Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: ZeroAccess Trojaner in der Desktop.ini gefunden

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 12.08.2012, 17:45   #1
Patty80LE
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden



Hallo zusammen,

tjaa.. nun hab ichs mal wieder geschafft, habe mir nach Jahren ohne Probleme dummerweise doch wieder nen Trojaner eingefangen.
Es handelt sich laut McAffee um "ZeroAccess".
Wie die meisten bestimmt wissen verhindert er die Aktivierung der Firewall und macht noch so einige hässliche Probleme .
Wäre nett wenn mir jemand die Neuaufsetzung des Systems ersparen könnte ;-)

Hier die Logfile aus OTL:

OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 12.08.2012 12:49:16 - Run 1
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\Patty\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,98 Gb Total Physical Memory | 4,17 Gb Available Physical Memory | 69,64% Memory free
11,96 Gb Paging File | 9,02 Gb Available in Paging File | 75,39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 906,34 Gb Total Space | 463,66 Gb Free Space | 51,16% Space Free | Partition Type: NTFS
Drive D: | 56,98 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 3,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 1,57 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: PATTY-PC | User Name: Patty | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.12 12:47:35 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe
PRC - [2012.08.09 11:10:21 | 000,189,248 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrB.exe
PRC - [2012.08.09 11:10:10 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2012.07.10 14:18:38 | 000,561,544 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-Agent.exe
PRC - [2012.07.10 14:18:24 | 000,577,928 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-Frontend.exe
PRC - [2012.07.10 14:18:14 | 000,389,512 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-FileSystem.exe
PRC - [2012.07.10 14:18:10 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
PRC - [2012.07.10 14:17:36 | 000,389,512 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe
PRC - [2012.07.10 14:17:30 | 000,389,512 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-Network.exe
PRC - [2012.07.10 14:17:20 | 000,397,704 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-Service.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.06.06 21:33:42 | 001,564,872 | ---- | M] (Ask) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe
PRC - [2012.05.26 06:32:24 | 004,327,744 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\Patty\AppData\Local\Akamai\netsession_win.exe
PRC - [2012.04.03 18:24:34 | 000,160,840 | ---- | M] (Geek Software GmbH) -- C:\Program Files (x86)\PDF24\pdf24.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.10.03 08:30:32 | 000,098,304 | ---- | M] (Firebird Project) -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe
PRC - [2011.10.03 08:30:20 | 003,764,224 | ---- | M] (Firebird Project) -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe
PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011.04.09 10:12:08 | 003,520,000 | ---- | M] (sw4you, Siegfried Weckmann) -- C:\Program Files (x86)\Hardcopy\hardcopy.exe
PRC - [2011.03.18 09:11:51 | 000,031,744 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe
PRC - [2011.03.09 14:30:08 | 000,092,592 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2011.02.24 17:06:42 | 000,511,448 | ---- | M] (TomTom) -- C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe
PRC - [2011.02.17 11:04:12 | 000,863,744 | ---- | M] (Siliten) -- C:\Program Files (x86)\SilverCrest SOML 807 A1 Driver\MouClient_FD2_9063RL.exe
PRC - [2011.01.20 11:20:12 | 001,305,408 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
PRC - [2010.10.08 10:49:40 | 000,285,696 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe
PRC - [2010.09.13 19:32:32 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.09.13 19:32:30 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.09.09 12:19:08 | 000,265,216 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe
PRC - [2010.09.01 06:26:04 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PRC - [2010.08.30 00:07:34 | 000,096,752 | ---- | M] () -- C:\Program Files (x86)\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe
PRC - [2010.01.21 08:40:59 | 000,040,960 | ---- | M] () -- C:\Windows\SysWOW64\UMonit.exe
PRC - [2009.12.04 17:59:28 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
PRC - [2009.09.30 12:19:30 | 000,049,152 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Power Dial\LenovoCOMSvc.exe
PRC - [2009.07.16 10:05:10 | 000,114,688 | ---- | M] (JME) -- C:\Program Files (x86)\jmesoft\hotkey.exe
PRC - [2006.11.03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\Pac207\Monitor.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.07.29 18:01:20 | 014,050,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\DevComponents.DotNe#\544559a292ef9299f4588196686a1f8d\DevComponents.DotNetBar2.ni.dll
MOD - [2012.07.29 18:01:14 | 000,524,288 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\HD-Agent\75b3ede095d4e2da81b07e3ce3dace9b\HD-Agent.ni.exe
MOD - [2012.07.29 18:01:13 | 001,443,328 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\NAudio\804c2927f990fe8e289316cefbabdb77\NAudio.ni.dll
MOD - [2012.07.29 18:01:12 | 000,634,880 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\HD-Frontend\d555bc9eae963abfcb687c3c506bf352\HD-Frontend.ni.exe
MOD - [2012.07.29 18:01:10 | 000,155,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\JSON\bc16a8709a5bb402e422287af4bc56be\JSON.ni.dll
MOD - [2012.06.14 03:35:48 | 001,670,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\3eaec5bc57c67c3b24ca2bb281ca249d\Microsoft.VisualBasic.ni.dll
MOD - [2012.06.14 03:35:19 | 000,475,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\4aa3b127a59b6c1cd3b8749ea972771f\IAStorUtil.ni.dll
MOD - [2012.06.14 03:31:43 | 000,212,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8b7a7f9c607e09bfa03c07b5ff3a8ae3\System.ServiceProcess.ni.dll
MOD - [2012.06.14 03:31:39 | 011,824,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll
MOD - [2012.06.14 03:31:30 | 014,325,760 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\517358eb2fd962a942dd1ea6afc5b93e\PresentationFramework.ni.dll
MOD - [2012.06.14 03:31:21 | 012,433,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll
MOD - [2012.06.14 03:31:17 | 001,591,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll
MOD - [2012.06.14 03:31:16 | 012,218,880 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\e9d0ba41128f363f2390c7e630129c2b\PresentationCore.ni.dll
MOD - [2012.05.10 03:38:10 | 000,997,888 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\3f9dee1ce0ccb42145293a5bfcbe7205\System.Management.ni.dll
MOD - [2012.05.10 03:38:10 | 000,014,336 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\1a4c0f7ba90a13c246a90a579552935a\IAStorCommon.ni.dll
MOD - [2012.05.10 03:35:39 | 000,368,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\fc626095c194be137bceb219934b06a7\PresentationFramework.Aero.ni.dll
MOD - [2012.05.10 03:35:29 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll
MOD - [2012.05.10 03:35:01 | 003,325,952 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b68fdf2c95b93fc5006a092c11eed07c\WindowsBase.ni.dll
MOD - [2012.05.10 03:35:00 | 000,680,960 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\61af058c2bc079f28397a29ed145fbc7\System.Security.ni.dll
MOD - [2012.05.10 03:34:58 | 005,453,312 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll
MOD - [2012.05.10 03:34:56 | 007,952,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll
MOD - [2012.05.10 03:34:56 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll
MOD - [2012.05.10 03:34:52 | 011,490,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll
MOD - [2011.04.09 10:11:53 | 002,920,960 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\HcDllS.dll
MOD - [2011.03.18 09:11:51 | 000,031,744 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe
MOD - [2011.02.24 17:06:44 | 000,161,240 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\TomTomSupporterProxy.dll
MOD - [2011.02.24 17:06:44 | 000,047,576 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\TomTomSupporterBase.dll
MOD - [2011.02.24 17:06:34 | 007,508,480 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtGui4.dll
MOD - [2011.02.24 17:06:34 | 002,101,760 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtCore4.dll
MOD - [2011.02.24 17:06:34 | 000,911,872 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtNetwork4.dll
MOD - [2011.02.24 17:06:34 | 000,334,848 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtXml4.dll
MOD - [2010.09.30 10:14:19 | 000,055,296 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\hardcopy_03.dll
MOD - [2010.09.20 19:55:52 | 000,182,272 | ---- | M] () -- C:\Programme\Lenovo\Lenovo Brightness System\ddcHelperWraper.dll
MOD - [2010.09.20 11:08:10 | 000,210,432 | ---- | M] () -- C:\Programme\Lenovo\Lenovo Brightness System\KeyStoneAdapter.dll
MOD - [2010.09.09 12:19:30 | 000,210,432 | ---- | M] () -- C:\Programme\Lenovo\Lenovo Eye Distance System\KeyStoneAdapter.dll
MOD - [2010.09.09 12:18:58 | 000,211,456 | ---- | M] () -- C:\Programme\Lenovo\Lenovo Eye Distance System\VideoPlayer.dll
MOD - [2010.09.03 14:31:36 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\SilverCrest SOML 807 A1 Driver\UniFunc.dll
MOD - [2010.04.21 11:00:35 | 000,058,368 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\HcDLL2_30_Win32.dll
MOD - [2010.01.21 08:40:59 | 000,040,960 | ---- | M] () -- C:\Windows\SysWOW64\UMonit.exe
MOD - [2009.12.04 18:04:32 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
MOD - [2009.12.04 17:59:54 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
MOD - [2009.10.26 09:52:38 | 000,139,264 | ---- | M] () -- C:\Windows\SysWOW64\ustor.dll
MOD - [2009.09.14 08:00:24 | 000,208,896 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2009.09.14 08:00:17 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.07.16 10:20:38 | 000,032,768 | ---- | M] () -- C:\Program Files (x86)\jmesoft\Keyhook.dll
MOD - [2009.07.14 03:15:51 | 000,232,448 | ---- | M] () -- \\?\globalroot\systemroot\syswow64\mswsock.DLL
MOD - [2009.07.14 03:15:51 | 000,232,448 | ---- | M] () -- \\.\globalroot\systemroot\syswow64\mswsock.dll
MOD - [2007.12.31 11:27:42 | 000,007,168 | ---- | M] () -- C:\Program Files (x86)\jmesoft\VistaVolume.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012.07.20 19:49:54 | 009,705,984 | ---- | M] () [Auto | Stopped] -- C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe -- (MySQL55)
SRV:64bit: - [2012.05.25 17:13:54 | 000,162,224 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Windows\SysNative\mfevtps.exe -- (mfevtp)
SRV:64bit: - [2012.05.25 16:59:02 | 000,210,616 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV:64bit: - [2012.05.25 16:58:32 | 000,199,304 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McProxy)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service)
SRV - [2012.08.09 11:10:21 | 000,189,248 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2012.08.09 11:10:10 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.08.07 00:07:41 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.07.10 20:31:31 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai)
SRV - [2012.07.10 14:18:10 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc)
SRV - [2012.07.10 14:17:20 | 000,397,704 | ---- | M] (BlueStack Systems, Inc.) [On_Demand | Running] -- C:\Program Files (x86)\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.04.19 08:22:48 | 000,502,032 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.10.03 08:30:32 | 000,098,304 | ---- | M] (Firebird Project) [Auto | Running] -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance)
SRV - [2011.10.03 08:30:20 | 003,764,224 | ---- | M] (Firebird Project) [On_Demand | Running] -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe -- (FirebirdServerDefaultInstance)
SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.07.05 11:20:12 | 002,428,968 | ---- | M] (mobile concepts GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\CyberGhost VPN\CGVPNCliService.exe -- (CGVPNCliSrvc)
SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011.03.09 14:30:08 | 000,092,592 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2011.03.01 18:29:58 | 000,130,976 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)
SRV - [2010.09.29 18:47:00 | 004,032,992 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.13 19:32:32 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.09.09 12:46:14 | 000,081,920 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Programme\Lenovo\Power Dial\LitModeCtrl.exe -- (LitModeCtrl)
SRV - [2010.08.30 00:07:34 | 000,096,752 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe -- (CEEBC40A-FDED-4C59-B354-939132350B01)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.09.30 12:19:30 | 000,049,152 | ---- | M] (Lenovo) [Auto | Running] -- C:\Programme\Lenovo\Power Dial\LenovoCOMSvc.exe -- (LenovoCOMSvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.22 13:29:46 | 000,647,208 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)
DRV:64bit: - [2012.02.22 13:29:46 | 000,487,296 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek)
DRV:64bit: - [2012.02.22 13:29:46 | 000,289,664 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk)
DRV:64bit: - [2012.02.22 13:29:46 | 000,229,528 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)
DRV:64bit: - [2012.02.22 13:29:46 | 000,160,792 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk)
DRV:64bit: - [2012.02.22 13:29:46 | 000,100,912 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mferkdet.sys -- (mferkdet)
DRV:64bit: - [2012.02.22 13:29:46 | 000,075,936 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfenlfk.sys -- (mfenlfk)
DRV:64bit: - [2012.02.22 13:29:46 | 000,065,264 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids)
DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.05.30 14:02:12 | 000,046,112 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tbhsd.sys -- (tbhsd)
DRV:64bit: - [2011.05.08 16:20:10 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.04.28 12:00:32 | 001,310,720 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CM10664.sys -- (USBMULCD)
DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.11.12 01:10:49 | 000,155,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2010.10.20 10:58:44 | 000,015,360 | ---- | M] (Siliten) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MouFilter_FlexDef4.sys -- (MouFilter_Mou_FlexDef4)
DRV:64bit: - [2010.09.21 08:34:18 | 000,313,520 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress)
DRV:64bit: - [2010.09.21 03:59:38 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.09.13 19:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.06.19 08:36:04 | 000,017,920 | ---- | M] (Siliten) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\InputFilter_FlexDef2b.sys -- (InputFilter_Hid_FlexDef2b)
DRV:64bit: - [2010.02.25 18:51:02 | 000,029,696 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)
DRV:64bit: - [2010.02.22 04:49:58 | 000,052,224 | ---- | M] (Genesys Logic) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ustor2k.sys -- (USTOR2K)
DRV:64bit: - [2009.12.01 15:49:52 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2009.07.21 15:20:06 | 000,121,840 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2009.07.14 15:36:28 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009.07.13 23:59:33 | 005,020,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.07.01 11:54:54 | 000,030,728 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LGPBTDD.sys -- (LGPBTDD)
DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 22:35:53 | 000,051,712 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rtnic64.sys -- (RTL8023x64)
DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer)
DRV:64bit: - [2008.04.08 07:43:04 | 000,020,832 | ---- | M] (Nicomsoft Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ddcdrv.sys -- (WinI2C-DDC)
DRV:64bit: - [2006.12.05 11:34:26 | 000,572,416 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PFC027.SYS -- (PAC207)
DRV:64bit: - [2006.09.19 15:43:54 | 000,018,224 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2012.07.10 14:18:02 | 000,075,144 | ---- | M] (BlueStack Systems) [Kernel | Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys -- (BstHdDrv)
DRV - [2010.03.22 19:13:08 | 000,015,712 | ---- | M] (Nicomsoft Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysWOW64\drivers\ddcdrv.sys -- (WinI2C-DDC)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2004.12.31 08:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.bearshare.com/
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{BB0E13C0-0E3B-4F5F-B31B-48697D1BA5AA}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=HIP&o=102875&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=6F&apn_dtid=YYYYYYYYDE&apn_uid=434a70d5-6584-4c56-9114-95d72b6672f1&apn_sauid=689AA487-0083-4700-8AE2-C6C3A6F3E2E7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=;ftp=;https=;
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=102875&gct=hp"
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.3&q="
FF - prefs.js..network.proxy.gopher: ""
FF - prefs.js..network.proxy.gopher_port: 0
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~2\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.9: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Users\Patty\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Nightly 17.0a1\extensions\\Components: C:\PROGRAM FILES\NIGHTLY\COMPONENTS [2012.08.09 15:17:30 | 000,000,000 | ---D | M]
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Nightly 17.0a1\extensions\\Plugins: C:\PROGRAM FILES\NIGHTLY\PLUGINS
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore [2012.07.19 16:23:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2012.08.11 17:41:21 | 000,000,000 | ---D | M]
 
