140 3832        SiRemFil - ok
20:26:21.0179 3832        sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
20:26:21.0199 3832        sisagp - ok
20:26:21.0225 3832        SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
20:26:21.0245 3832        SiSRaid2 - ok
20:26:21.0272 3832        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
20:26:21.0296 3832        SiSRaid4 - ok
20:26:21.0406 3832        SkypeUpdate    (f07af60b152221472fbdb2fecec4896d) C:\Program Files\Skype\Updater\Updater.exe
20:26:21.0432 3832        SkypeUpdate - ok
20:26:21.0776 3832        slsvc          (a1dcd30534835cb67733ad00175125a6) C:\Windows\system32\SLsvc.exe
20:26:21.0966 3832        slsvc - ok
20:26:22.0143 3832        SLUINotify      (56da296e7b376a727e7bdc5ac7fbee02) C:\Windows\system32\SLUINotify.dll
20:26:22.0186 3832        SLUINotify - ok
20:26:22.0239 3832        Smb            (ac0d90738adb51a6fd12ff00874a2162) C:\Windows\system32\DRIVERS\smb.sys
20:26:22.0359 3832        Smb - ok
20:26:22.0510 3832        smserial        (d9bfd2298f5cf116d8eaae3b02dcee2e) C:\Windows\system32\DRIVERS\smserial.sys
20:26:22.0642 3832        smserial - ok
20:26:22.0739 3832        SNMPTRAP        (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe
20:26:22.0771 3832        SNMPTRAP - ok
20:26:22.0802 3832        spldr          (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys
20:26:22.0821 3832        spldr - ok
20:26:22.0866 3832        Spooler        (da612ef2556776df2630b68bf2d48935) C:\Windows\System32\spoolsv.exe
20:26:22.0899 3832        Spooler - ok
20:26:22.0949 3832        srv            (038579c35f7cad4a4bbf735dbf83277d) C:\Windows\system32\DRIVERS\srv.sys
20:26:23.0035 3832        srv - ok
20:26:23.0074 3832        srv2            (6971a757af8cb5e2cbcbb76cc530db6c) C:\Windows\system32\DRIVERS\srv2.sys
20:26:23.0119 3832        srv2 - ok
20:26:23.0152 3832        srvnet          (9e1a4603b874eebce0298113951abefb) C:\Windows\system32\DRIVERS\srvnet.sys
20:26:23.0184 3832        srvnet - ok
20:26:23.0216 3832        SSDPSRV        (8d3e4baff8b3997138c38eb1b600519a) C:\Windows\System32\ssdpsrv.dll
20:26:23.0334 3832        SSDPSRV - ok
20:26:23.0371 3832        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
20:26:23.0387 3832        ssmdrv - ok
20:26:23.0442 3832        stisvc          (a941e099ef46e3cc12f898cbe1c39910) C:\Windows\System32\wiaservc.dll
20:26:23.0495 3832        stisvc - ok
20:26:23.0573 3832        swenum          (1379bdb336f8158c176a465e30759f57) C:\Windows\system32\DRIVERS\swenum.sys
20:26:23.0592 3832        swenum - ok
20:26:23.0640 3832        swprv          (749ada8d6c18a08adfede69cbf5db2e0) C:\Windows\System32\swprv.dll
20:26:23.0758 3832        swprv - ok
20:26:23.0788 3832        Symc8xx        (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
20:26:23.0807 3832        Symc8xx - ok
20:26:23.0839 3832        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
20:26:23.0859 3832        Sym_hi - ok
20:26:23.0888 3832        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
20:26:23.0908 3832        Sym_u3 - ok
20:26:23.0998 3832        SysMain        (8f2b5fede18bd3c4c926cbf88e6f1264) C:\Windows\system32\sysmain.dll
20:26:24.0090 3832        SysMain - ok
20:26:24.0125 3832        TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll
20:26:24.0184 3832        TabletInputService - ok
20:26:24.0223 3832        TapiSrv        (ef3dd33c740fc2f82e7e4622f1c49289) C:\Windows\System32\tapisrv.dll
20:26:24.0337 3832        TapiSrv - ok
20:26:24.0362 3832        TBS            (68fa52794ae9acc61bde16fe0956b414) C:\Windows\System32\tbssvc.dll
20:26:24.0496 3832        TBS - ok
20:26:24.0615 3832        Tcpip          (2c1f7005aa3b62721bfdb307bd5f5010) C:\Windows\system32\drivers\tcpip.sys
20:26:24.0717 3832        Tcpip - ok
20:26:24.0745 3832        Tcpip6          (2c1f7005aa3b62721bfdb307bd5f5010) C:\Windows\system32\DRIVERS\tcpip.sys
20:26:24.0801 3832        Tcpip6 - ok
20:26:24.0834 3832        tcpipreg        (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys
20:26:24.0955 3832        tcpipreg - ok
20:26:24.0974 3832        TDPIPE          (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys
20:26:25.0095 3832        TDPIPE - ok
20:26:25.0119 3832        TDTCP          (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys
20:26:25.0235 3832        TDTCP - ok
20:26:25.0265 3832        tdx            (ab4fde8af4a0270a46a001c08cbce1c2) C:\Windows\system32\DRIVERS\tdx.sys
20:26:25.0379 3832        tdx - ok
20:26:25.0404 3832        TermDD          (2c549bd9dd091fbfaa0a2a48e82ec2fb) C:\Windows\system32\DRIVERS\termdd.sys
20:26:25.0425 3832        TermDD - ok
20:26:25.0489 3832        TermService    (fad71c1e8e4047b154e899ae31eb8caa) C:\Windows\System32\termsrv.dll
20:26:25.0638 3832        TermService - ok
20:26:25.0725 3832        TestHandler    (8c80a73a5d77b2208ca91e4fa269981d) C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
20:26:25.0738 3832        TestHandler ( UnsignedFile.Multi.Generic ) - warning
20:26:25.0738 3832        TestHandler - detected UnsignedFile.Multi.Generic (1)
20:26:25.0792 3832        Themes          (b264dfa21677728613267fe63802b332) C:\Windows\system32\shsvcs.dll
