TR/Dldr.OpenConnection.OJ.1, EXP/CVE-2010-4452 und EXP/CVE-2012-0507

Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Sonntag, 1. Juli 2012  15:27

Es wird nach 3819135 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer   : Avira AntiVir Personal - Free Antivirus
Seriennummer   : 0000149996-ADJIE-0000001
Plattform      : Windows 7 x64
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus     : Normal gebootet
Benutzername   : test
Computername   : TEST-PC

Versionsinformationen:
BUILD.DAT      : 10.2.0.707     36070 Bytes  25.01.2012 12:53:00
AVSCAN.EXE     : 10.3.0.7      484008 Bytes  30.06.2011 10:03:06
AVSCAN.DLL     : 10.0.5.0       57192 Bytes  30.06.2011 10:03:06
LUKE.DLL       : 10.3.0.5       45416 Bytes  30.06.2011 10:03:06
LUKERES.DLL    : 10.0.0.0       13672 Bytes  14.01.2010 10:59:47
AVSCPLR.DLL    : 10.3.0.7      119656 Bytes  30.06.2011 10:03:06
AVREG.DLL      : 10.3.0.9       88833 Bytes  13.07.2011 05:27:11
VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 08:05:36
VBASE001.VDF   : 7.11.0.0    13342208 Bytes  14.12.2010 15:06:56
VBASE002.VDF   : 7.11.19.170 14374912 Bytes  20.12.2011 22:22:55
VBASE003.VDF   : 7.11.21.238  4472832 Bytes  01.02.2012 21:17:35
VBASE004.VDF   : 7.11.26.44   4329472 Bytes  28.03.2012 10:43:18
VBASE005.VDF   : 7.11.34.116  4034048 Bytes  29.06.2012 13:28:52
VBASE006.VDF   : 7.11.34.117     2048 Bytes  29.06.2012 13:28:52
VBASE007.VDF   : 7.11.34.118     2048 Bytes  29.06.2012 13:28:53
VBASE008.VDF   : 7.11.34.119     2048 Bytes  29.06.2012 13:28:53
VBASE009.VDF   : 7.11.34.120     2048 Bytes  29.06.2012 13:28:54
VBASE010.VDF   : 7.11.34.121     2048 Bytes  29.06.2012 13:28:55
VBASE011.VDF   : 7.11.34.122     2048 Bytes  29.06.2012 13:28:55
VBASE012.VDF   : 7.11.34.123     2048 Bytes  29.06.2012 13:28:56
VBASE013.VDF   : 7.11.34.124     2048 Bytes  29.06.2012 13:28:56
VBASE014.VDF   : 7.11.34.125     2048 Bytes  29.06.2012 13:28:57
VBASE015.VDF   : 7.11.34.126     2048 Bytes  29.06.2012 13:28:57
VBASE016.VDF   : 7.11.34.127     2048 Bytes  29.06.2012 13:28:58
VBASE017.VDF   : 7.11.34.128     2048 Bytes  29.06.2012 13:28:58
VBASE018.VDF   : 7.11.34.129     2048 Bytes  29.06.2012 13:28:59
VBASE019.VDF   : 7.11.34.130     2048 Bytes  29.06.2012 13:29:00
VBASE020.VDF   : 7.11.34.131     2048 Bytes  29.06.2012 13:29:00
VBASE021.VDF   : 7.11.34.132     2048 Bytes  29.06.2012 13:29:01
VBASE022.VDF   : 7.11.34.133     2048 Bytes  29.06.2012 13:29:01
VBASE023.VDF   : 7.11.34.134     2048 Bytes  29.06.2012 13:29:02
VBASE024.VDF   : 7.11.34.135     2048 Bytes  29.06.2012 13:29:02
VBASE025.VDF   : 7.11.34.136     2048 Bytes  29.06.2012 13:29:03
VBASE026.VDF   : 7.11.34.137     2048 Bytes  29.06.2012 13:29:04
VBASE027.VDF   : 7.11.34.138     2048 Bytes  29.06.2012 13:29:04
VBASE028.VDF   : 7.11.34.139     2048 Bytes  29.06.2012 13:29:05
VBASE029.VDF   : 7.11.34.140     2048 Bytes  29.06.2012 13:29:05
VBASE030.VDF   : 7.11.34.141     2048 Bytes  29.06.2012 13:29:06
VBASE031.VDF   : 7.11.34.162    57344 Bytes  30.06.2012 13:19:51
Engineversion  : 8.2.10.102
AEVDF.DLL      : 8.1.2.8       106867 Bytes  01.06.2012 23:44:30
AESCRIPT.DLL   : 8.1.4.28      455035 Bytes  22.06.2012 00:35:42
AESCN.DLL      : 8.1.8.2       131444 Bytes  27.01.2012 21:16:34
AESBX.DLL      : 8.2.5.12      606578 Bytes  15.06.2012 15:48:46
AERDL.DLL      : 8.1.9.15      639348 Bytes  08.09.2011 23:31:42
AEPACK.DLL     : 8.2.16.22     807288 Bytes  22.06.2012 00:35:33
AEOFFICE.DLL   : 8.1.2.40      201082 Bytes  28.06.2012 13:26:45
AEHEUR.DLL     : 8.1.4.58     4993399 Bytes  28.06.2012 13:26:31
AEHELP.DLL     : 8.1.23.2      258422 Bytes  28.06.2012 13:21:19
AEGEN.DLL      : 8.1.5.30      422261 Bytes  15.06.2012 15:41:57
AEEXP.DLL      : 8.1.0.58       82292 Bytes  28.06.2012 13:27:18
AEEMU.DLL      : 8.1.3.0       393589 Bytes  24.11.2010 09:49:25
AECORE.DLL     : 8.1.25.10     201080 Bytes  31.05.2012 23:45:13
AEBB.DLL       : 8.1.1.0        53618 Bytes  27.07.2010 17:54:38
AVWINLL.DLL    : 10.0.0.0       19304 Bytes  14.01.2010 10:59:10
AVPREF.DLL     : 10.0.3.2       44904 Bytes  30.06.2011 10:03:06
AVREP.DLL      : 10.0.0.10     174120 Bytes  20.05.2011 08:21:11
AVARKT.DLL     : 10.0.26.1     255336 Bytes  30.06.2011 10:03:06
AVEVTLOG.DLL   : 10.0.0.9      203112 Bytes  30.06.2011 10:03:06
SQLITE3.DLL    : 3.6.19.0      355688 Bytes  28.01.2010 11:57:53
AVSMTP.DLL     : 10.0.0.17      63848 Bytes  16.03.2010 14:38:54
NETNT.DLL      : 10.0.0.0       11624 Bytes  19.02.2010 13:40:55
RCIMAGE.DLL    : 10.0.0.35    2589544 Bytes  30.06.2011 10:03:06
RCTEXT.DLL     : 10.0.64.0      98664 Bytes  30.06.2011 10:03:06