[2011.04.11 17:54:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Extensions
[2011.04.11 17:54:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
[2012.08.05 22:17:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions
[2012.07.25 21:29:41 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.06.12 20:18:27 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.03.30 02:42:30 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.07.17 22:09:05 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\toolbar@ask.com
[2012.07.17 22:09:05 | 000,002,325 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\askcom.xml
[2012.08.08 21:04:46 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-1.xml
[2011.10.30 14:47:09 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-10.xml
[2011.11.02 22:10:31 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-11.xml
[2011.11.10 18:49:21 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-12.xml
[2011.12.07 20:16:25 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-13.xml
[2011.12.23 16:57:23 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-14.xml
[2011.12.29 22:06:52 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-15.xml
[2012.02.03 21:54:08 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-16.xml
[2012.02.09 21:06:57 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-17.xml
[2011.08.11 04:23:30 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-2.xml
[2011.08.19 16:46:11 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-3.xml
[2011.09.03 13:08:10 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-4.xml
[2011.09.04 14:32:11 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-5.xml
[2011.09.13 04:30:28 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-6.xml
[2011.09.18 06:24:58 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-7.xml
[2011.10.12 19:53:18 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-8.xml
[2011.10.20 21:34:39 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-9.xml
[2011.07.25 01:19:29 | 000,001,056 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin.xml
[2012.02.09 21:02:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.10.12 16:14:05 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.08.05 22:17:28 | 000,314,397 | ---- | M] () (No name found) -- C:\USERS\PATTY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JGZY3W0Y.DEFAULT\EXTENSIONS\{C50CA3C4-5656-43C2-A061-13E717F73FC8}.XPI
[2011.04.14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
[2011.03.17 21:57:30 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Common Files\mcafee\systemcore\ScriptSn.20120719162333.dll (McAfee, Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120719162333.dll (McAfee, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [Cm106Sound] C:\windows\Syswow64\cm106.dll (C-Media Corporation)
O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [UMonit] C:\Windows\SysWOW64\UMonit.exe ()
O4:64bit: - HKLM..\Run: [Unattend0000000001{BFA3D12B-66DD-4617-923A-E864BC7D20B5}] C:\Windows\test.bat File not found
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [jmekey] C:\Program Files (x86)\jmesoft\hotkey.exe (JME)
O4 - HKLM..\Run: [Launch SilverCrest SOML 807 A1] C:\Program Files (x86)\SilverCrest SOML 807 A1 Driver\MouClient_FD2_9063RL.exe (Siliten)
O4 - HKLM..\Run: [Lenovo Dynamic Brightness System] C:\Program Files\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe (Lenovo)
O4 - HKLM..\Run: [Lenovo Eye Distance System] C:\Program Files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe (Lenovo)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [ModeSwitch] C:\Program Files\Lenovo\Power Dial\LitModeSwitch.exe (Lenovo)
O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Patty\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [MyTomTomSA.exe] C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe (TomTom)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam2\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - Startup: C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK = C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{47052FC8-237A-4868-A7AD-EF5D2AF3A5F8}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.04.28 12:00:35 | 000,000,038 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2011.09.25 19:27:45 | 000,000,098 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2010.08.25 22:57:19 | 000,000,070 | R--- | M] () - G:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell - "" = AutoRun
O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2011.09.25 19:27:45 | 003,811,542 | R--- | M] (RailSimulator.com                                           )
O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell - "" = AutoRun
O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell\AutoRun\command - "" = F:\autorun.exe
O33 - MountPoints2\{fee118cd-5d70-11e0-9680-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fee118cd-5d70-11e0-9680-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Setup.exe -- [2011.04.28 12:00:30 | 000,930,544 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.12 12:47:35 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe
[2012.08.12 12:42:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{43788298-41EE-4C8F-93F5-AFA140732A1A}
[2012.08.12 12:42:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CDA71FB9-9609-4782-BEDD-454E9D35A85E}
[2012.08.12 12:17:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012.08.12 06:26:10 | 000,000,000 | ---D | C] -- C:\ProgramData\A2AC
[2012.08.11 22:30:50 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C4169238-5F16-4C58-9E78-7844607B1626}
[2012.08.11 22:30:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{10422F33-6829-4482-8025-37F4E70B1147}
[2012.08.11 20:45:38 | 000,016,200 | ---- | C] (McAfee, Inc.) -- C:\windows\stinger.sys
[2012.08.11 20:45:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\stinger
[2012.08.11 20:20:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firestorm-Release
[2012.08.11 18:16:28 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Malwarebytes
[2012.08.11 18:16:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.11 18:16:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.11 18:16:11 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012.08.11 18:16:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.11 17:51:58 | 000,027,256 | ---- | C] (Symantec Corporation) -- C:\windows\SysNative\drivers\FixZeroAccess.sys
[2012.08.11 17:25:26 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\SpacialAudio
[2012.08.11 05:50:18 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{0784EFAA-C5F6-41F1-9739-BC9F188BA877}
[2012.08.11 05:50:07 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{644D5883-53A7-43C8-84FB-BB16238D36E4}
[2012.08.10 17:49:55 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{77ACB6B2-1CFD-40F2-8DBE-791EA1EBD762}
[2012.08.10 17:49:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4829B077-9FF2-4EAC-A9FA-C083A8923AEF}
[2012.08.09 20:54:58 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SAM Broadcaster
[2012.08.09 20:53:45 | 000,548,864 | ---- | C] (Firebird Project) -- C:\windows\SysWow64\GDS32.DLL
[2012.08.09 20:53:45 | 000,548,864 | ---- | C] (Firebird Project) -- C:\windows\SysWow64\FBCLIENT.DLL
[2012.08.09 20:53:40 | 000,462,848 | ---- | C] (IBPhoenix) -- C:\windows\SysWow64\Firebird2Control.cpl
[2012.08.09 20:53:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firebird 2.5 (Win32)
[2012.08.09 19:06:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MySQL
[2012.08.09 17:32:21 | 000,000,000 | ---D | C] -- C:\windows\SysWow64\RTCOM
[2012.08.09 17:32:12 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\windows\SysNative\SRSTSX64.dll
[2012.08.09 17:32:12 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\windows\SysNative\SRSTSH64.dll
[2012.08.09 17:32:12 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\windows\SysNative\SRSHP64.dll
[2012.08.09 17:32:12 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\windows\SysNative\SRSWOW64.dll
[2012.08.09 17:32:11 | 002,018,920 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RtPgEx64.dll
[2012.08.09 17:32:11 | 001,210,984 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RTCOM64.dll
[2012.08.09 17:32:11 | 001,146,984 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RTSnMg64.cpl
[2012.08.09 17:32:11 | 000,476,264 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RtkApi64.dll
[2012.08.09 17:32:11 | 000,372,936 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RTEEP64A.dll
[2012.08.09 17:32:11 | 000,332,392 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RtlCPAPI64.dll
[2012.08.09 17:32:11 | 000,307,920 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RP3DHT64.dll
[2012.08.09 17:32:11 | 000,307,920 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RP3DAA64.dll
[2012.08.09 17:32:11 | 000,201,928 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RTEED64A.dll
[2012.08.09 17:32:11 | 000,149,608 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RtkCfg64.dll
[2012.08.09 17:32:11 | 000,099,016 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RTEEL64A.dll
[2012.08.09 17:32:11 | 000,076,904 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RCoInst64.dll
[2012.08.09 17:32:11 | 000,076,488 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RTEEG64A.dll
[2012.08.09 17:32:09 | 000,330,656 | ---- | C] (Fortemedia Corporation) -- C:\windows\SysNative\FMAPO64.dll
[2012.08.09 17:32:08 | 000,168,288 | ---- | C] (Andrea Electronics Corporation) -- C:\windows\SysNative\AERTAC64.dll
[2012.08.09 17:32:08 | 000,108,960 | ---- | C] (Andrea Electronics Corporation) -- C:\windows\SysNative\AERTAR64.dll
[2012.08.09 17:32:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2012.08.09 17:32:06 | 001,251,944 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\RtlExUpd.dll
[2012.08.09 17:26:49 | 000,000,000 | ---D | C] -- C:\Drivers
[2012.08.09 17:04:59 | 000,000,000 | -H-D | C] -- C:\Lenovo
[2012.08.09 16:32:16 | 000,000,000 | ---D | C] -- C:\download
[2012.08.09 16:08:09 | 000,200,704 | ---- | C] (C-Media) -- C:\windows\SysWow64\cmpa106.dll
[2012.08.09 16:07:38 | 001,310,720 | ---- | C] (C-Media Electronics Inc) -- C:\windows\SysNative\drivers\CM10664.sys
[2012.08.09 16:07:38 | 000,315,392 | ---- | C] (C-Media Electronics Inc.) -- C:\windows\System\fltr106.dll
[2012.08.09 16:00:30 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\MySQL
[2012.08.09 15:50:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MySQL
[2012.08.09 15:50:06 | 000,000,000 | ---D | C] -- C:\Program Files\MySQL
[2012.08.09 15:45:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MySQL
[2012.08.09 15:45:57 | 000,000,000 | ---D | C] -- C:\ProgramData\MySQL
[2012.08.09 15:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Recorder Pro
[2012.08.09 15:30:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audio Recorder Pro
[2012.08.09 15:19:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SpacialAudio
[2012.08.09 14:21:27 | 008,757,248 | ---- | C] (C-Media Corporation) -- C:\windows\SysWow64\CM106.dll
[2012.08.09 14:19:06 | 000,524,768 | R--- | C] (Microsoft Corporation) -- C:\windows\difxapi.dll
[2012.08.09 11:02:36 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{50D3CD2F-5BBD-4AEB-9F4D-D0FD715938B6}
[2012.08.09 11:02:23 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C52C50E4-B394-4C78-9B63-EE1DCC4A1748}
[2012.08.08 16:51:15 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{67AE11BC-0FA1-4FE9-9D77-A929C16A50DA}
[2012.08.08 16:51:05 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5B3F7AF5-9622-49BC-978C-1DFC8FE167DC}
[2012.08.08 04:50:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2DE48A7F-13FA-4B3C-867A-B5BED8D89584}
[2012.08.08 04:50:38 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EB2430D0-09F2-4E7D-AC17-C596C5A10753}
[2012.08.07 16:50:25 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{902A8010-2BC0-4E14-8D56-52B786DCED97}
[2012.08.07 16:50:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{537784A7-F7C9-40B0-B2A9-35F7E49F7EEB}
[2012.08.07 04:49:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{B22EC84C-C099-4204-A814-A18A458B8848}
[2012.08.07 04:49:39 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C12CB901-8C4B-4C59-B76B-BA18B51DEC2A}
[2012.08.06 17:32:41 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Quest3D
[2012.08.06 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\Documents\ShipSimExtremes Userdata
[2012.08.06 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Roaming
[2012.08.06 14:17:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paradox Interactive
[2012.08.06 14:13:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Paradox Interactive
[2012.08.06 12:14:42 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5A103BE2-412A-4173-94DC-C862626DB820}
[2012.08.06 12:14:32 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{9FD4CA43-867E-4AC6-AD33-B24F3A5515BC}
[2012.08.06 00:14:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{80060651-833A-40A4-B494-3334B2C965F3}
[2012.08.06 00:14:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C1A30172-67EE-4408-8E58-B9AEB4F9677D}
[2012.08.05 21:20:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\SKIDROW
[2012.08.05 21:17:27 | 000,000,000 | ---D | C] -- C:\Users\Patty\Desktop\Railworks.3.Train.Simulator.2012.Deluxe.Update.1.and.2-SKIDROW
[2012.08.05 17:17:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RailSimulator.com
[2012.08.05 17:05:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RailSimulator.com
[2012.08.05 15:27:12 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\GamersFirst LIVE!
[2012.08.05 15:26:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GamersFirst
[2012.08.05 15:26:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GamersFirst
[2012.08.05 12:13:54 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{03FD720F-DBF9-401B-8189-B4261869619C}
[2012.08.05 12:13:44 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5CB3ED4C-F39C-4B0D-A543-02C55297BEEC}
[2012.08.05 06:23:43 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\MusicNet
[2012.08.05 06:23:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\Documents\My Received Files
[2012.08.05 06:23:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\BearShare
[2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BearShare Applications
[2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BearShare
[2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\ProgramData\BearShare
[2012.08.05 06:22:11 | 000,000,000 | -H-D | C] -- C:\ProgramData\{D79D348D-B804-455D-BF34-7E3989C8E84D}
[2012.08.04 23:04:02 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{08D5B1B0-1FF4-4217-89D8-6D5A547F9A90}
[2012.08.04 23:03:52 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CA4E7870-57B6-4EE8-8AB7-C4AB8E20EF0F}
[2012.08.04 11:03:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4D6D8287-0E4E-4567-9C9A-9A6673AED2FA}
[2012.08.04 11:03:26 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5716A376-6562-40E7-8DAA-E80653258772}
[2012.08.03 22:11:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{E2A6B2BB-5165-47F7-81AA-E8A006577E27}
[2012.08.03 22:11:21 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F656B47B-DF56-4D13-BFEF-4F5A9F68E0D0}
[2012.08.03 10:11:04 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2F8186E0-6AA5-4D6C-AF02-BE2FA4A1C64D}
[2012.08.03 10:10:54 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D96B8060-E668-4431-AFF7-66D0EFF62369}
[2012.08.02 11:40:19 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{654C4470-7FE1-4437-A839-57ECB2E26E2D}
[2012.08.02 11:40:09 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{9B3B93E1-8BBA-4B62-A032-1C5483A1D256}
[2012.08.01 18:44:47 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D70A40D9-3417-4B1C-AE92-15F8E591EDB3}
[2012.08.01 18:44:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{369E81AD-2CD6-4B11-A78B-8BDDD055D357}
[2012.08.01 10:50:53 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Apple Computer
[2012.07.31 14:27:17 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{AE30EF49-1B32-4C60-B0FD-AF1B4713DEDF}
[2012.07.31 14:27:07 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4588A487-460C-4323-B9C6-34CA4AE3F1B3}
[2012.07.31 07:52:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012.07.31 07:52:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2012.07.31 07:52:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2012.07.31 07:49:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2012.07.31 02:26:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{06EC3F31-BDA1-47F1-9170-24201BCC7E6C}
[2012.07.31 02:26:27 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{DA00BCF8-7CE7-4C2F-B00B-DAEEA95FAE9A}
[2012.07.30 14:26:09 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{33A1E426-B16E-4A42-A223-E0F4CC3F8F1E}
[2012.07.30 14:25:59 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D71F5E38-247B-4C63-A710-38AC32792AD2}
[2012.07.29 17:59:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\BlueStacks
[2012.07.29 17:59:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks
[2012.07.29 17:59:14 | 000,000,000 | ---D | C] -- C:\ProgramData\BlueStacks
[2012.07.29 17:59:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BlueStacks
[2012.07.28 19:51:46 | 000,000,000 | ---D | C] -- C:\Crash
[2012.07.28 19:35:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{0E185A8E-C61F-4694-A000-EDAA89F61D13}
[2012.07.28 19:35:35 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{225EC41F-97C4-4DF3-B99B-99ED02249A81}
[2012.07.28 06:35:59 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5387AD95-8366-4B9A-B4A5-2A59E3963F53}
[2012.07.28 06:35:48 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8F59DF63-E9E1-406C-9FD5-282BDE3E9F85}
[2012.07.27 18:35:32 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{459A40FA-767F-46B0-82FC-E779BB93FC5B}
[2012.07.27 18:35:21 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D456A8CD-D8C6-43E3-9232-AE45215172C7}
[2012.07.26 18:17:21 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5FD79D4C-E90D-4807-A795-859DD2BDD5EE}
[2012.07.26 18:17:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{93AB20D9-B6CD-4E61-BCD4-7F813277F7D8}
[2012.07.25 18:19:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{67C86C0C-D5BC-46D7-A2B3-A721DAF52EB1}
[2012.07.25 18:19:00 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2C003E68-58E2-4C7D-8539-936EBA7CCCDD}
[2012.07.24 20:25:58 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{1DDF11B6-D3BA-4B6C-89A6-1DA65F55D0E4}
[2012.07.24 20:25:48 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{33C50227-FE70-4051-BF0C-2927C51B35CA}
[2012.07.24 07:26:29 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F6A40DB3-DB4C-4C9E-A3D2-19EC57FBBE64}
[2012.07.24 07:26:19 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{44DABC9B-1B18-4C56-AA87-2B8C96E21D85}
[2012.07.22 04:13:58 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{363696BF-8702-4C39-ACF0-95327C4B0AB6}
[2012.07.22 04:13:47 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CE4D98A1-92F9-485A-991A-21E90C5E2DDC}
[2012.07.21 16:13:35 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{ED5665C7-8564-4DC5-9C4D-9CB00ACBF898}