20:26:25.0830 3832        Themes - ok
20:26:25.0859 3832        THREADORDER    (9dfa3a459af0954aa85b4f7622ad87bb) C:\Windows\system32\mmcss.dll
20:26:25.0966 3832        THREADORDER - ok
20:26:25.0991 3832        TrkWks          (6bba0582c0025d43729a1112d3b57897) C:\Windows\System32\trkwks.dll
20:26:26.0111 3832        TrkWks - ok
20:26:26.0177 3832        TrustedInstaller (34e388a395fedba1d0511ed39bbf4074) C:\Windows\servicing\TrustedInstaller.exe
20:26:26.0202 3832        TrustedInstaller - ok
20:26:26.0229 3832        tssecsrv        (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys
20:26:26.0347 3832        tssecsrv - ok
20:26:26.0404 3832        tunmp          (65e953bc0084d44498b51f59784d2a82) C:\Windows\system32\DRIVERS\tunmp.sys
20:26:26.0432 3832        tunmp - ok
20:26:26.0449 3832        tunnel          (4a39bda5e0fd30bdf4884f9d33ae6105) C:\Windows\system32\DRIVERS\tunnel.sys
20:26:26.0493 3832        tunnel - ok
20:26:26.0523 3832        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
20:26:26.0544 3832        uagp35 - ok
20:26:26.0583 3832        udfs            (6348da98707ceda8a0dfb05820e17732) C:\Windows\system32\DRIVERS\udfs.sys
20:26:26.0703 3832        udfs - ok
20:26:26.0751 3832        UI0Detect      (24a333f4f14dcfb6ff6d5a1b9e5d79dd) C:\Windows\system32\UI0Detect.exe
20:26:26.0783 3832        UI0Detect - ok
20:26:26.0808 3832        uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
20:26:26.0829 3832        uliagpkx - ok
20:26:26.0859 3832        uliahci        (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
20:26:26.0888 3832        uliahci - ok
20:26:26.0925 3832        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
20:26:26.0960 3832        UlSata - ok
20:26:26.0994 3832        ulsata2        (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
20:26:27.0028 3832        ulsata2 - ok
20:26:27.0055 3832        umbus          (3fb78f1d1dd86d87bececd9dffa24dd9) C:\Windows\system32\DRIVERS\umbus.sys
20:26:27.0168 3832        umbus - ok
20:26:27.0218 3832        upnphost        (8eb871a3deb6b3d5a85eb6ddfc390b59) C:\Windows\System32\upnphost.dll
20:26:27.0344 3832        upnphost - ok
20:26:27.0369 3832        usbccgp        (8bd3ae150d97ba4e633c6c5c51b41ae1) C:\Windows\system32\drivers\usbccgp.sys
20:26:27.0484 3832        usbccgp - ok
20:26:27.0516 3832        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
20:26:27.0636 3832        usbcir - ok
20:26:27.0666 3832        usbehci        (2f83363f98484f8edaf49f9b41520d14) C:\Windows\system32\DRIVERS\usbehci.sys
20:26:27.0722 3832        usbehci - ok
20:26:27.0760 3832        usbhub          (14d2a4dcd92c0b3368667aed6893463d) C:\Windows\system32\DRIVERS\usbhub.sys
20:26:27.0795 3832        usbhub - ok
20:26:27.0816 3832        usbohci        (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
20:26:27.0918 3832        usbohci - ok
20:26:27.0939 3832        usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\DRIVERS\usbprint.sys
20:26:28.0042 3832        usbprint - ok
20:26:28.0081 3832        USBSTOR        (7887ce56934e7f104e98c975f47353c5) C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:26:28.0132 3832        USBSTOR - ok
20:26:28.0158 3832        usbuhci        (7747b902f6b7d0096f9c2bf55d3247f1) C:\Windows\system32\DRIVERS\usbuhci.sys
20:26:28.0184 3832        usbuhci - ok
20:26:28.0222 3832        UxSms          (f79d0d7c9004474cb42746d9b2c30a2b) C:\Windows\System32\uxsms.dll
20:26:28.0329 3832        UxSms - ok
20:26:28.0469 3832        vds            (c9d0bafee0d0a2681f048ca61bc0da96) C:\Windows\System32\vds.exe
20:26:28.0566 3832        vds - ok
20:26:28.0594 3832        vga            (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
20:26:28.0697 3832        vga - ok
20:26:28.0718 3832        VgaSave        (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys
20:26:28.0821 3832        VgaSave - ok
20:26:28.0835 3832        viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
20:26:28.0857 3832        viaagp - ok
20:26:28.0870 3832        ViaC7          (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
20:26:28.0989 3832        ViaC7 - ok
20:26:29.0024 3832        viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
20:26:29.0044 3832        viaide - ok
20:26:29.0069 3832        viamraid        (7dc3e1dc6e4f8be381c31bfea578412a) C:\Windows\system32\drivers\viamraid.sys
20:26:29.0119 3832        viamraid - ok
20:26:29.0151 3832        volmgr          (103e84c95832d0ed93507997cc7b54e8) C:\Windows\system32\drivers\volmgr.sys
20:26:29.0171 3832        volmgr - ok
20:26:29.0213 3832        volmgrx        (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys
20:26:29.0244 3832        volmgrx - ok
20:26:29.0282 3832        volsnap        (80dc0c9bcb579ed9815001a4d37cbfd5) C:\Windows\system32\drivers\volsnap.sys
20:26:29.0309 3832        volsnap - ok
20:26:29.0340 3832        vsmraid        (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
20:26:29.0362 3832        vsmraid - ok
20:26:29.0491 3832        VSS            (e0e29d9ef2524abd11749c7c2fd7f607) C:\Windows\system32\vssvc.exe
20:26:29.0602 3832        VSS - ok
20:26:29.0647 3832        W32Time        (62b0d0f6f5580d9d0dfa5e0b466ff2ed) C:\Windows\system32\w32time.dll