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files (x86)\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, H:, 
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Sonntag, 1. Juli 2012  15:27

Der Suchlauf nach versteckten Objekten wird begonnen.
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows CE Services\symboliclinkvalue
  [HINWEIS]   Der Registrierungseintrag ist nicht sichtbar.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'mscorsvw.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'TurboKey.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'FourEngine.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'vmnetdhcp.exe' - '19' Modul(e) wurden durchsucht
Durchsuche Prozess 'VmbService.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'vmware-authd.exe' - '107' Modul(e) wurden durchsucht
Durchsuche Prozess 'vmnat.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'ImpWiFiSvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'retrorun.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'PassThruSvr.exe' - '19' Modul(e) wurden durchsucht
Durchsuche Prozess 'NBService.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'M4LIC.EXE' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'AsSysCtrlService.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'aaHMSvc.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '30' Modul(e) wurden durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'H:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '250' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Backup\Torrent.7z.001
  [WARNUNG]   Die Datei konnte nicht gelesen werden!
C:\Program Files (x86)\Steam\SteamApps\common\terraria\dotNetFx40_Full_x86_x64.exe
  [WARNUNG]   Die Datei konnte nicht gelesen werden!
C:\Users\test\AppData\Local\VirtualStore\Program Files (x86)\GnuWin32\bin\dl_dod.se.php@f=QRP_map_textures_v.1.00.pk3.7z
  [WARNUNG]   Die Datei konnte nicht gelesen werden!
C:\Users\test\AppData\Local\VirtualStore\Program Files (x86)\GnuWin32\bin\dl_dod.se.php@f=QRP_map_textures_v.1.00.pk3.7z.1
  [WARNUNG]   Die Datei konnte nicht gelesen werden!
C:\Users\test\AppData\Local\VirtualStore\Program Files (x86)\GnuWin32\bin\dl_dod.se.php@f=QRP_map_textures_v.1.00.pk3.7z.2
  [WARNUNG]   Die Datei konnte nicht gelesen werden!
C:\Users\test\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\5391f78f-11b6d0f8
  [FUND]      Ist das Trojanische Pferd TR/Dldr.OpenConnection.OJ.1
C:\Users\test\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\5391f78f-6353a88c
  [FUND]      Ist das Trojanische Pferd TR/Dldr.OpenConnection.OJ.1
C:\Users\test\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\62026d90-792eb3b1
  [0] Archivtyp: ZIP
  --> msf/x/Exploit.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507
  --> msf/x/Help.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/JAVA.Carbul.Gen
  --> msf/x/PayloadX$StreamConnector.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Treams.G
  --> msf/x/PayloadX.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Small.BX
  --> msf/x/Xxploit.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507
C:\Users\test\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\5bf963d4-2d592276
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-4452
C:\Users\test\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\4fae7cb6-20e78d0d
  [FUND]      Ist das Trojanische Pferd TR/Crypt.XPACK.Gen
C:\Users\test\Desktop\DeskSwap\GTK\demo_70.1.7z
  [0] Archivtyp: 7-Zip
  --> GTK2_demo_70.1.exe
      [FUND]      Ist das Trojanische Pferd TR/Injector.afc.1
C:\Users\test\Downloads\Trainer\civ5_plus13_customizable_updated_trainer.zip
  [0] Archivtyp: ZIP
  --> civ5_DX11_plus13_customizable_updated_trainer.exe
      [FUND]      Ist das Trojanische Pferd TR/Dynamer.dtc.3635
  --> civ5_DX9_plus13_customizable_updated_trainer.exe
      [FUND]      Ist das Trojanische Pferd TR/Agent.cada.4426
C:\Users\test\Downloads\Trainer\civilization5dx11_improved_trainer.zip
  [0] Archivtyp: ZIP
  --> civ5DX11 trainer improved.exe
      [FUND]      Ist das Trojanische Pferd TR/Agent.cada.2160
C:\Windows\SoftwareDistribution\Download\2929da9c30edb04e525e6fe6faf16a59\BIT3129.tmp
  [0] Archivtyp: CAB SFX (self extracting)
  --> silverlight.7z
      [WARNUNG]   Die Datei konnte nicht gelesen werden!
Beginne mit der Suche in 'H:\' <Volume>
H:\Backup\PUSB_80GB\Torrent.7z.001
  [WARNUNG]   Die Datei konnte nicht gelesen werden!
H:\Backup\demos\dos\COREfl.zip
  [0] Archivtyp: ZIP
  --> COREfl.exe
      [FUND]      Ist das Trojanische Pferd TR/Agent.bxt.1
H:\demos\dos\CORE_flames.zip
  [0] Archivtyp: ZIP
  --> COREfl.exe
      [FUND]      Ist das Trojanische Pferd TR/Agent.bxt.1