[2012.07.21 16:13:25 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{91111455-DA4A-4E46-9EC9-5B5CE872FF61}
[2012.07.20 19:33:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C2D290B3-0BA1-4CD0-A775-55C85370EBA3}
[2012.07.20 19:33:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EC626A97-5C24-429F-A209-AADF94DE3DD8}
[2012.07.20 03:17:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5B781F55-2AFA-4C47-B0B3-4A8386C784BD}
[2012.07.20 03:17:03 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C6B8F56A-11E2-437B-858F-1F464E828374}
[2012.07.19 17:15:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Firestorm-Release
[2012.07.19 16:23:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee.com
[2012.07.19 16:23:33 | 000,010,248 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mfeclnk.sys
[2012.07.19 16:23:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\McAfee
[2012.07.19 16:23:25 | 000,487,296 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mfefirek.sys
[2012.07.19 16:23:25 | 000,289,664 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mfewfpk.sys
[2012.07.19 16:23:25 | 000,229,528 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mfeavfk.sys
[2012.07.19 16:23:25 | 000,100,912 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mferkdet.sys
[2012.07.19 16:23:25 | 000,075,936 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mfenlfk.sys
[2012.07.19 16:23:25 | 000,065,264 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\cfwids.sys
[2012.07.19 16:23:16 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee.com
[2012.07.19 16:23:16 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee
[2012.07.19 16:17:41 | 000,162,224 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\mfevtps.exe
[2012.07.19 15:16:39 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{84FBB7AE-DADD-4B7A-8945-6D40AA759C38}
[2012.07.19 15:16:29 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{B6593ADA-5D5F-4BD5-84F1-6233CA68B460}
[2012.07.18 18:26:02 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{6040063C-31F3-4AD6-B368-DB00DD47C0DE}
[2012.07.18 18:25:52 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{B6EB9AEA-367E-4FC3-8229-C4CCA2A420AE}
[2012.07.17 16:36:30 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{A773E046-7EA8-4C01-A760-FD9B7C3B4818}
[2012.07.17 16:36:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5B00EBB7-EC99-4102-BF91-AE13BA088AFB}
[2012.07.16 22:22:43 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CAC0F8BD-E0CE-48D1-B12C-007B11CF5F9E}
[2012.07.16 22:22:33 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F30B0B73-6BDE-45CB-99A8-414979B4ACFE}
[2012.07.16 10:22:22 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8D54D450-B2C0-4B92-9B10-9CE601D242DC}
[2012.07.16 10:22:12 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5B418410-477B-4E12-9B08-95291EA03AAE}
[2012.07.15 16:11:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8C494765-A4BC-4D08-B3D9-8D76B6D96937}
[2012.07.15 16:11:21 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{170C644D-0935-47F4-912F-07FE2899C7A9}
[2012.07.15 04:11:08 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2797F96B-C298-4438-A3F5-875CEA49AF9C}
[2012.07.15 04:10:58 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{1E4AD127-9FEE-46B9-95C7-75471180BB5D}
[2012.07.14 16:54:34 | 000,620,822 | ---- | C] (Macromedia, Inc.) -- C:\Users\Patty\Desktop\fluchomat.exe
[2012.07.14 16:10:44 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{880659AD-3C60-4D2F-95FF-BCB5D356924D}
[2012.07.14 16:10:34 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{A8CF678A-D8C2-4BB6-8BF1-133D6FABCC28}
[2012.07.13 17:39:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CC572CFF-D4DC-4628-AD31-4EDBC9DF336D}
[2012.07.13 17:39:39 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CB3C7443-5939-442A-85DF-B0A0B334F349}
[2010.12.17 04:20:16 | 001,914,000 | ---- | C] (Adobe Systems Incorporated) -- C:\ProgramData\flashax10.exe
[1 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.12 12:48:57 | 000,000,168 | ---- | M] () -- C:\Users\Patty\defogger_reenable
[2012.08.12 12:47:35 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe
[2012.08.12 12:47:22 | 000,050,477 | ---- | M] () -- C:\Users\Patty\Desktop\Defogger.exe
[2012.08.12 12:26:00 | 000,001,108 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.12 12:17:35 | 000,001,828 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Internet Security Suite.lnk
[2012.08.12 12:15:32 | 000,001,104 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.12 12:15:11 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.08.12 06:26:18 | 000,011,776 | ---- | M] () -- C:\Users\Patty\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.08.12 03:58:56 | 000,215,763 | ---- | M] () -- C:\Users\Patty\Desktop\Leck mich.jpg
[2012.08.12 03:56:56 | 003,145,746 | ---- | M] () -- C:\Users\Patty\Desktop\Leck mich.tga
[2012.08.11 21:10:25 | 000,017,360 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.11 21:10:25 | 000,017,360 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.11 21:03:00 | 523,132,927 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.11 20:45:38 | 000,016,200 | ---- | M] (McAfee, Inc.) -- C:\windows\stinger.sys
[2012.08.11 20:20:18 | 000,001,321 | ---- | M] () -- C:\Users\Public\Desktop\Firestorm-Release.lnk
[2012.08.11 19:28:01 | 001,501,666 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012.08.11 19:28:01 | 000,655,070 | ---- | M] () -- C:\windows\SysNative\perfh007.dat
[2012.08.11 19:28:01 | 000,616,952 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012.08.11 19:28:01 | 000,130,394 | ---- | M] () -- C:\windows\SysNative\perfc007.dat
[2012.08.11 19:28:01 | 000,106,784 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012.08.11 18:16:19 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.11 17:58:54 | 000,027,256 | ---- | M] (Symantec Corporation) -- C:\windows\SysNative\drivers\FixZeroAccess.sys
[2012.08.11 17:38:19 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerApp.exe
[2012.08.11 17:38:18 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.08.11 17:22:23 | 000,002,043 | ---- | M] () -- C:\Users\Patty\Desktop\SAM Broadcaster.lnk
[2012.08.09 21:41:00 | 023,393,101 | ---- | M] () -- C:\Users\Patty\Desktop\sambc-fb-v492.exe
[2012.08.09 21:39:03 | 000,128,512 | ---- | M] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.9.2-RES-patch.exe
[2012.08.09 18:14:48 | 000,076,813 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt444444.wma
[2012.08.09 18:11:48 | 000,000,784 | ---- | M] () -- C:\windows\Cm106.ini.cfl
[2012.08.09 18:11:43 | 000,000,133 | ---- | M] () -- C:\windows\System\Dlap.pfx
[2012.08.09 18:11:42 | 000,001,189 | ---- | M] () -- C:\windows\Cm106.ini.imi
[2012.08.09 18:11:38 | 000,001,138 | ---- | M] () -- C:\windows\System\Cm106.ini
[2012.08.09 17:47:06 | 000,049,873 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt222.wma
[2012.08.09 17:43:27 | 000,103,753 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt1111.wma
[2012.08.09 17:30:08 | 000,045,383 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt5678.wma
[2012.08.09 17:04:58 | 000,002,175 | ---- | M] () -- C:\Users\Patty\Desktop\Lenovo Rescue System.lnk
[2012.08.09 17:03:51 | 000,072,323 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt4567.wma
[2012.08.09 16:57:07 | 000,067,833 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt3456.wma
[2012.08.09 16:53:13 | 000,085,793 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt2345.wma
[2012.08.09 16:49:32 | 000,274,373 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt1234.wma
[2012.08.09 16:47:30 | 000,103,753 | ---- | M] () -- C:\Users\Patty\Documents\Test123.wma
[2012.08.09 16:03:29 | 000,294,032 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2012.08.09 15:51:33 | 001,528,528 | ---- | M] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2012.08.09 15:50:58 | 000,000,238 | ---- | M] () -- C:\windows\ODBCINST.INI
[2012.08.09 15:30:23 | 000,000,997 | ---- | M] () -- C:\Users\Patty\Desktop\Audio Recorder Pro.lnk
[2012.08.09 11:10:21 | 000,189,248 | ---- | M] () -- C:\windows\SysWow64\PnkBstrB.exe
[2012.08.09 11:10:14 | 000,189,248 | ---- | M] () -- C:\windows\SysWow64\PnkBstrB.ex0
[2012.08.09 11:10:10 | 000,076,888 | ---- | M] () -- C:\windows\SysWow64\PnkBstrA.exe
[2012.08.09 04:12:44 | 000,001,864 | ---- | M] () -- C:\Users\Patty\Desktop\APBLauncher - Verknüpfung.lnk
[2012.08.07 23:24:54 | 000,001,164 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
[2012.08.07 23:24:54 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\GamersFirst LIVE!.lnk
[2012.08.06 14:17:17 | 000,002,247 | ---- | M] () -- C:\Users\Public\Desktop\Ship Simulator Extremes.lnk
[2012.08.05 17:17:12 | 000,002,409 | ---- | M] () -- C:\Users\Public\Desktop\Railworks 3 Train Simulator 2012 Deluxe.lnk
[2012.08.05 06:23:31 | 000,000,131 | ---- | M] () -- C:\Users\Public\Desktop\Emoticons for your messenger!.url
[2012.08.02 04:28:58 | 616,782,876 | ---- | M] () -- C:\windows\MEMORY.DMP
[2012.07.31 10:08:52 | 000,037,968 | ---- | M] () -- C:\Users\Patty\Documents\Colin.odt
[2012.07.31 07:26:30 | 000,105,054 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_24737.jpg
[2012.07.31 07:25:02 | 000,079,566 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_16862.jpg
[2012.07.31 07:24:15 | 000,083,001 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_75443.jpg
[2012.07.31 07:24:14 | 000,076,969 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_87561.jpg
[2012.07.31 07:23:33 | 000,079,525 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_39538.jpg
[2012.07.31 07:18:01 | 000,080,626 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_91947.jpg
[2012.07.31 07:14:57 | 000,080,603 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_59933.jpg
[2012.07.31 07:13:51 | 000,080,340 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_12583.jpg
[2012.07.31 07:12:14 | 000,104,213 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_8293.jpg
[2012.07.31 07:11:43 | 000,103,947 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_21134.jpg
[2012.07.31 07:11:31 | 000,103,873 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_63998.jpg
[2012.07.31 07:09:41 | 000,093,831 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_3232.jpg
[2012.07.31 07:07:32 | 000,084,617 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_99150.jpg
[2012.07.31 07:07:31 | 000,093,831 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_50305.jpg
[2012.07.31 07:05:01 | 000,076,966 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_37039.jpg
[2012.07.31 07:04:57 | 000,104,210 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_68910.jpg
[2012.07.31 07:04:47 | 000,101,057 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_55054.jpg
[2012.07.31 07:00:26 | 000,079,548 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_62165.jpg
[2012.07.31 06:59:21 | 000,057,658 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_11327.jpg
[2012.07.31 06:58:58 | 000,077,043 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_69895.jpg
[2012.07.31 06:57:06 | 000,077,942 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_51895.jpg
[2012.07.30 14:53:37 | 000,117,591 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_80839.jpg
[2012.07.29 17:59:35 | 000,001,549 | ---- | M] () -- C:\Users\Patty\Desktop\Apps.lnk
[2012.07.29 17:59:33 | 000,001,883 | ---- | M] () -- C:\Users\Patty\Desktop\Start BlueStacks.lnk
[2012.07.19 17:15:59 | 000,002,098 | ---- | M] () -- C:\Users\Patty\Desktop\Empire - Verknüpfung.lnk
[2012.07.16 18:43:15 | 000,002,441 | ---- | M] () -- C:\Users\Patty\Desktop\EverQuest II.lnk
[1 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.12 12:48:57 | 000,000,168 | ---- | C] () -- C:\Users\Patty\defogger_reenable
[2012.08.12 12:47:22 | 000,050,477 | ---- | C] () -- C:\Users\Patty\Desktop\Defogger.exe
[2012.08.12 03:58:56 | 000,215,763 | ---- | C] () -- C:\Users\Patty\Desktop\Leck mich.jpg
[2012.08.12 03:56:56 | 003,145,746 | ---- | C] () -- C:\Users\Patty\Desktop\Leck mich.tga
[2012.08.11 20:20:18 | 000,001,321 | ---- | C] () -- C:\Users\Public\Desktop\Firestorm-Release.lnk
[2012.08.11 18:16:19 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.11 17:59:13 | 000,000,804 | ---- | C] () -- C:\windows\Installer\{0ea5a4af-1013-3216-c893-c1d3f1639e8c}\L\00000004.@
[2012.08.10 18:01:28 | 023,393,101 | ---- | C] () -- C:\Users\Patty\Desktop\sambc-fb-v492.exe
[2012.08.10 18:01:28 | 000,128,512 | ---- | C] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.9.2-RES-patch.exe
[2012.08.09 20:54:58 | 000,002,043 | ---- | C] () -- C:\Users\Patty\Desktop\SAM Broadcaster.lnk
[2012.08.09 18:14:48 | 000,076,813 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt444444.wma
[2012.08.09 18:11:38 | 000,002,853 | ---- | C] () -- C:\windows\Cm106.ini.cfg
[2012.08.09 18:11:38 | 000,001,189 | ---- | C] () -- C:\windows\Cm106.ini.imi
[2012.08.09 17:47:06 | 000,049,873 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt222.wma
[2012.08.09 17:43:27 | 000,103,753 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt1111.wma
[2012.08.09 17:30:08 | 000,045,383 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt5678.wma
[2012.08.09 17:03:51 | 000,072,323 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt4567.wma
[2012.08.09 16:57:07 | 000,067,833 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt3456.wma
[2012.08.09 16:53:13 | 000,085,793 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt2345.wma
[2012.08.09 16:49:32 | 000,274,373 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt1234.wma
[2012.08.09 16:47:30 | 000,103,753 | ---- | C] () -- C:\Users\Patty\Documents\Test123.wma
[2012.08.09 16:08:14 | 000,491,520 | ---- | C] () -- C:\windows\System\cmau106.dll
[2012.08.09 16:08:14 | 000,389,120 | ---- | C] () -- C:\windows\SysNative\CM106.cpl
[2012.08.09 16:08:14 | 000,221,184 | ---- | C] () -- C:\windows\System\cm106eye.exe
[2012.08.09 16:08:08 | 000,000,784 | ---- | C] () -- C:\windows\Cm106.ini.cfl
[2012.08.09 15:50:58 | 000,000,238 | ---- | C] () -- C:\windows\ODBCINST.INI
[2012.08.09 15:30:23 | 000,000,997 | ---- | C] () -- C:\Users\Patty\Desktop\Audio Recorder Pro.lnk
[2012.08.09 14:21:28 | 000,143,360 | ---- | C] () -- C:\windows\Vmix106.dll
[2012.08.09 14:21:20 | 000,808,176 | ---- | C] () -- C:\windows\SysNative\Cmeau106.exe
[2012.08.09 14:21:20 | 000,000,133 | ---- | C] () -- C:\windows\System\Dlap.pfx
[2012.08.09 14:19:07 | 000,359,424 | ---- | C] () -- C:\windows\SysNative\CmiInstallResAll64.dll
[2012.08.09 11:10:14 | 000,189,248 | ---- | C] () -- C:\windows\SysWow64\PnkBstrB.exe
[2012.08.09 11:10:14 | 000,189,248 | ---- | C] () -- C:\windows\SysWow64\PnkBstrB.ex0
[2012.08.09 11:10:10 | 000,076,888 | ---- | C] () -- C:\windows\SysWow64\PnkBstrA.exe
[2012.08.09 04:12:44 | 000,001,864 | ---- | C] () -- C:\Users\Patty\Desktop\APBLauncher - Verknüpfung.lnk
[2012.08.06 14:17:17 | 000,002,247 | ---- | C] () -- C:\Users\Public\Desktop\Ship Simulator Extremes.lnk
[2012.08.05 17:17:12 | 000,002,409 | ---- | C] () -- C:\Users\Public\Desktop\Railworks 3 Train Simulator 2012 Deluxe.lnk
[2012.08.05 15:26:47 | 000,001,164 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
[2012.08.05 15:26:47 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\GamersFirst LIVE!.lnk
[2012.08.05 06:24:18 | 000,011,776 | ---- | C] () -- C:\Users\Patty\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.08.05 06:23:31 | 000,000,131 | ---- | C] () -- C:\Users\Public\Desktop\Emoticons for your messenger!.url
[2012.07.31 10:08:38 | 000,037,968 | ---- | C] () -- C:\Users\Patty\Documents\Colin.odt
[2012.07.31 07:26:30 | 000,105,054 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_24737.jpg
[2012.07.31 07:25:02 | 000,079,566 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_16862.jpg
[2012.07.31 07:24:15 | 000,083,001 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_75443.jpg
[2012.07.31 07:24:14 | 000,076,969 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_87561.jpg
[2012.07.31 07:23:33 | 000,079,525 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_39538.jpg
[2012.07.31 07:18:01 | 000,080,626 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_91947.jpg
[2012.07.31 07:14:57 | 000,080,603 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_59933.jpg
[2012.07.31 07:13:51 | 000,080,340 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_12583.jpg
[2012.07.31 07:12:14 | 000,104,213 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_8293.jpg
[2012.07.31 07:11:43 | 000,103,947 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_21134.jpg
[2012.07.31 07:11:31 | 000,103,873 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_63998.jpg
[2012.07.31 07:09:41 | 000,093,831 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_3232.jpg
[2012.07.31 07:07:32 | 000,084,617 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_99150.jpg
[2012.07.31 07:07:31 | 000,093,831 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_50305.jpg
[2012.07.31 07:05:01 | 000,076,966 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_37039.jpg
[2012.07.31 07:04:57 | 000,104,210 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_68910.jpg
[2012.07.31 07:04:47 | 000,101,057 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_55054.jpg
[2012.07.31 07:00:26 | 000,079,548 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_62165.jpg
[2012.07.31 06:59:21 | 000,057,658 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_11327.jpg
[2012.07.31 06:58:58 | 000,077,043 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_69895.jpg
[2012.07.31 06:57:06 | 000,077,942 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_51895.jpg
[2012.07.30 14:53:37 | 000,117,591 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_80839.jpg
[2012.07.29 17:59:35 | 000,001,549 | ---- | C] () -- C:\Users\Patty\Desktop\Apps.lnk
[2012.07.29 17:59:33 | 000,001,883 | ---- | C] () -- C:\Users\Patty\Desktop\Start BlueStacks.lnk
[2012.07.19 16:24:19 | 000,001,828 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Internet Security Suite.lnk
[2012.07.16 18:40:11 | 000,002,469 | ---- | C] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EverQuest II.lnk
[2012.07.16 18:40:11 | 000,002,441 | ---- | C] () -- C:\Users\Patty\Desktop\EverQuest II.lnk
[2012.05.30 13:54:51 | 000,005,191 | ---- | C] () -- C:\Users\Patty\.recently-used.xbel
[2012.03.12 19:41:18 | 000,077,653 | ---- | C] () -- C:\Users\Patty\ESt2011_Mustermann_Max.elfo
[2012.01.11 00:03:11 | 000,002,048 | -HS- | C] () -- C:\windows\Installer\{0ea5a4af-1013-3216-c893-c1d3f1639e8c}\@
[2011.06.05 21:20:00 | 000,005,120 | ---- | C] () -- C:\Users\Patty\AppData\Local\Databases.db
[2011.04.28 12:00:32 | 000,001,201 | ---- | C] () -- C:\windows\cm106.ini
[2011.04.03 20:41:07 | 001,528,528 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2010.12.17 12:30:39 | 000,201,728 | ---- | C] () -- C:\windows\SetDrive.exe
[2010.12.17 12:30:37 | 000,036,864 | ---- | C] () -- C:\windows\WinWait.exe
[2010.12.17 03:40:36 | 000,139,264 | ---- | C] () -- C:\windows\SysWow64\ustor.dll
[2010.12.17 03:40:36 | 000,040,960 | ---- | C] () -- C:\windows\SysWow64\UMonit.exe
[2010.12.17 03:40:33 | 000,001,393 | ---- | C] () -- C:\windows\SysWow64\IconCfg0.ini
[2010.12.17 03:40:33 | 000,000,722 | ---- | C] () -- C:\windows\SysWow64\ProductName.ini
[2010.12.17 03:38:01 | 000,008,192 | ---- | C] () -- C:\windows\SysWow64\drivers\IntelMEFWVer.dll