20:26:29.0781 3832        W32Time - ok
20:26:29.0813 3832        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
20:26:29.0926 3832        WacomPen - ok
20:26:29.0954 3832        Wanarp          (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
20:26:29.0980 3832        Wanarp - ok
20:26:29.0987 3832        Wanarpv6        (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
20:26:30.0014 3832        Wanarpv6 - ok
20:26:30.0050 3832        wcncsvc        (c1b19162e0509ceab4cdf664e139d956) C:\Windows\System32\wcncsvc.dll
20:26:30.0107 3832        wcncsvc - ok
20:26:30.0130 3832        WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll
20:26:30.0238 3832        WcsPlugInService - ok
20:26:30.0261 3832        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
20:26:30.0282 3832        Wd - ok
20:26:30.0357 3832        Wdf01000        (7b5f66e4a2219c7d9daf9e738480e534) C:\Windows\system32\drivers\Wdf01000.sys
20:26:30.0401 3832        Wdf01000 - ok
20:26:30.0437 3832        WdiServiceHost  (2a424b89b14ef17a3d06bcb5a8f79601) C:\Windows\system32\wdi.dll
20:26:30.0490 3832        WdiServiceHost - ok
20:26:30.0498 3832        WdiSystemHost  (2a424b89b14ef17a3d06bcb5a8f79601) C:\Windows\system32\wdi.dll
20:26:30.0537 3832        WdiSystemHost - ok
20:26:30.0587 3832        WebClient      (01e41c264eedcb827820a1909162579f) C:\Windows\System32\webclnt.dll
20:26:30.0636 3832        WebClient - ok
20:26:30.0659 3832        Wecsvc          (9cf67ff7f8d34cbf115d0c278b9f74aa) C:\Windows\system32\wecsvc.dll
20:26:30.0770 3832        Wecsvc - ok
20:26:30.0793 3832        wercplsupport  (b68cab45db1dab59d92acadfad6364a8) C:\Windows\System32\wercplsupport.dll
20:26:30.0909 3832        wercplsupport - ok
20:26:30.0946 3832        WerSvc          (36ba0707680ef4236fd752bee982cc25) C:\Windows\System32\WerSvc.dll
20:26:31.0055 3832        WerSvc - ok
20:26:31.0164 3832        WinDefend      (0d5ad0e71ff5ddac5dd2f443b499abd0) C:\Program Files\Windows Defender\mpsvc.dll
20:26:31.0194 3832        WinDefend - ok
20:26:31.0208 3832        WinHttpAutoProxySvc - ok
20:26:31.0273 3832        Winmgmt        (38a7b89de4e3417c122317949667fdd8) C:\Windows\system32\wbem\WMIsvc.dll
20:26:31.0380 3832        Winmgmt - ok
20:26:31.0450 3832        WinRM          (3f6823040030c3e4da1cf11cd40b7534) C:\Windows\system32\WsmSvc.dll
20:26:31.0601 3832        WinRM - ok
20:26:31.0693 3832        Wlansvc        (7640acea41348bfef34b76e245501261) C:\Windows\System32\wlansvc.dll
20:26:31.0753 3832        Wlansvc - ok
20:26:31.0809 3832        WmiAcpi        (17eac0d023a65fa9b02114cc2baacad5) C:\Windows\system32\DRIVERS\wmiacpi.sys
20:26:31.0846 3832        WmiAcpi - ok
20:26:31.0875 3832        wmiApSrv        (a279323bee5fffafda222910bce92132) C:\Windows\system32\wbem\WmiApSrv.exe
20:26:31.0905 3832        wmiApSrv - ok
20:26:32.0081 3832        WMPNetworkSvc  (acb2e63d50157e3ea7140f29d9e76a48) C:\Program Files\Windows Media Player\wmpnetwk.exe
20:26:32.0188 3832        WMPNetworkSvc - ok
20:26:32.0238 3832        WPCSvc          (3d3b3b80c12abe506f56930c46422c28) C:\Windows\System32\wpcsvc.dll
20:26:32.0308 3832        WPCSvc - ok
20:26:32.0340 3832        WPDBusEnum      (c24844a1d0d9528b19d5bc266b8cd572) C:\Windows\system32\wpdbusenum.dll
20:26:32.0384 3832        WPDBusEnum - ok
20:26:32.0419 3832        ws2ifsl        (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys
20:26:32.0520 3832        ws2ifsl - ok
20:26:32.0552 3832        wscsvc          (f97cbb919af6d0a6643d1a59c15014d1) C:\Windows\System32\wscsvc.dll
20:26:32.0603 3832        wscsvc - ok
20:26:32.0611 3832        WSearch - ok
20:26:32.0841 3832        wuauserv        (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll
20:26:33.0000 3832        wuauserv - ok
20:26:33.0151 3832        WUDFRd          (a2aafcc8a204736296d937c7c545b53f) C:\Windows\system32\DRIVERS\WUDFRd.sys
20:26:33.0269 3832        WUDFRd - ok
20:26:33.0309 3832        wudfsvc        (db5bf5aab72b1b99b5331231d09ebb26) C:\Windows\System32\WUDFSvc.dll
20:26:33.0429 3832        wudfsvc - ok
20:26:33.0511 3832        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
20:26:34.0060 3832        \Device\Harddisk0\DR0 - ok
20:26:34.0067 3832        Boot (0x1200)  (7406286e6bea798d75bb17d5767c0f7e) \Device\Harddisk0\DR0\Partition0
20:26:34.0072 3832        \Device\Harddisk0\DR0\Partition0 - ok
20:26:34.0099 3832        Boot (0x1200)  (4f8c53945aced41807e85ee2a4007738) \Device\Harddisk0\DR0\Partition1
20:26:34.0102 3832        \Device\Harddisk0\DR0\Partition1 - ok
20:26:34.0103 3832        ============================================================
20:26:34.0103 3832        Scan finished
20:26:34.0103 3832        ============================================================
20:26:34.0132 2212        Detected object count: 2
20:26:34.0132 2212        Actual detected object count: 2
20:27:17.0893 2212        RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
20:27:17.0894 2212        RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:27:17.0898 2212        TestHandler ( UnsignedFile.Multi.Generic ) - skipped by user
20:27:17.0899 2212        TestHandler ( UnsignedFile.Multi.Generic ) - User select action: Skip
gruß, chrissilein