Beginne mit der Desinfektion:
H:\demos\dos\CORE_flames.zip
  [FUND]      Ist das Trojanische Pferd TR/Agent.bxt.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0ba8d754.qua' verschoben!
H:\Backup\demos\dos\COREfl.zip
  [FUND]      Ist das Trojanische Pferd TR/Agent.bxt.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7bd4faa2.qua' verschoben!
C:\Users\test\Downloads\old\civilization5dx11_improved_trainer.zip
  [FUND]      Ist das Trojanische Pferd TR/Agent.cada.2160
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5658dad4.qua' verschoben!
C:\Users\test\Downloads\old\civ5_plus13_customizable_updated_trainer.zip
  [FUND]      Ist das Trojanische Pferd TR/Agent.cada.4426
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ecff573.qua' verschoben!
C:\Users\test\Desktop\DeskSwap\GTK\demo_70.1.7z
  [FUND]      Ist das Trojanische Pferd TR/Injector.afc.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4327af89.qua' verschoben!
C:\Users\test\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\4fae7cb6-20e78d0d
  [FUND]      Ist das Trojanische Pferd TR/Crypt.XPACK.Gen
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1ca7af98.qua' verschoben!
C:\Users\test\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\5bf963d4-2d592276
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2010-4452
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7a97e05e.qua' verschoben!
C:\Users\test\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\62026d90-792eb3b1
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3f65cd50.qua' verschoben!
C:\Users\test\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\5391f78f-6353a88c
  [FUND]      Ist das Trojanische Pferd TR/Dldr.OpenConnection.OJ.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4077ff30.qua' verschoben!
C:\Users\test\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\5391f78f-11b6d0f8
  [FUND]      Ist das Trojanische Pferd TR/Dldr.OpenConnection.OJ.1
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0ccfd37a.qua' verschoben!


Ende des Suchlaufs: Sonntag, 1. Juli 2012  18:16
Benötigte Zeit:  2:46:49 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  55700 Verzeichnisse wurden überprüft
 1980853 Dateien wurden geprüft
     15 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      7 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 1980838 Dateien ohne Befall
  41802 Archive wurden durchsucht
     10 Warnungen
      8 Hinweise
 821830 Objekte wurden beim Rootkitscan durchsucht
      1 Versteckte Objekte wurden gefunden
         

 Malwarebytes Anti-Malware  (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.01.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
test :: TEST-PC [Administrator]

Schutz: Aktiviert

01.07.2012 20:58:15
mbam-log-2012-07-01 (20-58-15).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 229342
Laufzeit: 3 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

OTL logfile created on: 01.07.2012 21:46:08 - Run 1
OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\test\Downloads\DTA
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,65 Gb Available Physical Memory | 66,22% Memory free
8,00 Gb Paging File | 6,45 Gb Available in Paging File | 80,69% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,76 Gb Total Space | 197,11 Gb Free Space | 42,32% Space Free | Partition Type: NTFS
Drive D: | 3,92 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive H: | 465,75 Gb Total Space | 285,94 Gb Free Space | 61,39% Space Free | Partition Type: NTFS
 