< End of report >
         
--- --- ---




Die restlichen Logs hab ich mal komplett gezippt und in den Anhang gepostet.

Hoffe ihr könnt mir helfen, danke schonmal im Voraus!



Gruß

Patty80LE

Achso, wichtig vllt auch noch zu Wissen:

Ich habe in der ersten Panik die befallene Datei gelöscht, und zwar die Desktop.ini ...
Habe erst danach hier im Forum nachgelesen und dabei fiel mir auf das man eigentlich nichts löschen soll ohne Anweisung.
Nunja, nicht mehr zu ändern, dachte nur könnte vllt von Interesse sein.

Alt 12.08.2012, 22:59   #2
Patty80LE
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden



Natürlich die Logfiles noch vergessen, sorry -.-
__________________


Alt 22.08.2012, 02:07   #3
t'john
/// Helfer-Team
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden





Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
ATTFilter
:OTL
 
O4:64bit: - HKLM..\Run: [UMonit] C:\Windows\SysWOW64\UMonit.exe () 
O4:64bit: - HKLM..\Run: [Unattend0000000001{BFA3D12B-66DD-4617-923A-E864BC7D20B5}] C:\Windows\test.bat File not found 
O4 - HKLM..\Run: [] File not found 
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) 
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Patty\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc) 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 


[2012.08.11 17:59:13 | 000,000,804 | ---- | C] () -- C:\windows\Installer\{0ea5a4af-1013-3216-c893-c1d3f1639e8c}\L\00000004.@ 
 
[2012.01.11 00:03:11 | 000,002,048 | -HS- | C] () -- C:\windows\Installer\{0ea5a4af-1013-3216-c893-c1d3f1639e8c}\@ 
:Files


ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________
__________________

Alt 28.08.2012, 20:07   #4
Patty80LE
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden



Hallo nochmal,

komme leider erst jetzt dazu mich wieder um das PC-Problem zu kümmern.
Ich glaube in der zwischenzeit ist noch ein BKA-Trojaner aktiv geworden, mir wurde heute eine Seite angezeigt auf der zur eingabe eines Pasafe-Codes aufgefordert wurde und der PC angeblich gesperrt wurde.
Daher nochmal die aktuelle MWB-Log anbei.

Code:
ATTFilter
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.28.06

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Patty :: PATTY-PC [Administrator]

28.08.2012 17:35:37
mbam-log-2012-08-28 (20-03-23).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|Q:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 891945
Laufzeit: 2 Stunde(n), 25 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKCR\regfile\shell\open\command| (Broken.OpenCommand) -> Bösartig: ("regedit.exe" "%1") Gut: (regedit.exe "%1") -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Users\Patty\AppData\Local\Temp\roper0dun.exe (Trojan.PWS) -> Keine Aktion durchgeführt.
C:\Users\Patty\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\5441db48-4192fdbe (Trojan.PWS) -> Keine Aktion durchgeführt.
C:\Users\Patty\Documents\MusicConverterSetup.exe (Adware.Agent) -> Keine Aktion durchgeführt.
C:\Users\Patty\Downloads\mymusictubesetup_FF.exe (Adware.RKN) -> Keine Aktion durchgeführt.
C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.

(Ende)
         
Wäre dankbar wenn da nochmal jemand drüber schaun würde.

LG

Alt 29.08.2012, 02:38   #5
t'john
/// Helfer-Team
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden



Wo ist das Log vom Fix?

Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>


Broken.OpenCommand
HKCR\regfile\shell\open\command|
Trojan.PWS
C:\Users\Patty\AppData\Local\Temp\roper0dun.exe
C:\Users\Patty\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\5441db48-4192fdbe
Adware.Agent
C:\Users\Patty\Documents\MusicConverterSetup.exe
Adware.RKN
C:\Users\Patty\Downloads\mymusictubesetup_FF.exe
Trojan.Ransom.Gen
C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

__________________
Mfg, t'john
Das TB unterstützen

Alt 29.08.2012, 03:29   #6
Patty80LE
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden



Naja, wie gesagt, ich habe den fix nun nicht durchgeführt weil ich dachte das der nun nicht mehr aktuell ist nach so langer zeit... Daher auch kein logfile.
Soll ich den fix denn trotzdem so durchführen wie beschrieben?