cosinus 13.08.2012 15:50
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Chrissilein 13.08.2012 16:37
ok, dann hier die combofix.txt:


Combofix Logfile:
Code:
ComboFix 12-08-13.01 - *** 13.08.2012  17:09:17.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6000.0.1252.49.1031.18.2046.1193 [GMT 2:00]
ausgeführt von:: c:\users\***\Pictures\100_JD50\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\***\AppData\Roaming\Microsoft\Windows\Recent\Alice.url
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-07-13 bis 2012-08-13  ))))))))))))))))))))))))))))))
.
.
2012-08-13 15:18 . 2012-08-13 15:19        --------        d-----w-        c:\users\***\AppData\Local\temp
2012-08-13 15:18 . 2012-08-13 15:18        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-08-12 09:34 . 2012-08-12 09:34        --------        d-----w-        C:\_OTL
2012-08-05 19:30 . 2012-08-05 19:30        --------        d-----w-        c:\program files\ESET
2012-08-03 15:10 . 2012-08-03 15:10        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes
2012-08-03 15:10 . 2012-08-03 15:10        --------        d-----w-        c:\programdata\Malwarebytes
2012-08-03 15:10 . 2012-08-03 15:32        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-08-03 15:10 . 2012-07-03 11:46        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-08-03 07:37 . 2012-06-29 08:44        6891424        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{AAB290DF-0785-4541-924D-909E1E313A89}\mpengine.dll
2012-07-19 09:47 . 2012-07-19 09:47        --------        d-----w-        c:\program files\Common Files\Skype
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-31 10:25 . 2011-10-24 17:09        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-07-19 17:25 . 2011-10-23 11:40        136672        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2011-10-27 1232896]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-07-18 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-18 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-18 81920]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 4468736]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"OSD"="c:\program files\C&E\OSD\osd.exe" [2007-07-10 557056]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-26 153136]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
.
Inhalt des "geplante Tasks" Ordners
.
2012-08-13 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2011-10-24 07:07]
.
2012-08-13 c:\windows\Tasks\User_Feed_Synchronization-{DC2F8076-C24D-4EE9-B46D-B047A3BBFEF9}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\bow9ol4v.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-GOAbaEDU2010deInst - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-08-13 17:19
Windows 6.0.6000  NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
.
c:\users\***\AppData\Local\Temp\catchme.dll 53248 bytes executable
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 1
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
"MSCurrentCountry"=dword:000000b5
.
Zeit der Fertigstellung: 2012-08-13  17:23:21
ComboFix-quarantined-files.txt  2012-08-13 15:23
.
Vor Suchlauf: 15 Verzeichnis(se), 101.247.148.032 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 101.187.059.712 Bytes frei
.
- - End Of File - - 0B22DA3FAA7EE4AB6DF8C237F3B3E909
--- --- ---