Computer Name: TEST-PC | User Name: test | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.01 16:45:53 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\test\Downloads\DTA\OTL.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe
PRC - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe
PRC - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
PRC - [2011.10.15 01:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011.09.15 13:06:04 | 000,088,576 | ---- | M] () -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
PRC - [2011.07.14 15:45:44 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2011.06.30 12:03:06 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.05.15 16:27:39 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2010.12.02 11:15:14 | 000,915,584 | ---- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
PRC - [2010.11.10 17:37:19 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.09.29 15:08:58 | 000,200,624 | ---- | M] (Telefónica I+D) -- C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe
PRC - [2009.07.29 12:19:00 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2009.07.29 11:54:36 | 000,205,312 | ---- | M] (Mediafour Corporation) -- C:\Program Files (x86)\Common Files\Mediafour\M4LIC.EXE
PRC - [2009.06.04 16:10:56 | 005,777,408 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
PRC - [2009.05.25 15:29:14 | 001,768,960 | ---- | M] () -- C:\Program Files (x86)\ASUS\Turbo Key\TurboKey.exe
PRC - [2009.04.02 13:27:28 | 000,090,112 | ---- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.09.27 08:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 08:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009.06.04 16:10:56 | 005,777,408 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
MOD - [2009.05.25 15:29:14 | 001,768,960 | ---- | M] () -- C:\Program Files (x86)\ASUS\Turbo Key\TurboKey.exe
MOD - [2009.04.29 15:24:44 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\Turbo Key\pngio.dll
MOD - [2009.04.29 15:24:44 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\Turbo Key\AiNap.dll
MOD - [2009.04.29 15:24:44 | 000,008,704 | ---- | M] () -- C:\Program Files (x86)\ASUS\Turbo Key\vvc.dll
MOD - [2009.03.25 17:53:14 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
MOD - [2009.01.15 15:55:10 | 000,565,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
MOD - [2006.01.10 17:50:20 | 000,024,576 | ---- | M] () -- C:\Windows\SysWOW64\AsIO.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.08.09 04:04:10 | 000,166,704 | ---- | M] (Samsung Electronics CO., LTD.) [On_Demand | Stopped] -- C:\Windows\SysNative\SUPDSvc.exe -- (Samsung UPD Service)
SRV:64bit: - [2009.07.14 12:55:58 | 000,019,456 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\wlms\wlms.exe -- (WLMS)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2007.05.16 09:41:16 | 000,036,360 | ---- | M] (TuneUp Software GmbH) [Auto | Stopped] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp)
SRV - [2012.06.17 21:11:21 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.04.23 22:32:39 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service)
SRV - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2011.10.15 10:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.10.15 01:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011.09.15 13:06:04 | 000,088,576 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2011.08.29 23:11:04 | 000,846,448 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe -- (VMUSBArbService)
SRV - [2011.07.17 18:58:02 | 000,075,136 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.07.14 15:45:44 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2011.06.30 12:03:06 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.05.15 16:27:39 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.12.02 11:15:14 | 000,915,584 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe -- (asHmComSvc)
SRV - [2010.09.29 15:08:58 | 000,200,624 | ---- | M] (Telefónica I+D) [Auto | Running] -- C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe -- (TGCM_ImportWiFiSvc)
SRV - [2010.03.22 09:17:24 | 000,276,584 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe -- (nTuneService)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.11.06 13:24:54 | 000,282,728 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe -- (UpdateCenterService)
SRV - [2009.09.03 10:33:50 | 000,218,112 | ---- | M] (Mediafour Corporation) [Disabled | Stopped] -- C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe -- (MacDrive8Service)
SRV - [2009.08.18 13:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.07.29 12:19:00 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.07.29 11:54:36 | 000,205,312 | ---- | M] (Mediafour Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Mediafour\M4LIC.EXE -- (M4LIC)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.04.02 13:27:28 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2007.05.31 11:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 11:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007.05.16 09:41:18 | 000,029,704 | ---- | M] (TuneUp Software GmbH) [Auto | Stopped] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.09 16:12:44 | 000,138,360 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AnyDVD.sys -- (AnyDVD)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.12.29 21:21:59 | 000,310,728 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2011.12.29 21:21:59 | 000,042,696 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2011.11.14 00:43:36 | 000,063,088 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86)
DRV:64bit: - [2011.11.14 00:42:40 | 000,032,880 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd)
DRV:64bit: - [2011.11.14 00:42:12 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV:64bit: - [2011.11.13 22:33:56 | 000,045,680 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV:64bit: - [2011.11.13 22:33:56 | 000,020,080 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV:64bit: - [2011.08.29 23:11:04 | 000,039,024 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon)
DRV:64bit: - [2011.08.08 15:59:12 | 000,116,336 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci)
DRV:64bit: - [2011.07.30 20:47:55 | 000,046,648 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PCAMp50a64.sys -- (PCAMp50a64)
DRV:64bit: - [2011.07.30 20:47:55 | 000,045,624 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PCASp50a64.sys -- (PCASp50a64)
DRV:64bit: - [2011.07.08 19:32:08 | 000,769,816 | ---- | M] (www.ext2fsd.com) [File_System | System | Running] -- C:\Windows\SysNative\drivers\Ext2Fsd.sys -- (Ext2Fsd)
DRV:64bit: - [2011.07.07 17:13:40 | 000,018,456 | ---- | M] (HandSet Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter_hs.sys -- (massfilter_hs)
DRV:64bit: - [2011.06.30 12:03:06 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.06.30 12:03:06 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.05.20 17:15:54 | 000,058,880 | ---- | M] (Vodafone) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vodafone_zte_cdc_ecm.sys -- (vodafone_zte_cdc_ecm)
DRV:64bit: - [2011.05.20 17:15:54 | 000,056,320 | ---- | M] (Vodafone) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vodafone_zte_ecm_enum_filter.sys -- (vodafone_zte_ecm_enum_filter)
DRV:64bit: - [2011.05.20 17:15:54 | 000,056,320 | ---- | M] (Vodafone) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vodafone_zte_ecm_enum.sys -- (vodafone_zte_ecm_enum) Vodafone Vodafone ZTE DC Enumerator (ZTE)
DRV:64bit: - [2011.05.20 17:15:52 | 000,079,872 | ---- | M] (Vodafone) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vodafone_zte_cdc_acm.sys -- (vodafone_zte_cdc_acm) Vodafone Vodafone ZTE CDC-ACM driver (ZTE)
DRV:64bit: - [2011.05.20 17:15:52 | 000,014,336 | ---- | M] (Vodafone) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vodafone_zte_cpo.sys -- (vodafone_zte_cpo)
DRV:64bit: - [2011.05.17 23:55:39 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.03.28 16:42:18 | 000,129,304 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ghsmdm.sys -- (ghsmdm)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.12.17 00:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.09.01 14:33:12 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K3805-z_dc_enum.sys -- (vodafone_K3805-z_dc_enum)
DRV:64bit: - [2010.08.10 10:57:32 | 000,230,352 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2010.06.25 17:08:10 | 000,036,928 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\htcnprot.sys -- (htcnprot)
DRV:64bit: - [2010.06.14 10:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk)
DRV:64bit: - [2010.04.09 09:24:32 | 000,076,288 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:64bit: - [2010.04.07 11:05:00 | 000,250,368 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbnet.sys -- (ewusbnet)
DRV:64bit: - [2010.03.25 04:08:46 | 000,120,704 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2010.03.20 05:56:56 | 000,114,560 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:64bit: - [2010.02.03 15:56:56 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2009.11.02 19:16:50 | 000,033,736 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys -- (HTCAND64)
DRV:64bit: - [2009.09.21 14:24:37 | 000,169,520 | ---- | M] (Auerswald GmbH & Co.KG                         ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\aumpa.sys -- (aumpa)
DRV:64bit: - [2009.09.21 14:24:32 | 000,234,800 | ---- | M] (Auerswald GmbH & Co.KG                         ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\aucapi.sys -- (aucapi)
DRV:64bit: - [2009.09.15 14:59:30 | 000,042,088 | ---- | M] (NVIDIA Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvoclk64.sys -- (nvoclk64)
DRV:64bit: - [2009.09.03 10:53:20 | 000,333,416 | ---- | M] (Mediafour Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\MDFSYSNT.SYS -- (MDFSYSNT)
DRV:64bit: - [2009.08.23 06:08:10 | 000,056,320 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E)
DRV:64bit: - [2009.08.21 10:52:09 | 000,079,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009.07.16 12:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009.07.06 16:06:18 | 000,032,352 | ---- | M] (Mediafour Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\MDPMGRNT.SYS -- (MDPMGRNT)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2006.06.14 14:45:18 | 000,015,360 | R--- | M] (ASUSTeK Computer Inc.) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\EIO64_XP.sys -- (EIO_XP)
DRV:64bit: - [2005.09.23 23:18:34 | 000,261,120 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MarvinBus64.sys -- (MarvinBus)
DRV - [2012.03.09 16:12:44 | 000,138,360 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2010.06.14 10:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2007.03.20 12:33:26 | 000,028,672 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\libusb0.sys -- (libusb0)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 91 C4 FB 10 88 24 CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.8
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: dtaScheduler@forboden.com:0.2.7
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.3.6
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.8
FF - prefs.js..extensions.enabledItems: {b749fc7c-e949-447f-926c-3f4eed6accfe}:0.7.0.2
FF - prefs.js..extensions.enabledItems: firefoxtweak@pribic.am:3.0
FF - prefs.js..extensions.enabledItems: {4a1a0a40-7d27-11dd-ad8b-0800200c9a66}:1.3.1
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\test\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\test\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011.04.16 21:40:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011.04.16 21:40:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.17 21:11:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.09 22:33:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files (x86)\Mozilla Sunbird\components [2011.11.11 01:46:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Sunbird\plugins [2011.11.11 01:46:04 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.17 21:11:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.09 22:33:07 | 000,000,000 | ---D | M]
 