Alt 29.08.2012, 04:09   #7
t'john
/// Helfer-Team
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden



Woher weiss ich, dass ich nicht wieder vergeblich einen Fix erstelle?
__________________
Mfg, t'john
Das TB unterstützen

Alt 29.08.2012, 05:32   #8
Patty80LE
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden



ja wie gesagt, tut mir leid , ich kam aus Real-Life gründen vorher dazu das problem zu beseitigen...

Alt 29.08.2012, 06:06   #9
t'john
/// Helfer-Team
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden



CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

  • Starte bitte die OTL.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

Code:
ATTFilter
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.*
%APPDATA%\*AcroIEH*.*
%APPDATA%\*.exe
%APPDATA%\*.tmp
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Klick auf .
  • Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread
__________________
Mfg, t'john
Das TB unterstützen

Alt 29.08.2012, 13:55   #10
Patty80LE
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden



Hallo,
hier das Ergebnis des Scans mit OTL:

Code:
ATTFilter
OTL logfile created on: 29.08.2012 13:32:28 - Run 2
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Patty\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,98 Gb Total Physical Memory | 4,88 Gb Available Physical Memory | 81,62% Memory free
11,96 Gb Paging File | 9,74 Gb Available in Paging File | 81,39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 906,34 Gb Total Space | 384,84 Gb Free Space | 42,46% Space Free | Partition Type: NTFS
Drive E: | 3,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 1,57 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive I: | 1,87 Gb Total Space | 0,13 Gb Free Space | 6,85% Space Free | Partition Type: FAT
 
Computer Name: PATTY-PC | User Name: Patty | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.28 17:43:43 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe
PRC - [2012.08.09 11:10:21 | 000,189,248 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrB.exe
PRC - [2012.08.09 11:10:10 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2012.07.10 14:18:10 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011.03.18 09:11:51 | 000,031,744 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe
PRC - [2011.03.09 14:30:08 | 000,092,592 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2011.02.24 17:06:42 | 000,511,448 | ---- | M] (TomTom) -- C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe
PRC - [2011.01.20 11:20:12 | 001,305,408 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
PRC - [2010.09.17 11:14:50 | 000,098,304 | ---- | M] (Firebird Project) -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe
PRC - [2010.09.17 11:14:42 | 003,735,552 | ---- | M] (Firebird Project) -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe
PRC - [2010.09.13 19:32:32 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.09.01 06:26:04 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PRC - [2010.08.30 00:07:34 | 000,096,752 | ---- | M] () -- C:\Program Files (x86)\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe
PRC - [2010.01.21 08:40:59 | 000,040,960 | ---- | M] () -- C:\Windows\SysWOW64\UMonit.exe
PRC - [2009.09.30 12:19:30 | 000,049,152 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Power Dial\LenovoCOMSvc.exe
PRC - [2006.11.03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\Pac207\Monitor.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.03.18 09:11:51 | 000,031,744 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe
MOD - [2011.02.24 17:06:44 | 000,161,240 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\TomTomSupporterProxy.dll
MOD - [2011.02.24 17:06:44 | 000,047,576 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\TomTomSupporterBase.dll
MOD - [2011.02.24 17:06:34 | 007,508,480 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtGui4.dll
MOD - [2011.02.24 17:06:34 | 002,101,760 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtCore4.dll
MOD - [2011.02.24 17:06:34 | 000,911,872 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtNetwork4.dll
MOD - [2011.02.24 17:06:34 | 000,334,848 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtXml4.dll
MOD - [2010.04.21 11:00:35 | 000,058,368 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\HcDLL2_30_Win32.dll
MOD - [2010.01.21 08:40:59 | 000,040,960 | ---- | M] () -- C:\Windows\SysWOW64\UMonit.exe
MOD - [2009.10.26 09:52:38 | 000,139,264 | ---- | M] () -- C:\Windows\SysWOW64\ustor.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2012.05.25 17:13:54 | 000,162,224 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Windows\SysNative\mfevtps.exe -- (mfevtp)
SRV:64bit: - [2012.05.25 16:59:02 | 000,210,616 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV:64bit: - [2012.05.25 16:58:32 | 000,199,304 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McProxy)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service)
SRV - [2012.08.23 11:57:48 | 000,502,064 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2012.08.09 11:10:21 | 000,189,248 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2012.08.09 11:10:10 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.08.07 00:07:41 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.07.10 20:31:31 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai)
SRV - [2012.07.10 14:18:10 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc)
SRV - [2012.07.10 14:17:20 | 000,397,704 | ---- | M] (BlueStack Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc)
SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.07.05 11:20:12 | 002,428,968 | ---- | M] (mobile concepts GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\CyberGhost VPN\CGVPNCliService.exe -- (CGVPNCliSrvc)
SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011.03.09 14:30:08 | 000,092,592 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2011.03.01 18:29:58 | 000,130,976 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)
SRV - [2010.09.29 18:47:00 | 004,032,992 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.17 11:14:50 | 000,098,304 | ---- | M] (Firebird Project) [Auto | Running] -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance)
SRV - [2010.09.17 11:14:42 | 003,735,552 | ---- | M] (Firebird Project) [On_Demand | Running] -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe -- (FirebirdServerDefaultInstance)
SRV - [2010.09.13 19:32:32 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.09.09 12:46:14 | 000,081,920 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Programme\Lenovo\Power Dial\LitModeCtrl.exe -- (LitModeCtrl)
SRV - [2010.08.30 00:07:34 | 000,096,752 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe -- (CEEBC40A-FDED-4C59-B354-939132350B01)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.09.30 12:19:30 | 000,049,152 | ---- | M] (Lenovo) [Auto | Running] -- C:\Programme\Lenovo\Power Dial\LenovoCOMSvc.exe -- (LenovoCOMSvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.22 13:29:46 | 000,647,208 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)
DRV:64bit: - [2012.02.22 13:29:46 | 000,487,296 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek)
DRV:64bit: - [2012.02.22 13:29:46 | 000,289,664 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk)
DRV:64bit: - [2012.02.22 13:29:46 | 000,229,528 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)
DRV:64bit: - [2012.02.22 13:29:46 | 000,160,792 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk)
DRV:64bit: - [2012.02.22 13:29:46 | 000,100,912 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mferkdet.sys -- (mferkdet)
DRV:64bit: - [2012.02.22 13:29:46 | 000,075,936 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfenlfk.sys -- (mfenlfk)
DRV:64bit: - [2012.02.22 13:29:46 | 000,065,264 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids)
DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.05.30 14:02:12 | 000,046,112 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tbhsd.sys -- (tbhsd)
DRV:64bit: - [2011.05.08 16:20:10 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.11.12 01:10:49 | 000,155,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2010.10.20 10:58:44 | 000,015,360 | ---- | M] (Siliten) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MouFilter_FlexDef4.sys -- (MouFilter_Mou_FlexDef4)
DRV:64bit: - [2010.09.21 08:34:18 | 000,313,520 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress)
DRV:64bit: - [2010.09.21 03:59:38 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.09.13 19:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.06.19 08:36:04 | 000,017,920 | ---- | M] (Siliten) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\InputFilter_FlexDef2b.sys -- (InputFilter_Hid_FlexDef2b)
DRV:64bit: - [2010.02.25 18:51:02 | 000,029,696 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)
DRV:64bit: - [2010.02.22 04:49:58 | 000,052,224 | ---- | M] (Genesys Logic) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ustor2k.sys -- (USTOR2K)
DRV:64bit: - [2009.12.01 15:49:52 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2009.07.21 15:20:06 | 000,121,840 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2009.07.14 15:36:28 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009.07.13 23:59:33 | 005,020,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.07.01 11:54:54 | 000,030,728 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGPBTDD.sys -- (LGPBTDD)
DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 22:35:53 | 000,051,712 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rtnic64.sys -- (RTL8023x64)
DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer)
DRV:64bit: - [2008.04.08 07:43:04 | 000,020,832 | ---- | M] (Nicomsoft Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ddcdrv.sys -- (WinI2C-DDC)
DRV:64bit: - [2006.12.05 11:34:26 | 000,572,416 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PFC027.SYS -- (PAC207)
DRV:64bit: - [2006.09.19 15:43:54 | 000,018,224 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2012.07.10 14:18:02 | 000,075,144 | ---- | M] (BlueStack Systems) [Kernel | Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys -- (BstHdDrv)
DRV - [2010.03.22 19:13:08 | 000,015,712 | ---- | M] (Nicomsoft Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysWOW64\drivers\ddcdrv.sys -- (WinI2C-DDC)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2004.12.31 08:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
 
 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data]
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=102875&gct=hp
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{BB0E13C0-0E3B-4F5F-B31B-48697D1BA5AA}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=HIP&o=102875&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=6F&apn_dtid=YYYYYYYYDE&apn_uid=434a70d5-6584-4c56-9114-95d72b6672f1&apn_sauid=689AA487-0083-4700-8AE2-C6C3A6F3E2E7
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=;ftp=;https=;
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=102875&gct=hp"
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.3&q="
FF - prefs.js..network.proxy.gopher: ""
FF - prefs.js..network.proxy.gopher_port: 0
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~2\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.9: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Users\Patty\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Nightly 17.0a1\extensions\\Components: C:\PROGRAM FILES\NIGHTLY\COMPONENTS [2012.08.14 04:00:23 | 000,000,000 | ---D | M]
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Nightly 17.0a1\extensions\\Plugins: C:\PROGRAM FILES\NIGHTLY\PLUGINS
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore [2012.07.19 16:23:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2012.08.14 02:48:27 | 000,000,000 | ---D | M]
 
[2011.04.11 17:54:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Extensions
[2011.04.11 17:54:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
[2012.08.05 22:17:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions
[2012.07.25 21:29:41 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.06.12 20:18:27 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.03.30 02:42:30 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.07.17 22:09:05 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\toolbar@ask.com
[2012.07.17 22:09:05 | 000,002,325 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\askcom.xml
[2012.08.23 12:38:29 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-1.xml
[2011.10.30 14:47:09 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-10.xml
[2011.11.02 22:10:31 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-11.xml
[2011.11.10 18:49:21 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-12.xml
[2011.12.07 20:16:25 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-13.xml
[2011.12.23 16:57:23 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-14.xml
[2011.12.29 22:06:52 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-15.xml
[2012.02.03 21:54:08 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-16.xml
[2012.02.09 21:06:57 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-17.xml
[2011.08.11 04:23:30 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-2.xml
[2011.08.19 16:46:11 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-3.xml
[2011.09.03 13:08:10 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-4.xml
[2011.09.04 14:32:11 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-5.xml
[2011.09.13 04:30:28 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-6.xml
[2011.09.18 06:24:58 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-7.xml
[2011.10.12 19:53:18 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-8.xml
[2011.10.20 21:34:39 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-9.xml
[2011.07.25 01:19:29 | 000,001,056 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin.xml
[2012.02.09 21:02:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.10.12 16:14:05 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.08.05 22:17:28 | 000,314,397 | ---- | M] () (No name found) -- C:\USERS\PATTY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JGZY3W0Y.DEFAULT\EXTENSIONS\{C50CA3C4-5656-43C2-A061-13E717F73FC8}.XPI
[2011.04.14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
[2011.03.17 21:57:30 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Common Files\mcafee\systemcore\ScriptSn.20120719162333.dll (McAfee, Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120719162333.dll (McAfee, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [UMonit] C:\Windows\SysWOW64\UMonit.exe ()
O4:64bit: - HKLM..\Run: [Unattend0000000001{BFA3D12B-66DD-4617-923A-E864BC7D20B5}] C:\Windows\test.bat File not found
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [jmekey] C:\Program Files (x86)\jmesoft\hotkey.exe (JME)
O4 - HKLM..\Run: [Launch SilverCrest SOML 807 A1] C:\Program Files (x86)\SilverCrest SOML 807 A1 Driver\MouClient_FD2_9063RL.exe (Siliten)
O4 - HKLM..\Run: [Lenovo Dynamic Brightness System] C:\Program Files\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe (Lenovo)
O4 - HKLM..\Run: [Lenovo Eye Distance System] C:\Program Files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe (Lenovo)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [ModeSwitch] C:\Program Files\Lenovo\Power Dial\LitModeSwitch.exe (Lenovo)
O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [Akamai NetSession Interface] C:\Users\Patty\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [ICQ] C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [MyTomTomSA.exe] C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe (TomTom)
O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [Steam] C:\Program Files (x86)\Steam2\steam.exe (Valve Corporation)
O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [TomTomHOME.exe] C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK = C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{47052FC8-237A-4868-A7AD-EF5D2AF3A5F8}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.09.25 19:27:45 | 000,000,098 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2010.08.25 22:57:19 | 000,000,070 | R--- | M] () - G:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell - "" = AutoRun
O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2011.09.25 19:27:45 | 003,811,542 | R--- | M] (RailSimulator.com                                           )
O33 - MountPoints2\{8e6cfc5a-8575-11e1-8576-406186747ef6}\Shell - "" = AutoRun
O33 - MountPoints2\{8e6cfc5a-8575-11e1-8576-406186747ef6}\Shell\AutoRun\command - "" = G:\Setup.exe -- [2010.08.25 22:57:19 | 001,518,798 | R--- | M] (Paradox Interactive                                         )
O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell - "" = AutoRun
O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell\AutoRun\command - "" = F:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
 