cosinus 13.08.2012 18:18
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Chrissilein 13.08.2012 20:26
dann hier erstmal das GMER-Log:


GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-08-13 21:22:51
Windows 6.0.6000  Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD25 rev.01.0
Running: lkcijiwh.exe; Driver: C:\Users\***\AppData\Local\Temp\kwrdipow.sys


---- System - GMER 1.0.15 ----

SSDT  8DC84614                                                                                        ZwClose
SSDT  8DC8461E                                                                                        ZwCreateSection
SSDT  8DC8460F                                                                                        ZwDuplicateObject
SSDT  8DC845B0                                                                                        ZwOpenProcess
SSDT  8DC845B5                                                                                        ZwOpenThread
SSDT  8DC84628                                                                                        ZwRequestWaitReplyPort
SSDT  8DC84623                                                                                        ZwSetContextThread
SSDT  8DC8462D                                                                                        ZwSetSecurityObject
SSDT  8DC84632                                                                                        ZwSystemDebugControl
SSDT  8DC845BF                                                                                        ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text  ntkrnlpa.exe!ZwCallbackReturn + 368                                                              81C80874 4 Bytes  [14, 46, C8, 8D]
.text  ntkrnlpa.exe!ZwCallbackReturn + 3D4                                                              81C808E0 4 Bytes  [1E, 46, C8, 8D]
.text  ntkrnlpa.exe!ZwCallbackReturn + 73C                                                              81C80C48 4 Bytes  [23, 46, C8, 8D]
.text  C:\Windows\system32\DRIVERS\nvlddmkm.sys                                                        section is writeable [0x8BAC0380, 0x3559E2, 0xE8000020]

---- Registry - GMER 1.0.15 ----

Reg    HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060d01305                     
Reg    HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060d16a4d                     
Reg    HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060d01305 (not active ControlSet) 
Reg    HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060d16a4d (not active ControlSet) 

---- EOF - GMER 1.0.15 ----
--- --- ---

und hier das OSAM log

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 21:41:57 on 13.08.2012

OS: Windows Vista Home Premium Edition (Build 6000), 32-bit
Default Browser: Mozilla Corporation Firefox 14.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GlaryInitialize.job" - "Glarysoft Ltd" - C:\Program Files\Glary Utilities\initialize.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\Users\***\AppData\Local\Temp\catchme.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"kwrdipow" (kwrdipow) - ? - C:\Users\***\AppData\Local\Temp\kwrdipow.sys  (Hidden registry entry, rootkit activity | File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{72923739-5A47-40A3-9895-25AF0DFBB9E4} "Glary Utilities Context Menu Shell Extension" - "Glarysoft Ltd" - C:\PROGRA~1\GLARYU~1\CONTEX~1.DLL
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"NeroFilterCheck" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
"OSD" - "C&E" - C:\Program Files\C&E\OSD\osd.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
"Fujitsu Siemens Computers Diagnostic Testhandler" (TestHandler) - "Fujitsu Siemens Computers" - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files\Skype\Updater\Updater.exe
"Symantec Lic NetConnect service" (CLTNetCnService) - ? - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - "Fujitsu Siemens Computers" - c:\windows\system32\Fujits~1.scr

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru



so, und nun nach einem Absturz auch das letzte aswmbr-log:


Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-13 22:00:21
-----------------------------
22:00:21.527    OS Version: Windows 6.0.6000
22:00:21.527    Number of processors: 2 586 0xF0D
22:00:21.527    ComputerName: ***-PC  UserName: ***
22:00:44.412    Initialize success
22:01:08.919    AVAST engine defs: 12081301
22:01:31.149    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
22:01:31.149    Disk 0 Vendor: WDC_WD25 01.0 Size: 238475MB BusType: 3
22:01:31.181    Disk 0 MBR read successfully
22:01:31.196    Disk 0 MBR scan
22:01:31.227    Disk 0 Windows VISTA default MBR code
22:01:31.243    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        12102 MB offset 2048
22:01:31.274    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      150915 MB offset 24786944
22:01:31.305    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        75456 MB offset 333860864
22:01:31.321    Disk 0 scanning sectors +488394752
22:01:31.415    Disk 0 scanning C:\Windows\system32\drivers
22:01:46.827    Service scanning
22:02:27.169    Modules scanning
22:02:33.768    Disk 0 trace - called modules:
22:02:33.830    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
22:02:33.846    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x851ffad8]
22:02:33.861    3 ntkrnlpa.exe[81cb07e2] -> nt!IofCallDriver -> [0x84804238]
22:02:33.861    5 acpi.sys[8046932a] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8481e030]
22:02:35.328    AVAST engine scan C:\Windows
22:02:42.098    AVAST engine scan C:\Windows\system32
22:08:06.251    AVAST engine scan C:\Windows\system32\drivers
22:08:23.738    AVAST engine scan C:\Users\Tina
22:14:31.872    AVAST engine scan C:\ProgramData
22:15:14.663    Scan finished successfully
22:17:03.348    Disk 0 MBR has been saved successfully to "C:\Users\***\Pictures\100_JD50\Desktop\MBR.dat"
22:17:03.364    The log file has been saved successfully to "C:\Users\***\Pictures\100_JD50\Desktop\aswMBR.txt"

cosinus 14.08.2012 14:21
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Chrissilein 14.08.2012 17:45
hier erstmal der vollscan von malwarebyte

Code:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.14.03

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.16982
Tina :: ***-PC [Administrator]

Schutz: Aktiviert

14.08.2012 17:19:29
mbam-log-2012-08-14 (17-19-29).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 283709
Laufzeit: 1 Stunde(n), 15 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Eine Frage hätte ich. Es ist jetzt schon das zweite oder dritte mal passiert, dass mein Laptop im Ruhezustand plötzlich grundlos heruntergefahren ist und Windows neu gestartet hat. Das hatte ich vor dem Virus noch nicht.. Kann man da noch was scannen oder so?

Gruß, Chrissilein

cosinus 14.08.2012 18:07
Zum Ruhezustand kann ich leider nicht viel sagen. Ich nutzte den noch nie. Wenn lass ich den Rechner an, oder fahre ihn runter.

Chrissilein 14.08.2012 20:31
schade. dann werd ich mir den ruhezustand mal lieber abgewöhnen.

hier nun das sasw-log:

Code:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 08/14/2012 at 08:20 PM

Application Version : 5.5.1012

Core Rules Database Version : 9054
Trace Rules Database Version: 6866

Scan type      : Complete Scan
Total Scan Time : 01:22:56

Operating System Information
Windows Vista Home Premium 32-bit (Build 6.00.6000)
UAC On - Administrator

Memory items scanned      : 657
Memory threats detected  : 0
Registry items scanned    : 34864
Registry threats detected : 0
File items scanned        : 148771
File threats detected    : 439