[2012.02.10 13:07:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\test\AppData\Roaming\mozilla\Extensions
[2010.09.21 14:35:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\test\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2012.02.10 13:07:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\test\AppData\Roaming\mozilla\Extensions\pencil@evolus.vn
[2012.07.01 14:00:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\test\AppData\Roaming\mozilla\Firefox\Profiles\23pxxzg1.default\extensions
[2012.02.10 17:04:12 | 000,000,000 | ---D | M] (MonoChrome) -- C:\Users\test\AppData\Roaming\mozilla\Firefox\Profiles\23pxxzg1.default\extensions\{4a1a0a40-7d27-11dd-ad8b-0800200c9a66}
[2012.05.10 00:53:18 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\test\AppData\Roaming\mozilla\Firefox\Profiles\23pxxzg1.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.05.23 22:03:13 | 000,000,000 | ---D | M] (DownThemAll! Scheduler) -- C:\Users\test\AppData\Roaming\mozilla\Firefox\Profiles\23pxxzg1.default\extensions\dtaScheduler@forboden.com
[2012.01.20 01:20:44 | 000,000,000 | ---D | M] (FireFox Tweak) -- C:\Users\test\AppData\Roaming\mozilla\Firefox\Profiles\23pxxzg1.default\extensions\firefoxtweak@pribic.am
[2012.03.12 10:58:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\test\AppData\Roaming\mozilla\Sunbird\Profiles\ijlvyncg.default\extensions
[2012.02.06 11:06:26 | 000,000,000 | ---D | M] (FG Printers) -- C:\Users\test\AppData\Roaming\mozilla\Sunbird\Profiles\ijlvyncg.default\extensions\{9C463B6A-CCBE-11DB-97FC-FBC955D89593}
[2012.05.09 22:33:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.07.01 14:00:56 | 000,743,305 | ---- | M] () (No name found) -- C:\USERS\TEST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\23PXXZG1.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.05.09 22:40:33 | 000,709,293 | ---- | M] () (No name found) -- C:\USERS\TEST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\23PXXZG1.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
[2012.06.17 21:11:21 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.09.15 05:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.17 21:11:20 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.17 21:11:20 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.17 21:11:20 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.27 12:59:29 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
[2012.06.17 21:11:20 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.17 21:11:20 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.17 21:11:20 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: facemoods (Enabled)
CHR - default_search_provider: search_url = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
CHR - default_search_provider: suggest_url = 
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\test\AppData\Local\Google\Chrome\Application\19.0.1084.52\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\test\AppData\Local\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\test\AppData\Local\Google\Chrome\Application\19.0.1084.52\pdf.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\test\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\test\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\test\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: DivX HiQ = C:\Users\test\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.1.94_0\
CHR - Extension: DivX Plus Web Player HTML5 video = C:\Users\test\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.1.94_0\
CHR - Extension: DivX Plus Web Player HTML5 video = C:\Users\test\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.1.94_0\CRX_INSTALL\
CHR - Extension: Gmail = C:\Users\test\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2012.04.08 21:03:46 | 000,001,109 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 ns6.gandi.net 
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKLM..\Run: [Turbo Key] C:\Program Files (x86)\ASUS\Turbo Key\TurboKey.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.3.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{36CCD250-CE86-46E3-8C01-87C6CBA80B0E}: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9585A43D-8547-4747-BDF3-AA4C46FDA365}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BCBF42F2-7CB2-40ED-93CE-D2CC36AB19D5}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C24ADC5C-DACE-4185-BBC4-CFFACD8D0161}: NameServer = 139.7.30.125 139.7.30.126
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{02d67ed1-4799-11e1-8b04-001e101f63cf}\Shell - "" = AutoRun
O33 - MountPoints2\{02d67ed1-4799-11e1-8b04-001e101f63cf}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{0c308b98-5874-11e1-998a-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{0c308b98-5874-11e1-998a-005056c00008}\Shell\AutoRun\command - "" = G:\AutoRun.exe {D2D77DC2-8299-11D1-8949-444553540000} 5.2066.1.A11B02 PID_0083
O33 - MountPoints2\{0c308bff-5874-11e1-998a-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{0c308bff-5874-11e1-998a-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{15541105-80c0-11e0-aa85-e0cb4e19681a}\Shell - "" = AutoRun