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: mcmscsvc - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: McMPFSvc - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SafeBootNet:64bit: mcmscsvc - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: mfefire - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe ()
SafeBootNet:64bit: mfefirek - C:\Windows\SysNative\drivers\mfefirek.sys (McAfee, Inc.)
SafeBootNet:64bit: mfefirek.sys - C:\Windows\SysNative\drivers\mfefirek.sys (McAfee, Inc.)
SafeBootNet:64bit: mfehidk - C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.)
SafeBootNet:64bit: mfehidk.sys - C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.)
SafeBootNet:64bit: mfevtp - C:\Windows\SysNative\mfevtps.exe (McAfee, Inc.)
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codec - C:\windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\windows\SysWow64\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/)
Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\windows\SysWow64\frapsvid.dll (Beepa P/L)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.29 13:07:25 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F27CA0D7-EA74-46DC-87E3-76A5F385290A}
[2012.08.29 01:07:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8A0A13CF-B84A-4D32-B950-6E30A7267008}
[2012.08.28 18:39:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012.08.28 17:43:37 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe
[2012.08.28 17:33:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.28 17:33:52 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012.08.28 13:06:51 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{66EFFEE9-1421-4959-B26C-C65CF52647F3}
[2012.08.28 01:06:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{FDF3A868-9559-4E48-B3CF-762C40E60161}
[2012.08.27 13:06:16 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{A8A3D581-F6C2-45FC-825C-7F0796F45FC6}
[2012.08.27 01:06:04 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{21A39D6D-EA71-4283-B9F1-744FD0D96DC7}
[2012.08.26 13:05:53 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F76A08CF-E493-4B6C-9C5A-8A9DDB6CD96B}
[2012.08.26 01:05:42 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4B0E1CB6-7612-44FC-9C58-6E1F75750D81}
[2012.08.25 13:05:18 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{006FFBF3-68AF-46EB-982D-F1258387A17F}
[2012.08.25 01:05:07 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{01345E16-A15F-4424-B2BD-0F5CDADA05EA}
[2012.08.24 13:04:56 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EF932FC5-629B-4B57-838F-C25CD2664552}
[2012.08.23 23:46:19 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D7925CF1-3ACE-4D50-9A67-859E76FD0B70}
[2012.08.23 11:46:08 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{16FCAC01-B339-4BF3-B6C2-E7D905629C32}
[2012.08.22 23:45:57 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{B099A377-1808-4070-A9AC-1E044839615E}
[2012.08.22 11:45:46 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{77EF1655-0284-485B-8022-71B13756B933}
[2012.08.21 21:58:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{861D9AA2-A23C-450A-9F0B-1FC04D17B9E5}
[2012.08.21 21:16:00 | 000,000,000 | ---D | C] -- C:\Users\Patty\Desktop\Bilder2
[2012.08.21 21:14:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\Desktop\Bilder PCNEU
[2012.08.20 12:14:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment
[2012.08.20 11:54:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
[2012.08.20 10:56:09 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{313764A7-09F4-41AB-AA8D-2E8C704B5813}
[2012.08.20 10:12:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard
[2012.08.20 10:11:31 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Blizzard Entertainment
[2012.08.20 10:04:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment
[2012.08.19 22:55:58 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8F99F755-7A42-4CA6-B8F9-9D3F025103FB}
[2012.08.19 21:47:28 | 000,000,000 | ---D | C] -- C:\WoW
[2012.08.19 21:46:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WoW
[2012.08.19 10:55:47 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{39AA1D65-9D57-4BFE-BD40-F7B15A9A8F10}
[2012.08.18 15:27:52 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D6072E7D-F25F-489D-BB2D-C05536D64B63}
[2012.08.18 15:27:42 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{408129A9-7E22-41E7-97AF-92A28AF41A8B}
[2012.08.17 04:23:32 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EA54E2DE-3447-4DD0-9176-EFCA0F659AE1}
[2012.08.17 04:23:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{E3956F9D-366A-44FF-B796-675B2BE0F4DE}
[2012.08.16 16:23:06 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{94CF0498-3A43-42E2-86B6-ED587FA6736A}
[2012.08.16 16:22:55 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D9118002-AA53-4B97-84F6-8D45771D2483}
[2012.08.16 04:22:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EA7252BB-4101-4B9E-B571-839EEE989921}
[2012.08.16 04:22:29 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{878426E6-1655-45C7-87E7-EE238CDADFB2}
[2012.08.15 16:22:16 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{9B622767-A61B-46C5-926C-6D5224DD67C7}
[2012.08.15 16:22:02 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CEABADBC-252D-42F1-A48D-20D5A5CEBBCE}
[2012.08.15 04:21:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CDA0A941-DC90-43A7-BD51-EF4353F49F7E}
[2012.08.15 04:21:34 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C623443A-8CC5-4484-B4E7-DE7FD33C7591}
[2012.08.14 16:21:22 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{62722B0D-B2DF-439A-B21F-F03827FE4413}
[2012.08.14 16:21:12 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D2532EA9-6606-4158-B3DF-0E3CD2DF7CCB}
[2012.08.14 03:58:25 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SAM Broadcaster
[2012.08.13 21:30:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firestorm-Release
[2012.08.13 21:28:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Firestorm-Release
[2012.08.13 18:53:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Second Life Viewer
[2012.08.13 18:52:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SecondLifeViewer
[2012.08.13 12:43:24 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8A311A33-C09D-4946-BC8C-335D6D0BC2BC}
[2012.08.13 12:43:13 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{AF2ED083-8313-4343-A62F-F64F2A9FF9C6}
[2012.08.13 00:42:59 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{6AC2517B-9545-4C63-B112-8880C78C95A2}
[2012.08.13 00:42:48 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{1CF3849B-4908-4ABA-A7AE-66DC82569A7C}
[2012.08.12 12:42:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{43788298-41EE-4C8F-93F5-AFA140732A1A}
[2012.08.12 12:42:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CDA71FB9-9609-4782-BEDD-454E9D35A85E}
[2012.08.12 06:26:10 | 000,000,000 | ---D | C] -- C:\ProgramData\A2AC
[2012.08.11 22:30:50 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C4169238-5F16-4C58-9E78-7844607B1626}
[2012.08.11 22:30:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{10422F33-6829-4482-8025-37F4E70B1147}
[2012.08.11 18:16:28 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Malwarebytes
[2012.08.11 18:16:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.11 18:16:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.11 17:25:26 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\SpacialAudio
[2012.08.11 05:50:18 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{0784EFAA-C5F6-41F1-9739-BC9F188BA877}
[2012.08.11 05:50:07 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{644D5883-53A7-43C8-84FB-BB16238D36E4}
[2012.08.10 17:49:55 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{77ACB6B2-1CFD-40F2-8DBE-791EA1EBD762}
[2012.08.10 17:49:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4829B077-9FF2-4EAC-A9FA-C083A8923AEF}
[2012.08.09 17:26:49 | 000,000,000 | ---D | C] -- C:\Drivers
[2012.08.09 17:04:59 | 000,000,000 | -H-D | C] -- C:\Lenovo
[2012.08.09 16:32:16 | 000,000,000 | ---D | C] -- C:\download
[2012.08.09 16:00:30 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\MySQL
[2012.08.09 15:50:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MySQL
[2012.08.09 15:50:06 | 000,000,000 | ---D | C] -- C:\Program Files\MySQL
[2012.08.09 15:45:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MySQL
[2012.08.09 15:45:57 | 000,000,000 | ---D | C] -- C:\ProgramData\MySQL
[2012.08.09 15:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Recorder Pro
[2012.08.09 15:30:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audio Recorder Pro
[2012.08.09 11:02:36 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{50D3CD2F-5BBD-4AEB-9F4D-D0FD715938B6}
[2012.08.09 11:02:23 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C52C50E4-B394-4C78-9B63-EE1DCC4A1748}
[2012.08.08 16:51:15 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{67AE11BC-0FA1-4FE9-9D77-A929C16A50DA}
[2012.08.08 16:51:05 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5B3F7AF5-9622-49BC-978C-1DFC8FE167DC}
[2012.08.08 04:50:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2DE48A7F-13FA-4B3C-867A-B5BED8D89584}
[2012.08.08 04:50:38 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EB2430D0-09F2-4E7D-AC17-C596C5A10753}
[2012.08.07 16:50:25 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{902A8010-2BC0-4E14-8D56-52B786DCED97}
[2012.08.07 16:50:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{537784A7-F7C9-40B0-B2A9-35F7E49F7EEB}
[2012.08.07 04:49:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{B22EC84C-C099-4204-A814-A18A458B8848}
[2012.08.07 04:49:39 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C12CB901-8C4B-4C59-B76B-BA18B51DEC2A}
[2012.08.06 17:32:41 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Quest3D
[2012.08.06 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\Documents\ShipSimExtremes Userdata
[2012.08.06 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Roaming
[2012.08.06 14:17:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paradox Interactive
[2012.08.06 14:13:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Paradox Interactive
[2012.08.06 12:14:42 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5A103BE2-412A-4173-94DC-C862626DB820}
[2012.08.06 12:14:32 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{9FD4CA43-867E-4AC6-AD33-B24F3A5515BC}
[2012.08.06 00:14:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{80060651-833A-40A4-B494-3334B2C965F3}
[2012.08.06 00:14:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C1A30172-67EE-4408-8E58-B9AEB4F9677D}
[2012.08.05 21:20:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\SKIDROW
[2012.08.05 21:17:27 | 000,000,000 | ---D | C] -- C:\Users\Patty\Desktop\Railworks.3.Train.Simulator.2012.Deluxe.Update.1.and.2-SKIDROW
[2012.08.05 17:17:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RailSimulator.com
[2012.08.05 17:05:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RailSimulator.com
[2012.08.05 15:27:12 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\GamersFirst LIVE!
[2012.08.05 15:26:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GamersFirst
[2012.08.05 15:26:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GamersFirst
[2012.08.05 12:13:54 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{03FD720F-DBF9-401B-8189-B4261869619C}
[2012.08.05 12:13:44 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5CB3ED4C-F39C-4B0D-A543-02C55297BEEC}
[2012.08.05 06:23:43 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\MusicNet
[2012.08.05 06:23:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\Documents\My Received Files
[2012.08.05 06:23:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\BearShare
[2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BearShare Applications
[2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BearShare
[2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\ProgramData\BearShare
[2012.08.05 06:22:11 | 000,000,000 | -H-D | C] -- C:\ProgramData\{D79D348D-B804-455D-BF34-7E3989C8E84D}
[2012.08.04 23:04:02 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{08D5B1B0-1FF4-4217-89D8-6D5A547F9A90}
[2012.08.04 23:03:52 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CA4E7870-57B6-4EE8-8AB7-C4AB8E20EF0F}
[2012.08.04 11:03:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4D6D8287-0E4E-4567-9C9A-9A6673AED2FA}
[2012.08.04 11:03:26 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5716A376-6562-40E7-8DAA-E80653258772}
[2012.08.03 22:11:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{E2A6B2BB-5165-47F7-81AA-E8A006577E27}
[2012.08.03 22:11:21 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F656B47B-DF56-4D13-BFEF-4F5A9F68E0D0}
[2012.08.03 10:11:04 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2F8186E0-6AA5-4D6C-AF02-BE2FA4A1C64D}
[2012.08.03 10:10:54 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D96B8060-E668-4431-AFF7-66D0EFF62369}
[2012.08.02 11:40:19 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{654C4470-7FE1-4437-A839-57ECB2E26E2D}
[2012.08.02 11:40:09 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{9B3B93E1-8BBA-4B62-A032-1C5483A1D256}
[2012.08.01 18:44:47 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D70A40D9-3417-4B1C-AE92-15F8E591EDB3}
[2012.08.01 18:44:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{369E81AD-2CD6-4B11-A78B-8BDDD055D357}
[2012.08.01 10:50:53 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Apple Computer
[2012.07.31 14:27:17 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{AE30EF49-1B32-4C60-B0FD-AF1B4713DEDF}
[2012.07.31 14:27:07 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4588A487-460C-4323-B9C6-34CA4AE3F1B3}
[2012.07.31 07:52:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012.07.31 07:52:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2012.07.31 07:52:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2012.07.31 07:49:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2012.07.31 02:26:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{06EC3F31-BDA1-47F1-9170-24201BCC7E6C}
[2012.07.31 02:26:27 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{DA00BCF8-7CE7-4C2F-B00B-DAEEA95FAE9A}
[2012.07.30 14:26:09 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{33A1E426-B16E-4A42-A223-E0F4CC3F8F1E}
[2012.07.30 14:25:59 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D71F5E38-247B-4C63-A710-38AC32792AD2}
[2010.12.17 04:20:16 | 001,914,000 | ---- | C] (Adobe Systems Incorporated) -- C:\ProgramData\flashax10.exe
[1 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.29 13:26:00 | 000,001,108 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.29 13:04:37 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.08.28 23:26:00 | 000,001,104 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.28 18:39:48 | 000,001,828 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Internet Security Suite.lnk