Adware.Tracking Cookie
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@68378.findfastnow[1].txt [ /68378.findfastnow ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ad.adc-serv[1].txt [ /ad.adc-serv ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ad.adnet[1].txt [ /ad.adnet ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ad.yieldmanager[1].txt [ /ad.yieldmanager ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ad.zanox[1].txt [ /ad.zanox ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ad1.adfarm1.adition[2].txt [ /ad1.adfarm1.adition ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ad2.adfarm1.adition[1].txt [ /ad2.adfarm1.adition ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ad4.adfarm1.adition[2].txt [ /ad4.adfarm1.adition ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@adfarm1.adition[1].txt [ /adfarm1.adition ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@adjuggler[1].txt [ /adjuggler ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@adnetwork[1].txt [ /adnetwork ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ads1.ministerial5[1].txt [ /ads1.ministerial5 ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@adserver.adtechus[1].txt [ /adserver.adtechus ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@apmebf[2].txt [ /apmebf ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@atdmt[2].txt [ /atdmt ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@c.atdmt[2].txt [ /c.atdmt ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@clicksor[2].txt [ /clicksor ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@content.yieldmanager[1].txt [ /content.yieldmanager ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@doubleclick[1].txt [ /doubleclick ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@eclickz[1].txt [ /eclickz ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@fastclick[2].txt [ /fastclick ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@filter.cynosmedia[2].txt [ /filter.cynosmedia ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@findfastnow[1].txt [ /findfastnow ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@goclicker[1].txt [ /goclicker ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@harrenmedianetwork[1].txt [ /harrenmedianetwork ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@imrworldwide[2].txt [ /imrworldwide ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@invitemedia[1].txt [ /invitemedia ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@mediaplex[2].txt [ /mediaplex ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@myroitracking[1].txt [ /myroitracking ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@openx.overadmedia[1].txt [ /openx.overadmedia ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ox-d.enveromedia[1].txt [ /ox-d.enveromedia ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@questionsitesell[1].txt [ /questionsitesell ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@quizquestionsite[1].txt [ /quizquestionsite ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@revsci[1].txt [ /revsci ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ru4[2].txt [ /ru4 ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@s2.trafficno[2].txt [ /s2.trafficno ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@s4.mediaadserver[2].txt [ /s4.mediaadserver ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@search.eclickz[1].txt [ /search.eclickz ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@serving-sys[2].txt [ /serving-sys ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@statcounter[1].txt [ /statcounter ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@tradedoubler[1].txt [ /tradedoubler ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@vidasco.rotator.hadj7.adjuggler[2].txt [ /vidasco.rotator.hadj7.adjuggler ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@webmasterplan[2].txt [ /webmasterplan ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@yieldmanager[1].txt [ /yieldmanager ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@youporn[2].txt [ /youporn ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@yourquestionstudy[1].txt [ /yourquestionstudy ]
        C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@zanox[2].txt [ /zanox ]
        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\Low\***@c.atdmt[2].txt [ Cookie:***@c.atdmt.com/ ]
        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\Low\***@doubleclick[1].txt [ Cookie:***@doubleclick.net/ ]
        C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\Low\***@atdmt[2].txt [ Cookie:***@atdmt.com/ ]
        C:\USERS\***\Cookies\***@mediaplex[2].txt [ Cookie:***@mediaplex.com/ ]
        C:\USERS\***\Cookies\***@adnetwork[1].txt [ Cookie:***@adnetwork.net/ ]
        C:\USERS\***\Cookies\***@vidasco.rotator.hadj7.adjuggler[2].txt [ Cookie:***@vidasco.rotator.hadj7.adjuggler.net/ ]
        C:\USERS\***\Cookies\***@statcounter[1].txt [ Cookie:***@statcounter.com/ ]
        C:\USERS\***\Cookies\***@harrenmedianetwork[1].txt [ Cookie:***@harrenmedianetwork.com/ ]
        C:\USERS\***\Cookies\***@serving-sys[2].txt [ Cookie:***@serving-sys.com/ ]
        C:\USERS\***\Cookies\***@search.eclickz[1].txt [ Cookie:***@search.eclickz.com/ ]
        C:\USERS\***\Cookies\***@clicksor[2].txt [ Cookie:***@clicksor.com/ ]
        C:\USERS\***\Cookies\***@c.atdmt[2].txt [ Cookie:***@c.atdmt.com/ ]
        C:\USERS\***\Cookies\***@goclicker[1].txt [ Cookie:***@goclicker.com/ ]
        C:\USERS\***\Cookies\***@doubleclick[1].txt [ Cookie:***@doubleclick.net/ ]
        C:\USERS\***\Cookies\***@eclickz[1].txt [ Cookie:***@eclickz.com/ ]
        C:\USERS\***\Cookies\***@ru4[2].txt [ Cookie:***@ru4.com/ ]
        C:\USERS\***\Cookies\***@yieldmanager[1].txt [ Cookie:***@yieldmanager.net/ ]
        C:\USERS\***\Cookies\***@yourquestionstudy[1].txt [ Cookie:***@yourquestionstudy.net/ ]
        C:\USERS\***\Cookies\***@webmasterplan[2].txt [ Cookie:***@webmasterplan.com/ ]
        C:\USERS\***\Cookies\***@adserver.adtechus[1].txt [ Cookie:***@adserver.adtechus.com/ ]
        C:\USERS\***\Cookies\***@ad.yieldmanager[1].txt [ Cookie:***@ad.yieldmanager.com/ ]
        C:\USERS\***\Cookies\***@quizquestionsite[1].txt [ Cookie:***@quizquestionsite.net/ ]
        C:\USERS\***\Cookies\***@findfastnow[1].txt [ Cookie:***@findfastnow.com/ ]
        C:\USERS\***\Cookies\***@imrworldwide[2].txt [ Cookie:***@imrworldwide.com/cgi-bin ]
        C:\USERS\***\Cookies\***@invitemedia[1].txt [ Cookie:***@invitemedia.com/ ]
        C:\USERS\***\Cookies\***@ad.zanox[1].txt [ Cookie:***@ad.zanox.com/ ]
        C:\USERS\***\Cookies\***@s2.trafficno[2].txt [ Cookie:***@s2.trafficno.com/ ]
        C:\USERS\***\Cookies\***@ad.adnet[1].txt [ Cookie:***@ad.adnet.de/ ]
        C:\USERS\***\Cookies\***@youporn[2].txt [ Cookie:***@youporn.com/ ]
        C:\USERS\***\Cookies\***@68378.findfastnow[1].txt [ Cookie:***@68378.findfastnow.com/ ]
        C:\USERS\***\Cookies\***@adfarm1.adition[1].txt [ Cookie:***@adfarm1.adition.com/ ]
        C:\USERS\***\Cookies\***@atdmt[2].txt [ Cookie:***@atdmt.com/ ]
        C:\USERS\***\Cookies\***@ad2.adfarm1.adition[1].txt [ Cookie:***@ad2.adfarm1.adition.com/ ]
        C:\USERS\***\Cookies\***@questionsitesell[1].txt [ Cookie:***@questionsitesell.com/ ]
        C:\USERS\***\Cookies\***@openx.overadmedia[1].txt [ Cookie:***@openx.overadmedia.com/ ]
        C:\USERS\***\Cookies\***@filter.cynosmedia[2].txt [ Cookie:***@filter.cynosmedia.com/ ]
        C:\USERS\***\Cookies\***@adjuggler[1].txt [ Cookie:***@adjuggler.net/ ]
        C:\USERS\***\Cookies\***@tradedoubler[1].txt [ Cookie:***@tradedoubler.com/ ]
        C:\USERS\***\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\***@AD.360YIELD[2].TXT [ /AD.360YIELD ]
        C:\USERS\***\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\***@XITI[1].TXT [ /XITI ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ads.247activemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .paypal.112.2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .generaltracking.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.blogcounter.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        tracking.mlsat02.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        tracking.tchibo.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        audit.median.hu [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .eclipse.unrulymedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .eclipse.unrulymedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .eclipse.unrulymedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        counters.gigya.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .care2.112.2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .mmstat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .indieclick.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        optimize.indieclick.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        banner.mwonline.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        be.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .stepstone.112.2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .stats.paypal.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        adserving.avazudsp.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        adserving.avazudsp.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .c.gigcount.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aelocic5scp.stats.esomniture.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.blogcounter.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        track.zalando.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .dmtracker.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .survey.g.doubleclick.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        eset-online-scanner.softonic.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        eset-online-scanner.softonic.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        eset-online-scanner.softonic.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        eset-online-scanner.softonic.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .quartermedia.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .quartermedia.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .mm.chitika.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        count.primawebtools.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .opodo.122.2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        tomtailor.dyntracker.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        server.iad.liveperson.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        tracking.statravel.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        media.gan-online.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .guj.122.2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .philips.112.2o7.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .clickfuse.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        aimfar.solution.weborama.fr [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .weborama.fr [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .weborama.fr [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .weborama.fr [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .weboramapublishertrackinguk2.solution.weborama.fr [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .weboramapublishertrackinguk2.solution.weborama.fr [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.active-tracking.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.skyscanner.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.skyscanner.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.skyscanner.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.skyscanner.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .skyscanner.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.skyscanner.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .unister-adservices.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .at.atwola.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .skyscanner.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .skyscanner.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .skyscanner.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        www.skyscanner.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tracker.vinsight.de [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BOW9OL4V.DEFAULT\COOKIES.SQLITE ]