O33 - MountPoints2\{15541105-80c0-11e0-aa85-e0cb4e19681a}\Shell\AutoRun\command - "" = G:\autorun.exe
O33 - MountPoints2\{2c7976cb-9064-11e0-88cd-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{2c7976cb-9064-11e0-88cd-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{4688a479-286d-11e0-b26c-e0cb4e19681a}\Shell - "" = AutoRun
O33 - MountPoints2\{4688a479-286d-11e0-b26c-e0cb4e19681a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{4688a47d-286d-11e0-b26c-e0cb4e19681a}\Shell - "" = AutoRun
O33 - MountPoints2\{4688a47d-286d-11e0-b26c-e0cb4e19681a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{4f7c7cfb-4124-11e1-82b4-e0cb4e19681a}\Shell - "" = AutoRun
O33 - MountPoints2\{4f7c7cfb-4124-11e1-82b4-e0cb4e19681a}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{4f7c7d0e-4124-11e1-82b4-e0cb4e19681a}\Shell - "" = AutoRun
O33 - MountPoints2\{4f7c7d0e-4124-11e1-82b4-e0cb4e19681a}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{4ffbb221-9df0-11e1-bf20-e0cb4e19681a}\Shell - "" = AutoRun
O33 - MountPoints2\{4ffbb221-9df0-11e1-bf20-e0cb4e19681a}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O33 - MountPoints2\{84e16066-8bbd-11e1-9b2a-e0cb4e19681a}\Shell - "" = AutoRun
O33 - MountPoints2\{84e16066-8bbd-11e1-9b2a-e0cb4e19681a}\Shell\AutoRun\command - "" = H:\setup_vmb_lite.exe /checkApplicationPresence
O33 - MountPoints2\{84e160b6-8bbd-11e1-9b2a-e0cb4e19681a}\Shell - "" = AutoRun
O33 - MountPoints2\{84e160b6-8bbd-11e1-9b2a-e0cb4e19681a}\Shell\AutoRun\command - "" = H:\setup_vmb_lite.exe /checkApplicationPresence
O33 - MountPoints2\{8759b913-bb38-11e1-8c62-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{8759b913-bb38-11e1-8c62-005056c00008}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{94e7547c-6c19-11e1-b41b-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{94e7547c-6c19-11e1-b41b-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{99ca26fd-627f-11e0-84f0-e0cb4e19681a}\Shell - "" = AutoRun
O33 - MountPoints2\{99ca26fd-627f-11e0-84f0-e0cb4e19681a}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{9c5e812f-7032-11e1-903d-005056c00008}\Shell - "" = AutoRun
O33 - MountPoints2\{9c5e812f-7032-11e1-903d-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b6e2be1f-a673-11e1-87f3-e0cb4e19681a}\Shell - "" = AutoRun
O33 - MountPoints2\{b6e2be1f-a673-11e1-87f3-e0cb4e19681a}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{e99c39aa-a225-11e0-8e71-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{e99c39aa-a225-11e0-8e71-806e6f6e6963}\Shell\AutoRun\command - "" = D:\FTE_MAXIMAL_ST_1.4.exe
O33 - MountPoints2\{ed9ff346-4279-11e1-bed8-080027001025}\Shell - "" = AutoRun
O33 - MountPoints2\{ed9ff346-4279-11e1-bed8-080027001025}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.01 21:05:10 | 000,000,000 | ---D | C] -- C:\Users\test\Desktop\Logs
[2012.07.01 20:01:40 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.07.01 19:34:57 | 000,000,000 | ---D | C] -- C:\Users\test\AppData\Roaming\Malwarebytes
[2012.07.01 19:34:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.01 19:34:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.01 19:34:50 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.01 19:34:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.06.29 00:01:22 | 000,000,000 | ---D | C] -- C:\Users\test\Desktop\Swap
[2012.06.22 19:19:45 | 000,000,000 | ---D | C] -- C:\Vms
[2012.06.10 16:16:33 | 000,000,000 | ---D | C] -- C:\Users\test\AppData\Roaming\FLV Extract
[2012.06.08 21:21:02 | 000,000,000 | ---D | C] -- C:\Program Files\Nestopia140bin
[2012.06.08 15:13:08 | 000,000,000 | ---D | C] -- C:\Users\test\Desktop\StarTrek TOS
[2012.06.06 17:18:46 | 000,000,000 | ---D | C] -- C:\Users\test\Desktop\Video Work Folder
[2012.06.05 23:39:47 | 000,000,000 | ---D | C] -- C:\Users\test\Desktop\StarTrek DS9
[2012.06.04 21:35:03 | 000,769,816 | ---- | C] (www.ext2fsd.com) -- C:\Windows\SysNative\drivers\Ext2Fsd.sys
[2010.11.16 12:18:17 | 001,531,392 | ---- | C] (Toshiba Samsung Storage Technology Corporation) -- C:\Users\test\AppData\Roaming\tsdnwin.dll
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.01 21:49:33 | 000,015,040 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.01 21:49:33 | 000,015,040 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.01 21:49:21 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.01 21:44:37 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.01 21:44:11 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2012.07.01 21:43:59 | 000,426,056 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.01 21:43:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.01 21:42:08 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3263010352-2300850641-2568945405-1001UA.job
[2012.07.01 21:37:46 | 000,907,452 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.01 21:37:46 | 000,710,630 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.01 21:37:46 | 000,154,642 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.01 21:37:46 | 000,023,044 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.01 21:37:46 | 000,009,920 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.01 19:34:52 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.01 18:37:59 | 000,076,786 | ---- | M] () -- C:\Users\test\Documents\cc_20120701_183716.reg