[2012.08.28 17:47:45 | 000,001,469 | ---- | M] () -- C:\Users\Patty\.recently-used.xbel
[2012.08.28 17:43:43 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe
[2012.08.28 17:33:53 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.28 17:29:39 | 001,500,294 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012.08.28 17:29:39 | 000,654,602 | ---- | M] () -- C:\windows\SysNative\perfh007.dat
[2012.08.28 17:29:39 | 000,616,484 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012.08.28 17:29:39 | 000,130,216 | ---- | M] () -- C:\windows\SysNative\perfc007.dat
[2012.08.28 17:29:39 | 000,106,606 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012.08.28 17:23:40 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad
[2012.08.28 17:17:05 | 000,001,887 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.08.27 18:59:45 | 000,017,360 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.27 18:59:45 | 000,017,360 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.27 18:51:37 | 523,132,927 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.23 14:47:34 | 008,606,816 | ---- | M] () -- C:\Users\Patty\Desktop\Jasi-Micha-Patty-Berlin.xcf
[2012.08.21 22:01:26 | 000,195,220 | ---- | M] () -- C:\Users\Patty\Desktop\002.jpg
[2012.08.21 22:01:26 | 000,185,694 | ---- | M] () -- C:\Users\Patty\Desktop\003.jpg
[2012.08.21 20:04:04 | 000,659,538 | ---- | M] () -- C:\Users\Patty\Desktop\DSC_0255.JPG
[2012.08.21 20:03:52 | 000,575,254 | ---- | M] () -- C:\Users\Patty\Desktop\DSC_0254.JPG
[2012.08.21 20:03:08 | 000,541,123 | ---- | M] () -- C:\Users\Patty\Desktop\DSC_0253.JPG
[2012.08.21 20:02:48 | 000,616,760 | ---- | M] () -- C:\Users\Patty\Desktop\DSC_0252.JPG
[2012.08.20 22:23:50 | 559,250,716 | ---- | M] () -- C:\windows\MEMORY.DMP
[2012.08.20 12:09:41 | 000,000,803 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2012.08.20 10:12:03 | 000,001,293 | ---- | M] () -- C:\Users\Patty\Desktop\World of Warcraft-Installationsprogramm.lnk
[2012.08.17 07:37:17 | 000,288,360 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2012.08.14 03:58:25 | 000,002,032 | ---- | M] () -- C:\Users\Patty\Desktop\SAM Broadcaster.lnk
[2012.08.14 00:10:09 | 023,393,101 | ---- | M] () -- C:\Users\Patty\Desktop\sambc-fb-v492.exe
[2012.08.14 00:05:49 | 000,128,512 | ---- | M] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.9.2-RES-patch.exe
[2012.08.13 21:30:55 | 000,001,321 | ---- | M] () -- C:\Users\Public\Desktop\Firestorm-Release.lnk
[2012.08.12 20:52:25 | 000,000,000 | ---- | M] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.2.2-1
[2012.08.12 12:48:57 | 000,000,168 | ---- | M] () -- C:\Users\Patty\defogger_reenable
[2012.08.12 03:58:56 | 000,215,763 | ---- | M] () -- C:\Users\Patty\Desktop\Leck mich.jpg
[2012.08.12 03:56:56 | 003,145,746 | ---- | M] () -- C:\Users\Patty\Desktop\Leck mich.tga
[2012.08.09 18:14:48 | 000,076,813 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt444444.wma
[2012.08.09 17:47:06 | 000,049,873 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt222.wma
[2012.08.09 17:43:27 | 000,103,753 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt1111.wma
[2012.08.09 17:30:08 | 000,045,383 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt5678.wma
[2012.08.09 17:03:51 | 000,072,323 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt4567.wma
[2012.08.09 16:57:07 | 000,067,833 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt3456.wma
[2012.08.09 16:53:13 | 000,085,793 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt2345.wma
[2012.08.09 16:49:32 | 000,274,373 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt1234.wma
[2012.08.09 16:47:30 | 000,103,753 | ---- | M] () -- C:\Users\Patty\Documents\Test123.wma
[2012.08.09 14:19:07 | 000,001,138 | ---- | M] () -- C:\windows\Cm106.ini.imi
[2012.08.09 14:19:07 | 000,001,138 | ---- | M] () -- C:\windows\System\Cm106.ini
[2012.08.09 11:10:21 | 000,189,248 | ---- | M] () -- C:\windows\SysWow64\PnkBstrB.exe
[2012.08.09 11:10:14 | 000,189,248 | ---- | M] () -- C:\windows\SysWow64\PnkBstrB.ex0
[2012.08.09 11:10:10 | 000,076,888 | ---- | M] () -- C:\windows\SysWow64\PnkBstrA.exe
[2012.08.09 04:12:44 | 000,001,864 | ---- | M] () -- C:\Users\Patty\Desktop\APBLauncher - Verknüpfung.lnk
[2012.08.07 23:24:54 | 000,001,164 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
[2012.08.07 23:24:54 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\GamersFirst LIVE!.lnk
[2012.08.06 14:17:17 | 000,002,247 | ---- | M] () -- C:\Users\Public\Desktop\Ship Simulator Extremes.lnk
[2012.08.05 17:17:12 | 000,002,409 | ---- | M] () -- C:\Users\Public\Desktop\Railworks 3 Train Simulator 2012 Deluxe.lnk
[2012.08.05 06:24:30 | 000,011,264 | ---- | M] () -- C:\Users\Patty\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.08.05 06:23:31 | 000,000,131 | ---- | M] () -- C:\Users\Public\Desktop\Emoticons for your messenger!.url
[2012.07.31 10:08:52 | 000,037,968 | ---- | M] () -- C:\Users\Patty\Documents\Colin.odt
[2012.07.31 07:26:30 | 000,105,054 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_24737.jpg
[2012.07.31 07:25:02 | 000,079,566 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_16862.jpg
[2012.07.31 07:24:15 | 000,083,001 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_75443.jpg
[2012.07.31 07:24:14 | 000,076,969 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_87561.jpg
[2012.07.31 07:23:33 | 000,079,525 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_39538.jpg
[2012.07.31 07:18:01 | 000,080,626 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_91947.jpg
[2012.07.31 07:14:57 | 000,080,603 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_59933.jpg
[2012.07.31 07:13:51 | 000,080,340 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_12583.jpg
[2012.07.31 07:12:14 | 000,104,213 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_8293.jpg
[2012.07.31 07:11:43 | 000,103,947 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_21134.jpg
[2012.07.31 07:11:31 | 000,103,873 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_63998.jpg
[2012.07.31 07:09:41 | 000,093,831 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_3232.jpg
[2012.07.31 07:07:32 | 000,084,617 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_99150.jpg
[2012.07.31 07:07:31 | 000,093,831 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_50305.jpg
[2012.07.31 07:05:01 | 000,076,966 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_37039.jpg
[2012.07.31 07:04:57 | 000,104,210 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_68910.jpg
[2012.07.31 07:04:47 | 000,101,057 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_55054.jpg
[2012.07.31 07:00:26 | 000,079,548 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_62165.jpg
[2012.07.31 06:59:21 | 000,057,658 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_11327.jpg
[2012.07.31 06:58:58 | 000,077,043 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_69895.jpg
[2012.07.31 06:57:06 | 000,077,942 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_51895.jpg
[2012.07.30 14:53:37 | 000,117,591 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_80839.jpg
[1 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.28 17:47:45 | 000,001,469 | ---- | C] () -- C:\Users\Patty\.recently-used.xbel
[2012.08.28 17:33:53 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.28 17:17:05 | 004,503,728 | ---- | C] () -- C:\ProgramData\nud0repor.pad
[2012.08.28 17:17:05 | 000,001,887 | ---- | C] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.08.23 14:46:15 | 008,606,816 | ---- | C] () -- C:\Users\Patty\Desktop\Jasi-Micha-Patty-Berlin.xcf
[2012.08.21 22:00:30 | 000,659,538 | ---- | C] () -- C:\Users\Patty\Desktop\DSC_0255.JPG
[2012.08.21 22:00:30 | 000,616,760 | ---- | C] () -- C:\Users\Patty\Desktop\DSC_0252.JPG
[2012.08.21 22:00:30 | 000,575,254 | ---- | C] () -- C:\Users\Patty\Desktop\DSC_0254.JPG
[2012.08.21 22:00:30 | 000,541,123 | ---- | C] () -- C:\Users\Patty\Desktop\DSC_0253.JPG
[2012.08.20 15:01:22 | 000,185,694 | ---- | C] () -- C:\Users\Patty\Desktop\003.jpg
[2012.08.20 15:00:58 | 000,195,220 | ---- | C] () -- C:\Users\Patty\Desktop\002.jpg
[2012.08.20 10:12:03 | 000,001,293 | ---- | C] () -- C:\Users\Patty\Desktop\World of Warcraft-Installationsprogramm.lnk
[2012.08.20 10:04:05 | 000,000,803 | ---- | C] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2012.08.15 01:11:31 | 000,135,205 | ---- | C] () -- C:\Users\Patty\Desktop\17072011062.jpg
[2012.08.15 01:10:04 | 000,873,695 | ---- | C] () -- C:\Users\Patty\Desktop\SNC00030.jpg
[2012.08.15 01:09:34 | 000,858,118 | ---- | C] () -- C:\Users\Patty\Desktop\SNC00031.jpg
[2012.08.15 01:08:32 | 000,189,617 | ---- | C] () -- C:\Users\Patty\Desktop\12032012075.jpg
[2012.08.15 01:07:38 | 000,039,143 | ---- | C] () -- C:\Users\Patty\Desktop\12032012077.jpg
[2012.08.14 03:58:25 | 000,002,032 | ---- | C] () -- C:\Users\Patty\Desktop\SAM Broadcaster.lnk
[2012.08.14 00:04:13 | 000,128,512 | ---- | C] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.9.2-RES-patch.exe
[2012.08.14 00:04:08 | 023,393,101 | ---- | C] () -- C:\Users\Patty\Desktop\sambc-fb-v492.exe
[2012.08.13 21:30:55 | 000,001,321 | ---- | C] () -- C:\Users\Public\Desktop\Firestorm-Release.lnk
[2012.08.12 20:52:25 | 000,000,000 | ---- | C] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.2.2-1
[2012.08.12 12:48:57 | 000,000,168 | ---- | C] () -- C:\Users\Patty\defogger_reenable
[2012.08.12 03:58:56 | 000,215,763 | ---- | C] () -- C:\Users\Patty\Desktop\Leck mich.jpg
[2012.08.12 03:56:56 | 003,145,746 | ---- | C] () -- C:\Users\Patty\Desktop\Leck mich.tga
[2012.08.09 18:14:48 | 000,076,813 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt444444.wma
[2012.08.09 17:47:06 | 000,049,873 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt222.wma
[2012.08.09 17:43:27 | 000,103,753 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt1111.wma
[2012.08.09 17:30:08 | 000,045,383 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt5678.wma
[2012.08.09 17:03:51 | 000,072,323 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt4567.wma
[2012.08.09 16:57:07 | 000,067,833 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt3456.wma
[2012.08.09 16:53:13 | 000,085,793 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt2345.wma
[2012.08.09 16:49:32 | 000,274,373 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt1234.wma
[2012.08.09 16:47:30 | 000,103,753 | ---- | C] () -- C:\Users\Patty\Documents\Test123.wma
[2012.08.09 14:19:07 | 000,359,424 | ---- | C] () -- C:\windows\SysNative\CmiInstallResAll64.dll
[2012.08.09 14:19:07 | 000,002,853 | ---- | C] () -- C:\windows\Cm106.ini.cfg
[2012.08.09 14:19:07 | 000,001,138 | ---- | C] () -- C:\windows\Cm106.ini.imi
[2012.08.09 11:10:14 | 000,189,248 | ---- | C] () -- C:\windows\SysWow64\PnkBstrB.exe
[2012.08.09 11:10:14 | 000,189,248 | ---- | C] () -- C:\windows\SysWow64\PnkBstrB.ex0
[2012.08.09 11:10:10 | 000,076,888 | ---- | C] () -- C:\windows\SysWow64\PnkBstrA.exe
[2012.08.09 04:12:44 | 000,001,864 | ---- | C] () -- C:\Users\Patty\Desktop\APBLauncher - Verknüpfung.lnk
[2012.08.06 14:17:17 | 000,002,247 | ---- | C] () -- C:\Users\Public\Desktop\Ship Simulator Extremes.lnk
[2012.08.05 17:17:12 | 000,002,409 | ---- | C] () -- C:\Users\Public\Desktop\Railworks 3 Train Simulator 2012 Deluxe.lnk
[2012.08.05 15:26:47 | 000,001,164 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
[2012.08.05 15:26:47 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\GamersFirst LIVE!.lnk
[2012.08.05 06:24:18 | 000,011,264 | ---- | C] () -- C:\Users\Patty\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.08.05 06:23:31 | 000,000,131 | ---- | C] () -- C:\Users\Public\Desktop\Emoticons for your messenger!.url
[2012.07.31 10:08:38 | 000,037,968 | ---- | C] () -- C:\Users\Patty\Documents\Colin.odt
[2012.07.31 07:26:30 | 000,105,054 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_24737.jpg
[2012.07.31 07:25:02 | 000,079,566 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_16862.jpg
[2012.07.31 07:24:15 | 000,083,001 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_75443.jpg
[2012.07.31 07:24:14 | 000,076,969 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_87561.jpg
[2012.07.31 07:23:33 | 000,079,525 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_39538.jpg
[2012.07.31 07:18:01 | 000,080,626 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_91947.jpg
[2012.07.31 07:14:57 | 000,080,603 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_59933.jpg
[2012.07.31 07:13:51 | 000,080,340 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_12583.jpg
[2012.07.31 07:12:14 | 000,104,213 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_8293.jpg
[2012.07.31 07:11:43 | 000,103,947 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_21134.jpg
[2012.07.31 07:11:31 | 000,103,873 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_63998.jpg
[2012.07.31 07:09:41 | 000,093,831 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_3232.jpg
[2012.07.31 07:07:32 | 000,084,617 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_99150.jpg
[2012.07.31 07:07:31 | 000,093,831 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_50305.jpg
[2012.07.31 07:05:01 | 000,076,966 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_37039.jpg
[2012.07.31 07:04:57 | 000,104,210 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_68910.jpg
[2012.07.31 07:04:47 | 000,101,057 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_55054.jpg
[2012.07.31 07:00:26 | 000,079,548 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_62165.jpg
[2012.07.31 06:59:21 | 000,057,658 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_11327.jpg
[2012.07.31 06:58:58 | 000,077,043 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_69895.jpg
[2012.07.31 06:57:06 | 000,077,942 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_51895.jpg
[2012.07.30 14:53:37 | 000,117,591 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_80839.jpg
[2012.03.12 19:41:18 | 000,077,653 | ---- | C] () -- C:\Users\Patty\ESt2011_Saalmann_Patrice.elfo
[2011.06.05 21:20:00 | 000,005,120 | ---- | C] () -- C:\Users\Patty\AppData\Local\Databases.db
[2011.04.28 12:00:32 | 000,001,201 | R--- | C] () -- C:\windows\cm106.ini
[2011.04.03 20:41:07 | 001,526,976 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2010.12.17 12:30:39 | 000,201,728 | ---- | C] () -- C:\windows\SetDrive.exe
[2010.12.17 12:30:37 | 000,036,864 | ---- | C] () -- C:\windows\WinWait.exe
[2010.12.17 03:40:36 | 000,139,264 | ---- | C] () -- C:\windows\SysWow64\ustor.dll
[2010.12.17 03:40:36 | 000,040,960 | ---- | C] () -- C:\windows\SysWow64\UMonit.exe
[2010.12.17 03:40:33 | 000,001,393 | ---- | C] () -- C:\windows\SysWow64\IconCfg0.ini
[2010.12.17 03:40:33 | 000,000,722 | ---- | C] () -- C:\windows\SysWow64\ProductName.ini
[2010.12.17 03:38:01 | 000,008,192 | ---- | C] () -- C:\windows\SysWow64\drivers\IntelMEFWVer.dll
 
========== LOP Check ==========
 
[2011.09.13 04:40:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Ashampoo
[2012.04.21 03:45:21 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Avnex
[2011.09.16 03:28:17 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\BitTorrent
[2011.05.08 16:21:31 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DAEMON Tools Lite
[2012.01.04 18:36:29 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DVDVideoSoft
[2011.06.12 20:18:27 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.05 15:53:41 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\elsterformular
[2012.08.01 20:07:23 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Firestorm
[2011.12.13 02:28:19 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\FreeHideIP
[2012.08.23 14:47:34 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\gtk-2.0
[2012.08.11 18:00:37 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\ICQ
[2011.12.29 00:21:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Imprudence
[2012.08.13 21:13:44 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\IrfanView
[2011.05.15 15:10:28 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Laconic Software
[2012.08.05 06:23:43 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\MusicNet
[2012.08.09 16:00:30 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\MySQL
[2012.05.30 14:22:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Pamela
[2012.08.06 17:32:41 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Quest3D
[2012.08.06 17:32:40 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Roaming
[2012.04.21 09:23:37 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Screaming Bee
[2012.08.19 22:23:14 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\SecondLife
[2012.07.17 22:00:39 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\SoftGrid Client
[2012.08.13 21:13:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\streamripper
[2011.11.29 20:18:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TeamViewer
[2011.04.13 14:35:58 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\The Creative Assembly
[2011.11.29 17:03:57 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TL-Player
[2011.04.11 17:54:50 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TomTom
[2011.04.03 20:41:40 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TP
[2011.04.02 18:05:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Windows Live Writer
[2012.07.06 03:11:19 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Z-Software
[2012.08.11 18:57:11 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\Firestorm
[2012.07.23 16:36:40 | 000,032,620 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.04.03 13:54:17 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Adobe
[2012.08.01 10:50:53 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Apple Computer
[2011.09.13 04:40:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Ashampoo
[2012.04.21 03:45:21 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Avnex
[2011.09.16 03:28:17 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\BitTorrent
[2011.04.04 23:08:18 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\CyberLink
[2011.05.08 16:21:31 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DAEMON Tools Lite
[2012.01.04 18:36:29 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DVDVideoSoft
[2011.06.12 20:18:27 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.05 15:53:41 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\elsterformular
[2012.08.01 20:07:23 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Firestorm
[2011.12.13 02:28:19 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\FreeHideIP
[2012.08.23 14:47:34 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\gtk-2.0
[2012.08.11 18:00:37 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\ICQ
[2011.04.02 16:37:37 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Identities
[2011.12.29 00:21:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Imprudence
[2011.04.13 13:06:16 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\InstallShield
[2011.04.02 16:38:10 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Intel Corporation
[2012.08.13 21:13:44 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\IrfanView
[2011.05.15 15:10:28 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Laconic Software
[2011.04.02 16:48:05 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Macromedia
[2012.08.11 18:16:28 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Malwarebytes
[2009.07.26 06:47:55 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Media Center Programs
[2011.12.04 05:34:27 | 000,000,000 | --SD | M] -- C:\Users\Patty\AppData\Roaming\Microsoft
[2011.12.10 17:19:50 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\MixMeister Technology
[2011.04.02 17:04:24 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Mozilla
[2011.05.15 15:20:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Mozilla-Cache
[2012.08.05 06:23:43 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\MusicNet
[2012.08.09 16:00:30 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\MySQL
[2011.04.24 19:33:11 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\NVIDIA
[2012.05.30 14:22:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Pamela
[2012.08.06 17:32:41 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Quest3D
[2012.08.06 17:32:40 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Roaming
[2011.06.25 13:33:27 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Roxio Log Files
[2012.04.21 09:23:37 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Screaming Bee
[2012.08.19 22:23:14 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\SecondLife
[2011.05.09 14:35:19 | 000,000,000 | RH-D | M] -- C:\Users\Patty\AppData\Roaming\SecuROM
[2012.08.29 09:37:32 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Skype
[2012.07.17 22:00:39 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\SoftGrid Client
[2012.08.13 21:13:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\streamripper
[2011.11.29 20:18:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TeamViewer
[2011.04.13 14:35:58 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\The Creative Assembly
[2011.11.29 17:03:57 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TL-Player
[2011.04.11 17:54:50 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TomTom
[2011.04.03 20:41:40 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TP
[2012.08.24 13:36:44 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\vlc
[2012.08.13 21:13:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Winamp
[2011.04.02 18:05:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Windows Live Writer
[2011.04.04 21:15:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\WinRAR
[2012.07.06 03:11:19 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Z-Software
 
< %APPDATA%\*.exe /s >
[2012.08.29 03:55:43 | 000,000,000 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Firestorm\logs\Firestorm-Release_4_1_1_28744.exec_marker
[2011.12.10 17:19:41 | 000,000,766 | R--- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Installer\{50CBBEC7-1010-41C5-8718-A1A6FEDD9C3A}\ARPPRODUCTICON.exe
[2011.05.08 16:36:50 | 000,049,152 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Patty\AppData\Roaming\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe
[2011.05.08 16:26:44 | 000,010,134 | R--- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Installer\{C920EFB6-59DB-472D-B445-21821477AD17}\ARPPRODUCTICON.exe
[2011.05.08 16:26:44 | 000,008,854 | R--- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Installer\{C920EFB6-59DB-472D-B445-21821477AD17}\UNINST_Uninstall_Tru_C920EFB659DB472DB44521821477AD17.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_b230b4f1ea781c27\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.20621_none_39f398b8542b6259\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2010.09.13 19:24:26 | 000,437,272 | ---- | M] (Intel Corporation) MD5=F7CE9BE72EDAC499B713ECA6DAE5D26F -- C:\windows\SysNative\drivers\iaStor.sys
[2010.09.13 19:24:26 | 000,437,272 | ---- | M] (Intel Corporation) MD5=F7CE9BE72EDAC499B713ECA6DAE5D26F -- C:\windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_2b0c50dc63f09dae\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\windows\SysNative\netlogon.dll
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\windows\SysNative\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\windows\SysNative\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\windows\SysNative\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\windows\SysNative\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\windows\system32\*.tmp files -> C:\windows\system32\*.tmp -> ]
 
< %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.* >
[2012.08.28 17:17:05 | 000,001,887 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.12 13:12:54 | 000,000,174 | -HS- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
[2011.04.16 18:32:29 | 000,002,389 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK
 
< %APPDATA%\*AcroIEH*.* >
 
< %APPDATA%\*.exe >
 
< %APPDATA%\*.tmp >

< End of report >
         

LG

Alt 29.08.2012, 19:57   #11
t'john
/// Helfer-Team
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden



Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
  • Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.


Code:
ATTFilter
:OTL
SRV - [2012.07.10 20:31:31 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai) 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://de.ask.com/?l=dis&o=102875&gct=hp 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook: - No CLSID value found 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{BB0E13C0-0E3B-4F5F-B31B-48697D1BA5AA}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=HIP&o=102875&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=6F&apn_dtid=YYYYYYYYDE&apn_uid=434a70d5-6584-4c56-9114-95d72b6672f1&apn_sauid=689AA487-0083-4700-8AE2-C6C3A6F3E2E7 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=;ftp=;https=; 
FF - prefs.js..browser.search.defaultengine: "Ask.com" 
FF - prefs.js..browser.search.defaultenginename: "Ask.com" 
FF - prefs.js..browser.search.defaulturl: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q=" 
FF - prefs.js..browser.search.order.1: "Ask.com" 
FF - prefs.js..browser.search.selectedEngine: "Google" 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "http://de.ask.com/?l=dis&o=102875&gct=hp" 
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.3&q=" 
FF - prefs.js..network.proxy.gopher: "" 
FF - prefs.js..network.proxy.gopher_port: 0 
FF - prefs.js..network.proxy.share_proxy_settings: true 
FF - prefs.js..network.proxy.type: 0 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\windows\system32\npDeployJava1.dll File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll File not found 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O3 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
O4:64bit: - HKLM..\Run: [Unattend0000000001{BFA3D12B-66DD-4617-923A-E864BC7D20B5}] C:\Windows\test.bat File not found 
O4 - HKLM..\Run: [] File not found 
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) 
O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [Akamai NetSession Interface] C:\Users\Patty\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites) 
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: freerealms.com ([]* in Trusted sites) 
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: soe.com ([]* in Trusted sites) 
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: sony.com ([]* in Trusted sites) 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2011.09.25 19:27:45 | 000,000,098 | R--- | M] () - E:\autorun.inf -- [ CDFS ] 
O32 - AutoRun File - [2010.08.25 22:57:19 | 000,000,070 | R--- | M] () - G:\autorun.inf -- [ CDFS ] 
O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell - "" = AutoRun 
O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2011.09.25 19:27:45 | 003,811,542 | R--- | M] (RailSimulator.com ) 
O33 - MountPoints2\{8e6cfc5a-8575-11e1-8576-406186747ef6}\Shell - "" = AutoRun 
O33 - MountPoints2\{8e6cfc5a-8575-11e1-8576-406186747ef6}\Shell\AutoRun\command - "" = G:\Setup.exe -- [2010.08.25 22:57:19 | 001,518,798 | R--- | M] (Paradox Interactive ) 
O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell - "" = AutoRun 
O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell\AutoRun\command - "" = F:\autorun.exe 
 

[2012.08.05 06:22:11 | 000,000,000 | -H-D | C] -- C:\ProgramData\{D79D348D-B804-455D-BF34-7E3989C8E84D} 

[1 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ] 
[2012.08.28 17:23:40 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad 
[2012.08.28 17:17:05 | 000,001,887 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 

 
:Files

C:\Users\Patty\AppData\Local\{*}
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\Patty\AppData\Local\Temp\*.exe
C:\Users\Patty\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
%SystemRoot%\System32\*.tmp
%SystemRoot%\SysWOW64\*.tmp
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________
Mfg, t'john
Das TB unterstützen

Alt 17.10.2012, 15:54   #12
t'john
/// Helfer-Team
 
ZeroAccess Trojaner in der Desktop.ini gefunden - Standard

ZeroAccess Trojaner in der Desktop.ini gefunden



Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu ZeroAccess Trojaner in der Desktop.ini gefunden
adware.agent, adware.rkn, akamai, autorun, bluestacks, broken.opencommand, converter, cyberghost, datei gelöscht, desktop.ini, explorer, firewall, format, google earth, home, lenovo, logfile, neuaufsetzung, nodrives, nvidia, programme, realtek, scan, siteadvisor, symantec, trojan.pws, trojan.ransom.gen, trojaner, zeroaccess, ändern



Ähnliche Themen: ZeroAccess Trojaner in der Desktop.ini gefunden


  1. Habe Trojaner: Trojan.Zeroaccess.C, Trojan.Zeroaccess.B,Trojan.Gen.2
    Log-Analyse und Auswertung - 10.11.2013 (3)
  2. BDS/ZeroAccess - Trojaner gelöscht, nicht sicher ob System jetzt sauber ist
    Plagegeister aller Art und deren Bekämpfung - 31.03.2013 (4)
  3. TR/Sirefef.P, TR/Rogue.kdz, TR/Buzus & BDS/ZeroAccess.Gen gefunden - Anfänger! [Vista]
    Plagegeister aller Art und deren Bekämpfung - 11.02.2013 (43)
  4. Trojaner bds zeroaccess.gen eingefangen
    Log-Analyse und Auswertung - 07.02.2013 (19)
  5. habe mir tr/agent.kl.25088 , tr/atraps.gen und bos/zeroAccess.gen und tr/psw.fareit.587 eingefangen (trojaner ? )
    Plagegeister aller Art und deren Bekämpfung - 03.02.2013 (15)
  6. ZeroAccess Trojaner
    Log-Analyse und Auswertung - 17.01.2013 (2)
  7. TR/Dldr.Kryptik.J und BDS/ZeroAccess.Gen und TR/Agent.KL.25088 mit Avira gefunden
    Plagegeister aller Art und deren Bekämpfung - 01.01.2013 (13)
  8. BDS/ZeroAccess.Gen - System Progressive Protection gefunden
    Log-Analyse und Auswertung - 26.11.2012 (21)
  9. Trojaner von Avira und weiteren Anti-Maleware Programmen entdeckt! ( BDS/ZeroAccess.Gen)
    Plagegeister aller Art und deren Bekämpfung - 03.11.2012 (5)
  10. Trojaner ZeroAccess.hi in Desktop.ini nicht löschbar von McAfee Internet Security
    Log-Analyse und Auswertung - 02.11.2012 (9)
  11. Facebook-Trojaner: ZeroAccess (C:\\Windows\assembly\GAC_64\Desktop.ini)
    Log-Analyse und Auswertung - 05.10.2012 (6)
  12. Zeroaccess Trojaner in c:\windows\sassembly\GAC\Desktop.ini
    Plagegeister aller Art und deren Bekämpfung - 12.09.2012 (11)
  13. Trojaner ZeroAccess + FakeAlert
    Plagegeister aller Art und deren Bekämpfung - 06.09.2012 (28)
  14. Trojaner BDS/zeroaccess.gen entdeckt
    Plagegeister aller Art und deren Bekämpfung - 31.08.2012 (3)
  15. Symantec meldet: Trojan.Zeroaccess.B | Trojan.Gen.2 | services.exe gefunden
    Plagegeister aller Art und deren Bekämpfung - 22.08.2012 (2)
  16. BKA-Trojaner zeroaccess!inf Run.dll error
    Log-Analyse und Auswertung - 15.03.2012 (3)
  17. GEMA-Trojaner: zwar wohl entfernt (c't Desinfect), aber desktop.ini fehlerhaft: leerer Desktop...
    Plagegeister aller Art und deren Bekämpfung - 14.01.2012 (2)

Zum Thema ZeroAccess Trojaner in der Desktop.ini gefunden - Hallo zusammen, tjaa.. nun hab ichs mal wieder geschafft, habe mir nach Jahren ohne Probleme dummerweise doch wieder nen Trojaner eingefangen. Es handelt sich laut McAffee um "ZeroAccess". Wie die - ZeroAccess Trojaner in der Desktop.ini gefunden...
Archiv
Du betrachtest: ZeroAccess Trojaner in der Desktop.ini gefunden auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.