cosinus 15.08.2012 19:24
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Chrissilein 16.08.2012 10:06
ok, werde ich mal eins von den genannten cookie-programmen ausprobieren.

mein pc arbeitet wieder einwandfrei - bis auf das selbstinitiierte herunterfahren im ruhezustand. aber damit werde ich schon leben können.

eine frage noch zu dem usb-stick, auf dem ich zu beginn das malware-programm gespeichert hatte und dann auf meinem laptop gestartet habe. kann der jetzt irgendwie infiziert sein oder brauche ich mir da keine sorgen machen? (der war nagelneu gekauft - wäre schade, ihn gleich wegzuschmeißen..)

gruß, chrissilein

cosinus 16.08.2012 11:48
Zitat:
wäre schade, ihn gleich wegzuschmeißen..)
Wie kommt man denn gleich auf wegschmeißen :wtf:
Du entsorgst doch auch nicht ein Auto wenn der Aschenbecher voll ist...formatiert das Ding über wenn keine wichtigen Daten drauf sind und deaktiviere grundsätzlich die automatische Wiedergabe auf allen Laufwerken

Automatische Wiedergabe deaktivieren

Windows XP: Zur Vereinfachung hab ich mal die noautoplay.reg hochgeladen. Lad das auf dem Desktop herunter, führ die Datei aus und bestätige mit ja. Nach einem Neustart des Rechners ist die automatische Wiedergabe (von Datenträgern) auf allen Laufwerken deaktiviert, d.h. keine CD, kein Stick oder sonstwas startet nach dem Einstecken mehr automatisch.

Windows Vista/7: In der Systemsteuerung unter automatische Wiedergabe von CDs und anderen Medien alles deaktivieren. => siehe auch Einstellungen für automatische Wiedergabe ändern


Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Chrissilein 19.08.2012 20:18
Ok, werde ich dann mal alles so machen wie beschrieben. Vielen lieben Dank für die Unterstützung!!

Gruß, Christine


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:57 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19