[2012.07.01 15:37:08 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3263010352-2300850641-2568945405-1001Core.job
[2012.06.29 21:50:43 | 000,000,414 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2012.06.22 14:17:08 | 000,000,600 | ---- | M] () -- C:\Users\test\AppData\Local\PUTTY.RND
[2012.06.14 15:00:52 | 000,032,383 | ---- | M] () -- C:\Users\test\Documents\Stellenangebot.pdf
[2012.06.08 17:54:45 | 525,827,763 | ---- | M] () -- C:\Users\test\Desktop\3.12 - Der Plan der Vianer.mp4
[2012.06.08 16:51:35 | 386,985,871 | ---- | M] () -- C:\Users\test\Desktop\3.14 - Wen die Götter zerstören.mp4
[2012.06.08 16:42:29 | 351,036,802 | ---- | M] () -- C:\Users\test\Desktop\3.13 - Brautschiff Enterprise.mp4
[2012.06.05 21:12:30 | 000,000,906 | ---- | M] () -- C:\Users\test\Desktop\Encoder - Verknüpfung.lnk
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.01 19:34:52 | 000,001,073 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.01 18:37:25 | 000,076,786 | ---- | C] () -- C:\Users\test\Documents\cc_20120701_183716.reg
[2012.06.30 18:42:33 | 351,036,802 | ---- | C] () -- C:\Users\test\Desktop\3.13 - Brautschiff Enterprise.mp4
[2012.06.30 18:42:20 | 525,827,763 | ---- | C] () -- C:\Users\test\Desktop\3.12 - Der Plan der Vianer.mp4
[2012.06.30 18:42:14 | 386,985,871 | ---- | C] () -- C:\Users\test\Desktop\3.14 - Wen die Götter zerstören.mp4
[2012.06.14 15:00:52 | 000,032,383 | ---- | C] () -- C:\Users\test\Documents\Stellenangebot.pdf
[2012.06.05 21:12:30 | 000,000,906 | ---- | C] () -- C:\Users\test\Desktop\Encoder - Verknüpfung.lnk
[2012.05.09 22:20:18 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.04.22 20:11:10 | 000,003,915 | ---- | C] () -- C:\Users\test\.recently-used.xbel
[2012.02.16 14:09:59 | 000,584,584 | ---- | C] () -- C:\Windows\adb.exe
[2011.12.21 19:53:22 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\AsIO.dll
[2011.12.21 19:53:22 | 000,013,440 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2011.12.21 19:53:21 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2011.12.21 19:53:21 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2011.11.27 14:57:36 | 000,000,092 | ---- | C] () -- C:\Users\test\AppData\Local\fusioncache.dat
[2011.11.22 22:40:32 | 000,000,426 | ---- | C] () -- C:\Windows\VICTORIA.INI
[2011.10.15 01:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.08.16 13:33:22 | 000,025,655 | ---- | C] () -- C:\Users\test\.jmf-resource
[2011.08.16 12:17:51 | 000,016,215 | ---- | C] () -- C:\Users\test\AppData\Roaming\ekiga.conf
[2011.08.01 23:19:41 | 000,007,606 | ---- | C] () -- C:\Users\test\AppData\Local\Resmon.ResmonCfg
[2011.07.17 18:58:13 | 000,281,656 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.07.17 18:58:02 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.07.12 14:02:16 | 000,232,496 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
[2011.05.26 00:38:51 | 000,182,784 | ---- | C] () -- C:\Windows\potrace.exe
[2011.05.26 00:38:51 | 000,046,592 | ---- | C] () -- C:\Windows\mkbitmap.exe
[2011.02.17 23:40:54 | 000,003,120 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2011.01.29 03:51:12 | 000,181,248 | ---- | C] () -- C:\Windows\dlhsetup.exe
[2011.01.29 03:51:12 | 000,026,015 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2011.01.13 21:39:13 | 000,037,639 | ---- | C] () -- C:\Windows\Irremote.ini
[2011.01.13 21:37:55 | 000,142,337 | ---- | C] () -- C:\Windows\SysWow64\Wait.exe
[2010.11.26 00:20:05 | 000,258,864 | ---- | C] () -- C:\Windows\SUPDRun.exe
[2010.11.22 23:26:23 | 000,004,980 | ---- | C] () -- C:\ProgramData\mxnhytee.feu
[2010.10.22 13:54:54 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2010.10.21 11:33:13 | 000,140,718 | ---- | C] () -- C:\Windows\JavaUpdater.exe
[2010.10.19 19:21:09 | 000,040,514 | ---- | C] () -- C:\Windows\DIIUnin.dat
[2010.10.12 10:48:04 | 000,000,600 | ---- | C] () -- C:\Users\test\AppData\Local\PUTTY.RND
[2010.09.16 22:57:34 | 000,819,200 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.09.16 22:57:34 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.09.05 22:35:04 | 000,000,170 | ---- | C] () -- C:\Windows\Sierra.ini
[2010.09.01 20:51:10 | 000,863,354 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.08.31 18:20:32 | 000,036,892 | ---- | C] () -- C:\Windows\SysWow64\bassmod.dll
[2010.08.30 12:23:08 | 000,000,507 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.08.30 12:23:07 | 000,001,657 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010.08.20 10:28:14 | 000,540,672 | ---- | C] () -- C:\Windows\_UnInst.exe
[2010.08.16 01:49:01 | 013,265,408 | ---- | C] () -- C:\Windows\ffmpeg.exe
[2010.08.15 15:21:26 | 000,315,444 | ---- | C] () -- C:\Windows\SysWow64\isdnapi32.dll
[2010.08.15 15:17:50 | 000,054,576 | ---- | C] () -- C:\Windows\SysWow64\AuerCapiJNINative.dll
[2010.08.15 15:17:28 | 000,054,576 | ---- | C] () -- C:\Windows\SysWow64\aucapjni.dll
[2010.08.10 10:07:06 | 000,080,896 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.08.07 01:29:29 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\GkSui18.EXE
[2010.07.21 17:43:31 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
 
========== LOP Check ==========
 
[2011.08.15 20:59:11 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\AmoK
[2012.06.10 16:28:40 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Audacity
[2012.04.11 23:18:34 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\avidemux
[2011.11.26 20:05:36 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Blink
[2011.11.01 21:32:54 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Coccinella
[2010.10.18 20:39:22 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Command and Conquer 4
[2010.11.23 23:21:45 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Cuttermaran
[2011.05.18 21:51:11 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\DAEMON Tools Lite
[2010.12.14 11:53:18 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\DVDVideoSoft
[2011.01.07 11:36:40 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\EssentialPIM
[2011.04.04 23:01:28 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Feedreader by netzwelt
[2012.07.01 18:36:48 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\FileZilla
[2012.05.14 19:58:03 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\fltk.org
[2012.06.10 16:16:52 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\FLV Extract
[2011.01.23 19:11:11 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\GetRightToGo
[2010.07.26 17:51:47 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\GHISLER
[2011.02.17 21:22:45 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Go!Zilla
[2012.04.25 15:14:35 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\GPAC
[2012.04.22 20:11:10 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\gtk-2.0
[2012.01.31 23:15:37 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\HandBrake
[2011.02.18 01:35:26 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\HD Tune Pro
[2012.01.25 22:15:48 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\HLSW
[2012.02.19 18:10:36 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\HTC
[2012.02.20 00:10:29 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012.01.25 22:16:02 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\inkscape
[2012.05.03 16:14:42 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\IrfanView
[2011.12.25 20:41:36 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Jaksta Streaming Media Recorder
[2011.08.16 13:33:36 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Jitsi
[2011.02.18 13:15:36 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Leadertech
[2010.07.21 00:41:26 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\LucasArts
[2010.07.20 21:52:54 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\MAXON
[2010.09.01 22:09:45 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Miranda
[2011.01.15 16:23:20 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\mkvtoolnix
[2012.03.17 21:34:17 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\MoreTerra
[2011.09.26 17:05:36 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\MPEG Streamclip
[2012.02.23 23:50:47 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\MyPhoneExplorer
[2011.08.16 12:34:36 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\NCH Swift Sound
[2012.06.12 22:51:34 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Nettalk
[2010.12.12 02:25:25 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Notepad++
[2011.06.06 19:59:40 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Opera
[2010.12.08 16:13:10 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Papyrus Autor
[2012.02.10 13:07:29 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Pencil
[2012.02.12 13:21:41 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\redsn0w
[2011.04.12 21:48:15 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\RipIt4Me
[2010.07.26 17:16:53 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\runic games
[2012.02.12 22:19:04 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Samsung
[2011.11.28 01:20:56 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\ScummVM
[2011.01.07 11:32:04 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\soft-evolution
[2011.02.17 22:11:37 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\SoftGrid Client
[2011.01.29 02:06:06 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\SynthFont
[2012.01.17 18:13:01 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Telefónica
[2011.04.09 16:13:50 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\TightVNC
[2011.01.17 13:06:48 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\TP
[2010.12.26 02:13:14 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\TrueCrypt
[2012.01.25 23:08:15 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\TS3Client
[2011.08.09 00:01:56 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\TuneUp Software
[2012.04.21 16:28:04 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Vodafone
[2011.02.06 01:48:42 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Wing 101 4
[2010.08.15 15:22:56 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\Wippien
[2010.09.01 21:00:51 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\xim
[2010.11.24 00:23:35 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\XMedia Recode
[2012.06.29 21:50:43 | 000,000,414 | ---- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job
[2012.01.25 23:10:48 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >