| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: ZeroAccess Trojaner in der Desktop.ini gefundenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
12.08.2012, 16:45
| #1 |
 |  ZeroAccess Trojaner in der Desktop.ini gefunden Hallo zusammen, tjaa.. nun hab ichs mal wieder geschafft, habe mir nach Jahren ohne Probleme dummerweise doch wieder nen Trojaner eingefangen.  Es handelt sich laut McAffee um "ZeroAccess". Wie die meisten bestimmt wissen verhindert er die Aktivierung der Firewall und macht noch so einige hässliche Probleme  . Wäre nett wenn mir jemand die Neuaufsetzung des Systems ersparen könnte ;-) Hier die Logfile aus OTL: OTL Logfile: Code:
ATTFilter OTL logfile created on: 12.08.2012 12:49:16 - Run 1 OTL by OldTimer - Version 3.2.57.0 Folder = C:\Users\Patty\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,98 Gb Total Physical Memory | 4,17 Gb Available Physical Memory | 69,64% Memory free 11,96 Gb Paging File | 9,02 Gb Available in Paging File | 75,39% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 906,34 Gb Total Space | 463,66 Gb Free Space | 51,16% Space Free | Partition Type: NTFS Drive D: | 56,98 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive E: | 3,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Drive G: | 1,57 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: PATTY-PC | User Name: Patty | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.12 12:47:35 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe PRC - [2012.08.09 11:10:21 | 000,189,248 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrB.exe PRC - [2012.08.09 11:10:10 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2012.07.10 14:18:38 | 000,561,544 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-Agent.exe PRC - [2012.07.10 14:18:24 | 000,577,928 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-Frontend.exe PRC - [2012.07.10 14:18:14 | 000,389,512 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-FileSystem.exe PRC - [2012.07.10 14:18:10 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe PRC - [2012.07.10 14:17:36 | 000,389,512 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe PRC - [2012.07.10 14:17:30 | 000,389,512 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-Network.exe PRC - [2012.07.10 14:17:20 | 000,397,704 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-Service.exe PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.06.06 21:33:42 | 001,564,872 | ---- | M] (Ask) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe PRC - [2012.05.26 06:32:24 | 004,327,744 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\Patty\AppData\Local\Akamai\netsession_win.exe PRC - [2012.04.03 18:24:34 | 000,160,840 | ---- | M] (Geek Software GmbH) -- C:\Program Files (x86)\PDF24\pdf24.exe PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.10.03 08:30:32 | 000,098,304 | ---- | M] (Firebird Project) -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe PRC - [2011.10.03 08:30:20 | 003,764,224 | ---- | M] (Firebird Project) -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2011.04.09 10:12:08 | 003,520,000 | ---- | M] (sw4you, Siegfried Weckmann) -- C:\Program Files (x86)\Hardcopy\hardcopy.exe PRC - [2011.03.18 09:11:51 | 000,031,744 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe PRC - [2011.03.09 14:30:08 | 000,092,592 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe PRC - [2011.02.24 17:06:42 | 000,511,448 | ---- | M] (TomTom) -- C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe PRC - [2011.02.17 11:04:12 | 000,863,744 | ---- | M] (Siliten) -- C:\Program Files (x86)\SilverCrest SOML 807 A1 Driver\MouClient_FD2_9063RL.exe PRC - [2011.01.20 11:20:12 | 001,305,408 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe PRC - [2010.10.08 10:49:40 | 000,285,696 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe PRC - [2010.09.13 19:32:32 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2010.09.13 19:32:30 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe PRC - [2010.09.09 12:19:08 | 000,265,216 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe PRC - [2010.09.01 06:26:04 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe PRC - [2010.08.30 00:07:34 | 000,096,752 | ---- | M] () -- C:\Program Files (x86)\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe PRC - [2010.01.21 08:40:59 | 000,040,960 | ---- | M] () -- C:\Windows\SysWOW64\UMonit.exe PRC - [2009.12.04 17:59:28 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe PRC - [2009.09.30 12:19:30 | 000,049,152 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Power Dial\LenovoCOMSvc.exe PRC - [2009.07.16 10:05:10 | 000,114,688 | ---- | M] (JME) -- C:\Program Files (x86)\jmesoft\hotkey.exe PRC - [2006.11.03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\Pac207\Monitor.exe ========== Modules (No Company Name) ========== MOD - [2012.07.29 18:01:20 | 014,050,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\DevComponents.DotNe#\544559a292ef9299f4588196686a1f8d\DevComponents.DotNetBar2.ni.dll MOD - [2012.07.29 18:01:14 | 000,524,288 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\HD-Agent\75b3ede095d4e2da81b07e3ce3dace9b\HD-Agent.ni.exe MOD - [2012.07.29 18:01:13 | 001,443,328 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\NAudio\804c2927f990fe8e289316cefbabdb77\NAudio.ni.dll MOD - [2012.07.29 18:01:12 | 000,634,880 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\HD-Frontend\d555bc9eae963abfcb687c3c506bf352\HD-Frontend.ni.exe MOD - [2012.07.29 18:01:10 | 000,155,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\JSON\bc16a8709a5bb402e422287af4bc56be\JSON.ni.dll MOD - [2012.06.14 03:35:48 | 001,670,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\3eaec5bc57c67c3b24ca2bb281ca249d\Microsoft.VisualBasic.ni.dll MOD - [2012.06.14 03:35:19 | 000,475,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\4aa3b127a59b6c1cd3b8749ea972771f\IAStorUtil.ni.dll MOD - [2012.06.14 03:31:43 | 000,212,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8b7a7f9c607e09bfa03c07b5ff3a8ae3\System.ServiceProcess.ni.dll MOD - [2012.06.14 03:31:39 | 011,824,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll MOD - [2012.06.14 03:31:30 | 014,325,760 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\517358eb2fd962a942dd1ea6afc5b93e\PresentationFramework.ni.dll MOD - [2012.06.14 03:31:21 | 012,433,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll MOD - [2012.06.14 03:31:17 | 001,591,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll MOD - [2012.06.14 03:31:16 | 012,218,880 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\e9d0ba41128f363f2390c7e630129c2b\PresentationCore.ni.dll MOD - [2012.05.10 03:38:10 | 000,997,888 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\3f9dee1ce0ccb42145293a5bfcbe7205\System.Management.ni.dll MOD - [2012.05.10 03:38:10 | 000,014,336 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\1a4c0f7ba90a13c246a90a579552935a\IAStorCommon.ni.dll MOD - [2012.05.10 03:35:39 | 000,368,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\fc626095c194be137bceb219934b06a7\PresentationFramework.Aero.ni.dll MOD - [2012.05.10 03:35:29 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll MOD - [2012.05.10 03:35:01 | 003,325,952 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b68fdf2c95b93fc5006a092c11eed07c\WindowsBase.ni.dll MOD - [2012.05.10 03:35:00 | 000,680,960 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\61af058c2bc079f28397a29ed145fbc7\System.Security.ni.dll MOD - [2012.05.10 03:34:58 | 005,453,312 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll MOD - [2012.05.10 03:34:56 | 007,952,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll MOD - [2012.05.10 03:34:56 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll MOD - [2012.05.10 03:34:52 | 011,490,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll MOD - [2011.04.09 10:11:53 | 002,920,960 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\HcDllS.dll MOD - [2011.03.18 09:11:51 | 000,031,744 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe MOD - [2011.02.24 17:06:44 | 000,161,240 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\TomTomSupporterProxy.dll MOD - [2011.02.24 17:06:44 | 000,047,576 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\TomTomSupporterBase.dll MOD - [2011.02.24 17:06:34 | 007,508,480 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtGui4.dll MOD - [2011.02.24 17:06:34 | 002,101,760 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtCore4.dll MOD - [2011.02.24 17:06:34 | 000,911,872 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtNetwork4.dll MOD - [2011.02.24 17:06:34 | 000,334,848 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtXml4.dll MOD - [2010.09.30 10:14:19 | 000,055,296 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\hardcopy_03.dll MOD - [2010.09.20 19:55:52 | 000,182,272 | ---- | M] () -- C:\Programme\Lenovo\Lenovo Brightness System\ddcHelperWraper.dll MOD - [2010.09.20 11:08:10 | 000,210,432 | ---- | M] () -- C:\Programme\Lenovo\Lenovo Brightness System\KeyStoneAdapter.dll MOD - [2010.09.09 12:19:30 | 000,210,432 | ---- | M] () -- C:\Programme\Lenovo\Lenovo Eye Distance System\KeyStoneAdapter.dll MOD - [2010.09.09 12:18:58 | 000,211,456 | ---- | M] () -- C:\Programme\Lenovo\Lenovo Eye Distance System\VideoPlayer.dll MOD - [2010.09.03 14:31:36 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\SilverCrest SOML 807 A1 Driver\UniFunc.dll MOD - [2010.04.21 11:00:35 | 000,058,368 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\HcDLL2_30_Win32.dll MOD - [2010.01.21 08:40:59 | 000,040,960 | ---- | M] () -- C:\Windows\SysWOW64\UMonit.exe MOD - [2009.12.04 18:04:32 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll MOD - [2009.12.04 17:59:54 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll MOD - [2009.10.26 09:52:38 | 000,139,264 | ---- | M] () -- C:\Windows\SysWOW64\ustor.dll MOD - [2009.09.14 08:00:24 | 000,208,896 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll MOD - [2009.09.14 08:00:17 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2009.07.16 10:20:38 | 000,032,768 | ---- | M] () -- C:\Program Files (x86)\jmesoft\Keyhook.dll MOD - [2009.07.14 03:15:51 | 000,232,448 | ---- | M] () -- \\?\globalroot\systemroot\syswow64\mswsock.DLL MOD - [2009.07.14 03:15:51 | 000,232,448 | ---- | M] () -- \\.\globalroot\systemroot\syswow64\mswsock.dll MOD - [2007.12.31 11:27:42 | 000,007,168 | ---- | M] () -- C:\Program Files (x86)\jmesoft\VistaVolume.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2012.07.20 19:49:54 | 009,705,984 | ---- | M] () [Auto | Stopped] -- C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe -- (MySQL55) SRV:64bit: - [2012.05.25 17:13:54 | 000,162,224 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Windows\SysNative\mfevtps.exe -- (mfevtp) SRV:64bit: - [2012.05.25 16:59:02 | 000,210,616 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire) SRV:64bit: - [2012.05.25 16:58:32 | 000,199,304 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (MSK80Service) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McProxy) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNASvc) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McMPFSvc) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service) SRV - [2012.08.09 11:10:21 | 000,189,248 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB) SRV - [2012.08.09 11:10:10 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2012.08.07 00:07:41 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.07.10 20:31:31 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai) SRV - [2012.07.10 14:18:10 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc) SRV - [2012.07.10 14:17:20 | 000,397,704 | ---- | M] (BlueStack Systems, Inc.) [On_Demand | Running] -- C:\Program Files (x86)\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc) SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.04.19 08:22:48 | 000,502,032 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee\VirusScan\mcods.exe -- (McODS) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.10.03 08:30:32 | 000,098,304 | ---- | M] (Firebird Project) [Auto | Running] -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance) SRV - [2011.10.03 08:30:20 | 003,764,224 | ---- | M] (Firebird Project) [On_Demand | Running] -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe -- (FirebirdServerDefaultInstance) SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2011.07.05 11:20:12 | 002,428,968 | ---- | M] (mobile concepts GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\CyberGhost VPN\CGVPNCliService.exe -- (CGVPNCliSrvc) SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2011.03.09 14:30:08 | 000,092,592 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService) SRV - [2011.03.01 18:29:58 | 000,130,976 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service) SRV - [2010.09.29 18:47:00 | 004,032,992 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc) SRV - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.09.13 19:32:32 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2010.09.09 12:46:14 | 000,081,920 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Programme\Lenovo\Power Dial\LitModeCtrl.exe -- (LitModeCtrl) SRV - [2010.08.30 00:07:34 | 000,096,752 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe -- (CEEBC40A-FDED-4C59-B354-939132350B01) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.09.30 12:19:30 | 000,049,152 | ---- | M] (Lenovo) [Auto | Running] -- C:\Programme\Lenovo\Power Dial\LenovoCOMSvc.exe -- (LenovoCOMSvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.22 13:29:46 | 000,647,208 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk) DRV:64bit: - [2012.02.22 13:29:46 | 000,487,296 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek) DRV:64bit: - [2012.02.22 13:29:46 | 000,289,664 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk) DRV:64bit: - [2012.02.22 13:29:46 | 000,229,528 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk) DRV:64bit: - [2012.02.22 13:29:46 | 000,160,792 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk) DRV:64bit: - [2012.02.22 13:29:46 | 000,100,912 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mferkdet.sys -- (mferkdet) DRV:64bit: - [2012.02.22 13:29:46 | 000,075,936 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfenlfk.sys -- (mfenlfk) DRV:64bit: - [2012.02.22 13:29:46 | 000,065,264 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids) DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2011.05.30 14:02:12 | 000,046,112 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tbhsd.sys -- (tbhsd) DRV:64bit: - [2011.05.08 16:20:10 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2011.04.28 12:00:32 | 001,310,720 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CM10664.sys -- (USBMULCD) DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2010.11.12 01:10:49 | 000,155,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2010.10.20 10:58:44 | 000,015,360 | ---- | M] (Siliten) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MouFilter_FlexDef4.sys -- (MouFilter_Mou_FlexDef4) DRV:64bit: - [2010.09.21 08:34:18 | 000,313,520 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress) DRV:64bit: - [2010.09.21 03:59:38 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2010.09.13 19:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2010.06.19 08:36:04 | 000,017,920 | ---- | M] (Siliten) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\InputFilter_FlexDef2b.sys -- (InputFilter_Hid_FlexDef2b) DRV:64bit: - [2010.02.25 18:51:02 | 000,029,696 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901) DRV:64bit: - [2010.02.22 04:49:58 | 000,052,224 | ---- | M] (Genesys Logic) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ustor2k.sys -- (USTOR2K) DRV:64bit: - [2009.12.01 15:49:52 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc) DRV:64bit: - [2009.07.21 15:20:06 | 000,121,840 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd) DRV:64bit: - [2009.07.14 15:36:28 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx) DRV:64bit: - [2009.07.13 23:59:33 | 005,020,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2009.07.01 11:54:54 | 000,030,728 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LGPBTDD.sys -- (LGPBTDD) DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009.06.10 22:35:53 | 000,051,712 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rtnic64.sys -- (RTL8023x64) DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer) DRV:64bit: - [2008.04.08 07:43:04 | 000,020,832 | ---- | M] (Nicomsoft Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ddcdrv.sys -- (WinI2C-DDC) DRV:64bit: - [2006.12.05 11:34:26 | 000,572,416 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PFC027.SYS -- (PAC207) DRV:64bit: - [2006.09.19 15:43:54 | 000,018,224 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2012.07.10 14:18:02 | 000,075,144 | ---- | M] (BlueStack Systems) [Kernel | Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys -- (BstHdDrv) DRV - [2010.03.22 19:13:08 | 000,015,712 | ---- | M] (Nicomsoft Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysWOW64\drivers\ddcdrv.sys -- (WinI2C-DDC) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2004.12.31 08:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data] IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.bearshare.com/ IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{BB0E13C0-0E3B-4F5F-B31B-48697D1BA5AA}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=HIP&o=102875&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=6F&apn_dtid=YYYYYYYYDE&apn_uid=434a70d5-6584-4c56-9114-95d72b6672f1&apn_sauid=689AA487-0083-4700-8AE2-C6C3A6F3E2E7 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=;ftp=;https=; ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q=" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=102875&gct=hp" FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.3&q=" FF - prefs.js..network.proxy.gopher: "" FF - prefs.js..network.proxy.gopher_port: 0 FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.type: 0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\windows\system32\npDeployJava1.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL () FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll () FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll File not found FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~2\mcafee\msc\npmcsn~1.dll () FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.9: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Users\Patty\AppData\LocalLow\Sony Online Entertainment\npsoe.dll () FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Nightly 17.0a1\extensions\\Components: C:\PROGRAM FILES\NIGHTLY\COMPONENTS [2012.08.09 15:17:30 | 000,000,000 | ---D | M] 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Nightly 17.0a1\extensions\\Plugins: C:\PROGRAM FILES\NIGHTLY\PLUGINS FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore [2012.07.19 16:23:40 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2012.08.11 17:41:21 | 000,000,000 | ---D | M] [2011.04.11 17:54:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Extensions [2011.04.11 17:54:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com [2012.08.05 22:17:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions [2012.07.25 21:29:41 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2011.06.12 20:18:27 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.03.30 02:42:30 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012.07.17 22:09:05 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\toolbar@ask.com [2012.07.17 22:09:05 | 000,002,325 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\askcom.xml [2012.08.08 21:04:46 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-1.xml [2011.10.30 14:47:09 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-10.xml [2011.11.02 22:10:31 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-11.xml [2011.11.10 18:49:21 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-12.xml [2011.12.07 20:16:25 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-13.xml [2011.12.23 16:57:23 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-14.xml [2011.12.29 22:06:52 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-15.xml [2012.02.03 21:54:08 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-16.xml [2012.02.09 21:06:57 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-17.xml [2011.08.11 04:23:30 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-2.xml [2011.08.19 16:46:11 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-3.xml [2011.09.03 13:08:10 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-4.xml [2011.09.04 14:32:11 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-5.xml [2011.09.13 04:30:28 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-6.xml [2011.09.18 06:24:58 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-7.xml [2011.10.12 19:53:18 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-8.xml [2011.10.20 21:34:39 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-9.xml [2011.07.25 01:19:29 | 000,001,056 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin.xml [2012.02.09 21:02:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.10.12 16:14:05 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.08.05 22:17:28 | 000,314,397 | ---- | M] () (No name found) -- C:\USERS\PATTY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JGZY3W0Y.DEFAULT\EXTENSIONS\{C50CA3C4-5656-43C2-A061-13E717F73FC8}.XPI [2011.04.14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll [2011.03.17 21:57:30 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Common Files\mcafee\systemcore\ScriptSn.20120719162333.dll (McAfee, Inc.) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120719162333.dll (McAfee, Inc.) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4:64bit: - HKLM..\Run: [Cm106Sound] C:\windows\Syswow64\cm106.dll (C-Media Corporation) O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [UMonit] C:\Windows\SysWOW64\UMonit.exe () O4:64bit: - HKLM..\Run: [Unattend0000000001{BFA3D12B-66DD-4617-923A-E864BC7D20B5}] C:\Windows\test.bat File not found O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [jmekey] C:\Program Files (x86)\jmesoft\hotkey.exe (JME) O4 - HKLM..\Run: [Launch SilverCrest SOML 807 A1] C:\Program Files (x86)\SilverCrest SOML 807 A1 Driver\MouClient_FD2_9063RL.exe (Siliten) O4 - HKLM..\Run: [Lenovo Dynamic Brightness System] C:\Program Files\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe (Lenovo) O4 - HKLM..\Run: [Lenovo Eye Distance System] C:\Program Files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe (Lenovo) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [ModeSwitch] C:\Program Files\Lenovo\Power Dial\LitModeSwitch.exe (Lenovo) O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Patty\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc) O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [MyTomTomSA.exe] C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe (TomTom) O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam2\steam.exe (Valve Corporation) O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) O4 - Startup: C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK = C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Free YouTube Download - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{47052FC8-237A-4868-A7AD-EF5D2AF3A5F8}: DhcpNameServer = 192.168.2.1 192.168.2.1 O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.) O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011.04.28 12:00:35 | 000,000,038 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ] O32 - AutoRun File - [2011.09.25 19:27:45 | 000,000,098 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O32 - AutoRun File - [2010.08.25 22:57:19 | 000,000,070 | R--- | M] () - G:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell - "" = AutoRun O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2011.09.25 19:27:45 | 003,811,542 | R--- | M] (RailSimulator.com ) O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell - "" = AutoRun O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell\AutoRun\command - "" = F:\autorun.exe O33 - MountPoints2\{fee118cd-5d70-11e0-9680-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{fee118cd-5d70-11e0-9680-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Setup.exe -- [2011.04.28 12:00:30 | 000,930,544 | R--- | M] () O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.08.12 12:47:35 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe [2012.08.12 12:42:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{43788298-41EE-4C8F-93F5-AFA140732A1A} [2012.08.12 12:42:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CDA71FB9-9609-4782-BEDD-454E9D35A85E} [2012.08.12 12:17:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee [2012.08.12 06:26:10 | 000,000,000 | ---D | C] -- C:\ProgramData\A2AC [2012.08.11 22:30:50 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C4169238-5F16-4C58-9E78-7844607B1626} [2012.08.11 22:30:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{10422F33-6829-4482-8025-37F4E70B1147} [2012.08.11 20:45:38 | 000,016,200 | ---- | C] (McAfee, Inc.) -- C:\windows\stinger.sys [2012.08.11 20:45:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\stinger [2012.08.11 20:20:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firestorm-Release [2012.08.11 18:16:28 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Malwarebytes [2012.08.11 18:16:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.11 18:16:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.11 18:16:11 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys [2012.08.11 18:16:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.08.11 17:51:58 | 000,027,256 | ---- | C] (Symantec Corporation) -- C:\windows\SysNative\drivers\FixZeroAccess.sys [2012.08.11 17:25:26 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\SpacialAudio [2012.08.11 05:50:18 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{0784EFAA-C5F6-41F1-9739-BC9F188BA877} [2012.08.11 05:50:07 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{644D5883-53A7-43C8-84FB-BB16238D36E4} [2012.08.10 17:49:55 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{77ACB6B2-1CFD-40F2-8DBE-791EA1EBD762} [2012.08.10 17:49:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4829B077-9FF2-4EAC-A9FA-C083A8923AEF} [2012.08.09 20:54:58 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SAM Broadcaster [2012.08.09 20:53:45 | 000,548,864 | ---- | C] (Firebird Project) -- C:\windows\SysWow64\GDS32.DLL [2012.08.09 20:53:45 | 000,548,864 | ---- | C] (Firebird Project) -- C:\windows\SysWow64\FBCLIENT.DLL [2012.08.09 20:53:40 | 000,462,848 | ---- | C] (IBPhoenix) -- C:\windows\SysWow64\Firebird2Control.cpl [2012.08.09 20:53:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firebird 2.5 (Win32) [2012.08.09 19:06:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MySQL [2012.08.09 17:32:21 | 000,000,000 | ---D | C] -- C:\windows\SysWow64\RTCOM [2012.08.09 17:32:12 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\windows\SysNative\SRSTSX64.dll [2012.08.09 17:32:12 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\windows\SysNative\SRSTSH64.dll [2012.08.09 17:32:12 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\windows\SysNative\SRSHP64.dll [2012.08.09 17:32:12 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\windows\SysNative\SRSWOW64.dll [2012.08.09 17:32:11 | 002,018,920 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RtPgEx64.dll [2012.08.09 17:32:11 | 001,210,984 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RTCOM64.dll [2012.08.09 17:32:11 | 001,146,984 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RTSnMg64.cpl [2012.08.09 17:32:11 | 000,476,264 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RtkApi64.dll [2012.08.09 17:32:11 | 000,372,936 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RTEEP64A.dll [2012.08.09 17:32:11 | 000,332,392 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RtlCPAPI64.dll [2012.08.09 17:32:11 | 000,307,920 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RP3DHT64.dll [2012.08.09 17:32:11 | 000,307,920 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RP3DAA64.dll [2012.08.09 17:32:11 | 000,201,928 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RTEED64A.dll [2012.08.09 17:32:11 | 000,149,608 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RtkCfg64.dll [2012.08.09 17:32:11 | 000,099,016 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RTEEL64A.dll [2012.08.09 17:32:11 | 000,076,904 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\SysNative\RCoInst64.dll [2012.08.09 17:32:11 | 000,076,488 | ---- | C] (Dolby Laboratories, Inc.) -- C:\windows\SysNative\RTEEG64A.dll [2012.08.09 17:32:09 | 000,330,656 | ---- | C] (Fortemedia Corporation) -- C:\windows\SysNative\FMAPO64.dll [2012.08.09 17:32:08 | 000,168,288 | ---- | C] (Andrea Electronics Corporation) -- C:\windows\SysNative\AERTAC64.dll [2012.08.09 17:32:08 | 000,108,960 | ---- | C] (Andrea Electronics Corporation) -- C:\windows\SysNative\AERTAR64.dll [2012.08.09 17:32:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek [2012.08.09 17:32:06 | 001,251,944 | ---- | C] (Realtek Semiconductor Corp.) -- C:\windows\RtlExUpd.dll [2012.08.09 17:26:49 | 000,000,000 | ---D | C] -- C:\Drivers [2012.08.09 17:04:59 | 000,000,000 | -H-D | C] -- C:\Lenovo [2012.08.09 16:32:16 | 000,000,000 | ---D | C] -- C:\download [2012.08.09 16:08:09 | 000,200,704 | ---- | C] (C-Media) -- C:\windows\SysWow64\cmpa106.dll [2012.08.09 16:07:38 | 001,310,720 | ---- | C] (C-Media Electronics Inc) -- C:\windows\SysNative\drivers\CM10664.sys [2012.08.09 16:07:38 | 000,315,392 | ---- | C] (C-Media Electronics Inc.) -- C:\windows\System\fltr106.dll [2012.08.09 16:00:30 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\MySQL [2012.08.09 15:50:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MySQL [2012.08.09 15:50:06 | 000,000,000 | ---D | C] -- C:\Program Files\MySQL [2012.08.09 15:45:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MySQL [2012.08.09 15:45:57 | 000,000,000 | ---D | C] -- C:\ProgramData\MySQL [2012.08.09 15:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Recorder Pro [2012.08.09 15:30:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audio Recorder Pro [2012.08.09 15:19:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SpacialAudio [2012.08.09 14:21:27 | 008,757,248 | ---- | C] (C-Media Corporation) -- C:\windows\SysWow64\CM106.dll [2012.08.09 14:19:06 | 000,524,768 | R--- | C] (Microsoft Corporation) -- C:\windows\difxapi.dll [2012.08.09 11:02:36 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{50D3CD2F-5BBD-4AEB-9F4D-D0FD715938B6} [2012.08.09 11:02:23 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C52C50E4-B394-4C78-9B63-EE1DCC4A1748} [2012.08.08 16:51:15 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{67AE11BC-0FA1-4FE9-9D77-A929C16A50DA} [2012.08.08 16:51:05 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5B3F7AF5-9622-49BC-978C-1DFC8FE167DC} [2012.08.08 04:50:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2DE48A7F-13FA-4B3C-867A-B5BED8D89584} [2012.08.08 04:50:38 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EB2430D0-09F2-4E7D-AC17-C596C5A10753} [2012.08.07 16:50:25 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{902A8010-2BC0-4E14-8D56-52B786DCED97} [2012.08.07 16:50:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{537784A7-F7C9-40B0-B2A9-35F7E49F7EEB} [2012.08.07 04:49:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{B22EC84C-C099-4204-A814-A18A458B8848} [2012.08.07 04:49:39 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C12CB901-8C4B-4C59-B76B-BA18B51DEC2A} [2012.08.06 17:32:41 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Quest3D [2012.08.06 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\Documents\ShipSimExtremes Userdata [2012.08.06 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Roaming [2012.08.06 14:17:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paradox Interactive [2012.08.06 14:13:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Paradox Interactive [2012.08.06 12:14:42 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5A103BE2-412A-4173-94DC-C862626DB820} [2012.08.06 12:14:32 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{9FD4CA43-867E-4AC6-AD33-B24F3A5515BC} [2012.08.06 00:14:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{80060651-833A-40A4-B494-3334B2C965F3} [2012.08.06 00:14:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C1A30172-67EE-4408-8E58-B9AEB4F9677D} [2012.08.05 21:20:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\SKIDROW [2012.08.05 21:17:27 | 000,000,000 | ---D | C] -- C:\Users\Patty\Desktop\Railworks.3.Train.Simulator.2012.Deluxe.Update.1.and.2-SKIDROW [2012.08.05 17:17:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RailSimulator.com [2012.08.05 17:05:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RailSimulator.com [2012.08.05 15:27:12 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\GamersFirst LIVE! [2012.08.05 15:26:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GamersFirst [2012.08.05 15:26:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GamersFirst [2012.08.05 12:13:54 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{03FD720F-DBF9-401B-8189-B4261869619C} [2012.08.05 12:13:44 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5CB3ED4C-F39C-4B0D-A543-02C55297BEEC} [2012.08.05 06:23:43 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\MusicNet [2012.08.05 06:23:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\Documents\My Received Files [2012.08.05 06:23:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\BearShare [2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BearShare Applications [2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BearShare [2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\ProgramData\BearShare [2012.08.05 06:22:11 | 000,000,000 | -H-D | C] -- C:\ProgramData\{D79D348D-B804-455D-BF34-7E3989C8E84D} [2012.08.04 23:04:02 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{08D5B1B0-1FF4-4217-89D8-6D5A547F9A90} [2012.08.04 23:03:52 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CA4E7870-57B6-4EE8-8AB7-C4AB8E20EF0F} [2012.08.04 11:03:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4D6D8287-0E4E-4567-9C9A-9A6673AED2FA} [2012.08.04 11:03:26 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5716A376-6562-40E7-8DAA-E80653258772} [2012.08.03 22:11:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{E2A6B2BB-5165-47F7-81AA-E8A006577E27} [2012.08.03 22:11:21 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F656B47B-DF56-4D13-BFEF-4F5A9F68E0D0} [2012.08.03 10:11:04 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2F8186E0-6AA5-4D6C-AF02-BE2FA4A1C64D} [2012.08.03 10:10:54 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D96B8060-E668-4431-AFF7-66D0EFF62369} [2012.08.02 11:40:19 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{654C4470-7FE1-4437-A839-57ECB2E26E2D} [2012.08.02 11:40:09 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{9B3B93E1-8BBA-4B62-A032-1C5483A1D256} [2012.08.01 18:44:47 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D70A40D9-3417-4B1C-AE92-15F8E591EDB3} [2012.08.01 18:44:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{369E81AD-2CD6-4B11-A78B-8BDDD055D357} [2012.08.01 10:50:53 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Apple Computer [2012.07.31 14:27:17 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{AE30EF49-1B32-4C60-B0FD-AF1B4713DEDF} [2012.07.31 14:27:07 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4588A487-460C-4323-B9C6-34CA4AE3F1B3} [2012.07.31 07:52:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2012.07.31 07:52:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime [2012.07.31 07:52:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer [2012.07.31 07:49:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [2012.07.31 02:26:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{06EC3F31-BDA1-47F1-9170-24201BCC7E6C} [2012.07.31 02:26:27 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{DA00BCF8-7CE7-4C2F-B00B-DAEEA95FAE9A} [2012.07.30 14:26:09 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{33A1E426-B16E-4A42-A223-E0F4CC3F8F1E} [2012.07.30 14:25:59 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D71F5E38-247B-4C63-A710-38AC32792AD2} [2012.07.29 17:59:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\BlueStacks [2012.07.29 17:59:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks [2012.07.29 17:59:14 | 000,000,000 | ---D | C] -- C:\ProgramData\BlueStacks [2012.07.29 17:59:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BlueStacks [2012.07.28 19:51:46 | 000,000,000 | ---D | C] -- C:\Crash [2012.07.28 19:35:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{0E185A8E-C61F-4694-A000-EDAA89F61D13} [2012.07.28 19:35:35 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{225EC41F-97C4-4DF3-B99B-99ED02249A81} [2012.07.28 06:35:59 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5387AD95-8366-4B9A-B4A5-2A59E3963F53} [2012.07.28 06:35:48 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8F59DF63-E9E1-406C-9FD5-282BDE3E9F85} [2012.07.27 18:35:32 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{459A40FA-767F-46B0-82FC-E779BB93FC5B} [2012.07.27 18:35:21 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D456A8CD-D8C6-43E3-9232-AE45215172C7} [2012.07.26 18:17:21 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5FD79D4C-E90D-4807-A795-859DD2BDD5EE} [2012.07.26 18:17:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{93AB20D9-B6CD-4E61-BCD4-7F813277F7D8} [2012.07.25 18:19:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{67C86C0C-D5BC-46D7-A2B3-A721DAF52EB1} [2012.07.25 18:19:00 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2C003E68-58E2-4C7D-8539-936EBA7CCCDD} [2012.07.24 20:25:58 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{1DDF11B6-D3BA-4B6C-89A6-1DA65F55D0E4} [2012.07.24 20:25:48 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{33C50227-FE70-4051-BF0C-2927C51B35CA} [2012.07.24 07:26:29 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F6A40DB3-DB4C-4C9E-A3D2-19EC57FBBE64} [2012.07.24 07:26:19 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{44DABC9B-1B18-4C56-AA87-2B8C96E21D85} [2012.07.22 04:13:58 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{363696BF-8702-4C39-ACF0-95327C4B0AB6} [2012.07.22 04:13:47 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CE4D98A1-92F9-485A-991A-21E90C5E2DDC} [2012.07.21 16:13:35 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{ED5665C7-8564-4DC5-9C4D-9CB00ACBF898} [2012.07.21 16:13:25 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{91111455-DA4A-4E46-9EC9-5B5CE872FF61} [2012.07.20 19:33:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C2D290B3-0BA1-4CD0-A775-55C85370EBA3} [2012.07.20 19:33:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EC626A97-5C24-429F-A209-AADF94DE3DD8} [2012.07.20 03:17:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5B781F55-2AFA-4C47-B0B3-4A8386C784BD} [2012.07.20 03:17:03 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C6B8F56A-11E2-437B-858F-1F464E828374} [2012.07.19 17:15:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Firestorm-Release [2012.07.19 16:23:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee.com [2012.07.19 16:23:33 | 000,010,248 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mfeclnk.sys [2012.07.19 16:23:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\McAfee [2012.07.19 16:23:25 | 000,487,296 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mfefirek.sys [2012.07.19 16:23:25 | 000,289,664 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mfewfpk.sys [2012.07.19 16:23:25 | 000,229,528 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mfeavfk.sys [2012.07.19 16:23:25 | 000,100,912 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mferkdet.sys [2012.07.19 16:23:25 | 000,075,936 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\mfenlfk.sys [2012.07.19 16:23:25 | 000,065,264 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\cfwids.sys [2012.07.19 16:23:16 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee.com [2012.07.19 16:23:16 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee [2012.07.19 16:17:41 | 000,162,224 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\mfevtps.exe [2012.07.19 15:16:39 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{84FBB7AE-DADD-4B7A-8945-6D40AA759C38} [2012.07.19 15:16:29 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{B6593ADA-5D5F-4BD5-84F1-6233CA68B460} [2012.07.18 18:26:02 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{6040063C-31F3-4AD6-B368-DB00DD47C0DE} [2012.07.18 18:25:52 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{B6EB9AEA-367E-4FC3-8229-C4CCA2A420AE} [2012.07.17 16:36:30 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{A773E046-7EA8-4C01-A760-FD9B7C3B4818} [2012.07.17 16:36:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5B00EBB7-EC99-4102-BF91-AE13BA088AFB} [2012.07.16 22:22:43 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CAC0F8BD-E0CE-48D1-B12C-007B11CF5F9E} [2012.07.16 22:22:33 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F30B0B73-6BDE-45CB-99A8-414979B4ACFE} [2012.07.16 10:22:22 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8D54D450-B2C0-4B92-9B10-9CE601D242DC} [2012.07.16 10:22:12 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5B418410-477B-4E12-9B08-95291EA03AAE} [2012.07.15 16:11:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8C494765-A4BC-4D08-B3D9-8D76B6D96937} [2012.07.15 16:11:21 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{170C644D-0935-47F4-912F-07FE2899C7A9} [2012.07.15 04:11:08 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2797F96B-C298-4438-A3F5-875CEA49AF9C} [2012.07.15 04:10:58 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{1E4AD127-9FEE-46B9-95C7-75471180BB5D} [2012.07.14 16:54:34 | 000,620,822 | ---- | C] (Macromedia, Inc.) -- C:\Users\Patty\Desktop\fluchomat.exe [2012.07.14 16:10:44 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{880659AD-3C60-4D2F-95FF-BCB5D356924D} [2012.07.14 16:10:34 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{A8CF678A-D8C2-4BB6-8BF1-133D6FABCC28} [2012.07.13 17:39:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CC572CFF-D4DC-4628-AD31-4EDBC9DF336D} [2012.07.13 17:39:39 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CB3C7443-5939-442A-85DF-B0A0B334F349} [2010.12.17 04:20:16 | 001,914,000 | ---- | C] (Adobe Systems Incorporated) -- C:\ProgramData\flashax10.exe [1 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ] [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.08.12 12:48:57 | 000,000,168 | ---- | M] () -- C:\Users\Patty\defogger_reenable [2012.08.12 12:47:35 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe [2012.08.12 12:47:22 | 000,050,477 | ---- | M] () -- C:\Users\Patty\Desktop\Defogger.exe [2012.08.12 12:26:00 | 000,001,108 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job [2012.08.12 12:17:35 | 000,001,828 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Internet Security Suite.lnk [2012.08.12 12:15:32 | 000,001,104 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2012.08.12 12:15:11 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2012.08.12 06:26:18 | 000,011,776 | ---- | M] () -- C:\Users\Patty\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.08.12 03:58:56 | 000,215,763 | ---- | M] () -- C:\Users\Patty\Desktop\Leck mich.jpg [2012.08.12 03:56:56 | 003,145,746 | ---- | M] () -- C:\Users\Patty\Desktop\Leck mich.tga [2012.08.11 21:10:25 | 000,017,360 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.11 21:10:25 | 000,017,360 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.11 21:03:00 | 523,132,927 | -HS- | M] () -- C:\hiberfil.sys [2012.08.11 20:45:38 | 000,016,200 | ---- | M] (McAfee, Inc.) -- C:\windows\stinger.sys [2012.08.11 20:20:18 | 000,001,321 | ---- | M] () -- C:\Users\Public\Desktop\Firestorm-Release.lnk [2012.08.11 19:28:01 | 001,501,666 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI [2012.08.11 19:28:01 | 000,655,070 | ---- | M] () -- C:\windows\SysNative\perfh007.dat [2012.08.11 19:28:01 | 000,616,952 | ---- | M] () -- C:\windows\SysNative\perfh009.dat [2012.08.11 19:28:01 | 000,130,394 | ---- | M] () -- C:\windows\SysNative\perfc007.dat [2012.08.11 19:28:01 | 000,106,784 | ---- | M] () -- C:\windows\SysNative\perfc009.dat [2012.08.11 18:16:19 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.11 17:58:54 | 000,027,256 | ---- | M] (Symantec Corporation) -- C:\windows\SysNative\drivers\FixZeroAccess.sys [2012.08.11 17:38:19 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerApp.exe [2012.08.11 17:38:18 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerCPLApp.cpl [2012.08.11 17:22:23 | 000,002,043 | ---- | M] () -- C:\Users\Patty\Desktop\SAM Broadcaster.lnk [2012.08.09 21:41:00 | 023,393,101 | ---- | M] () -- C:\Users\Patty\Desktop\sambc-fb-v492.exe [2012.08.09 21:39:03 | 000,128,512 | ---- | M] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.9.2-RES-patch.exe [2012.08.09 18:14:48 | 000,076,813 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt444444.wma [2012.08.09 18:11:48 | 000,000,784 | ---- | M] () -- C:\windows\Cm106.ini.cfl [2012.08.09 18:11:43 | 000,000,133 | ---- | M] () -- C:\windows\System\Dlap.pfx [2012.08.09 18:11:42 | 000,001,189 | ---- | M] () -- C:\windows\Cm106.ini.imi [2012.08.09 18:11:38 | 000,001,138 | ---- | M] () -- C:\windows\System\Cm106.ini [2012.08.09 17:47:06 | 000,049,873 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt222.wma [2012.08.09 17:43:27 | 000,103,753 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt1111.wma [2012.08.09 17:30:08 | 000,045,383 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt5678.wma [2012.08.09 17:04:58 | 000,002,175 | ---- | M] () -- C:\Users\Patty\Desktop\Lenovo Rescue System.lnk [2012.08.09 17:03:51 | 000,072,323 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt4567.wma [2012.08.09 16:57:07 | 000,067,833 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt3456.wma [2012.08.09 16:53:13 | 000,085,793 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt2345.wma [2012.08.09 16:49:32 | 000,274,373 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt1234.wma [2012.08.09 16:47:30 | 000,103,753 | ---- | M] () -- C:\Users\Patty\Documents\Test123.wma [2012.08.09 16:03:29 | 000,294,032 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT [2012.08.09 15:51:33 | 001,528,528 | ---- | M] () -- C:\windows\SysWow64\PerfStringBackup.INI [2012.08.09 15:50:58 | 000,000,238 | ---- | M] () -- C:\windows\ODBCINST.INI [2012.08.09 15:30:23 | 000,000,997 | ---- | M] () -- C:\Users\Patty\Desktop\Audio Recorder Pro.lnk [2012.08.09 11:10:21 | 000,189,248 | ---- | M] () -- C:\windows\SysWow64\PnkBstrB.exe [2012.08.09 11:10:14 | 000,189,248 | ---- | M] () -- C:\windows\SysWow64\PnkBstrB.ex0 [2012.08.09 11:10:10 | 000,076,888 | ---- | M] () -- C:\windows\SysWow64\PnkBstrA.exe [2012.08.09 04:12:44 | 000,001,864 | ---- | M] () -- C:\Users\Patty\Desktop\APBLauncher - Verknüpfung.lnk [2012.08.07 23:24:54 | 000,001,164 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk [2012.08.07 23:24:54 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\GamersFirst LIVE!.lnk [2012.08.06 14:17:17 | 000,002,247 | ---- | M] () -- C:\Users\Public\Desktop\Ship Simulator Extremes.lnk [2012.08.05 17:17:12 | 000,002,409 | ---- | M] () -- C:\Users\Public\Desktop\Railworks 3 Train Simulator 2012 Deluxe.lnk [2012.08.05 06:23:31 | 000,000,131 | ---- | M] () -- C:\Users\Public\Desktop\Emoticons for your messenger!.url [2012.08.02 04:28:58 | 616,782,876 | ---- | M] () -- C:\windows\MEMORY.DMP [2012.07.31 10:08:52 | 000,037,968 | ---- | M] () -- C:\Users\Patty\Documents\Colin.odt [2012.07.31 07:26:30 | 000,105,054 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_24737.jpg [2012.07.31 07:25:02 | 000,079,566 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_16862.jpg [2012.07.31 07:24:15 | 000,083,001 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_75443.jpg [2012.07.31 07:24:14 | 000,076,969 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_87561.jpg [2012.07.31 07:23:33 | 000,079,525 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_39538.jpg [2012.07.31 07:18:01 | 000,080,626 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_91947.jpg [2012.07.31 07:14:57 | 000,080,603 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_59933.jpg [2012.07.31 07:13:51 | 000,080,340 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_12583.jpg [2012.07.31 07:12:14 | 000,104,213 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_8293.jpg [2012.07.31 07:11:43 | 000,103,947 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_21134.jpg [2012.07.31 07:11:31 | 000,103,873 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_63998.jpg [2012.07.31 07:09:41 | 000,093,831 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_3232.jpg [2012.07.31 07:07:32 | 000,084,617 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_99150.jpg [2012.07.31 07:07:31 | 000,093,831 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_50305.jpg [2012.07.31 07:05:01 | 000,076,966 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_37039.jpg [2012.07.31 07:04:57 | 000,104,210 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_68910.jpg [2012.07.31 07:04:47 | 000,101,057 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_55054.jpg [2012.07.31 07:00:26 | 000,079,548 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_62165.jpg [2012.07.31 06:59:21 | 000,057,658 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_11327.jpg [2012.07.31 06:58:58 | 000,077,043 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_69895.jpg [2012.07.31 06:57:06 | 000,077,942 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_51895.jpg [2012.07.30 14:53:37 | 000,117,591 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_80839.jpg [2012.07.29 17:59:35 | 000,001,549 | ---- | M] () -- C:\Users\Patty\Desktop\Apps.lnk [2012.07.29 17:59:33 | 000,001,883 | ---- | M] () -- C:\Users\Patty\Desktop\Start BlueStacks.lnk [2012.07.19 17:15:59 | 000,002,098 | ---- | M] () -- C:\Users\Patty\Desktop\Empire - Verknüpfung.lnk [2012.07.16 18:43:15 | 000,002,441 | ---- | M] () -- C:\Users\Patty\Desktop\EverQuest II.lnk [1 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ] [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.08.12 12:48:57 | 000,000,168 | ---- | C] () -- C:\Users\Patty\defogger_reenable [2012.08.12 12:47:22 | 000,050,477 | ---- | C] () -- C:\Users\Patty\Desktop\Defogger.exe [2012.08.12 03:58:56 | 000,215,763 | ---- | C] () -- C:\Users\Patty\Desktop\Leck mich.jpg [2012.08.12 03:56:56 | 003,145,746 | ---- | C] () -- C:\Users\Patty\Desktop\Leck mich.tga [2012.08.11 20:20:18 | 000,001,321 | ---- | C] () -- C:\Users\Public\Desktop\Firestorm-Release.lnk [2012.08.11 18:16:19 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.11 17:59:13 | 000,000,804 | ---- | C] () -- C:\windows\Installer\{0ea5a4af-1013-3216-c893-c1d3f1639e8c}\L\00000004.@ [2012.08.10 18:01:28 | 023,393,101 | ---- | C] () -- C:\Users\Patty\Desktop\sambc-fb-v492.exe [2012.08.10 18:01:28 | 000,128,512 | ---- | C] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.9.2-RES-patch.exe [2012.08.09 20:54:58 | 000,002,043 | ---- | C] () -- C:\Users\Patty\Desktop\SAM Broadcaster.lnk [2012.08.09 18:14:48 | 000,076,813 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt444444.wma [2012.08.09 18:11:38 | 000,002,853 | ---- | C] () -- C:\windows\Cm106.ini.cfg [2012.08.09 18:11:38 | 000,001,189 | ---- | C] () -- C:\windows\Cm106.ini.imi [2012.08.09 17:47:06 | 000,049,873 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt222.wma [2012.08.09 17:43:27 | 000,103,753 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt1111.wma [2012.08.09 17:30:08 | 000,045,383 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt5678.wma [2012.08.09 17:03:51 | 000,072,323 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt4567.wma [2012.08.09 16:57:07 | 000,067,833 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt3456.wma [2012.08.09 16:53:13 | 000,085,793 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt2345.wma [2012.08.09 16:49:32 | 000,274,373 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt1234.wma [2012.08.09 16:47:30 | 000,103,753 | ---- | C] () -- C:\Users\Patty\Documents\Test123.wma [2012.08.09 16:08:14 | 000,491,520 | ---- | C] () -- C:\windows\System\cmau106.dll [2012.08.09 16:08:14 | 000,389,120 | ---- | C] () -- C:\windows\SysNative\CM106.cpl [2012.08.09 16:08:14 | 000,221,184 | ---- | C] () -- C:\windows\System\cm106eye.exe [2012.08.09 16:08:08 | 000,000,784 | ---- | C] () -- C:\windows\Cm106.ini.cfl [2012.08.09 15:50:58 | 000,000,238 | ---- | C] () -- C:\windows\ODBCINST.INI [2012.08.09 15:30:23 | 000,000,997 | ---- | C] () -- C:\Users\Patty\Desktop\Audio Recorder Pro.lnk [2012.08.09 14:21:28 | 000,143,360 | ---- | C] () -- C:\windows\Vmix106.dll [2012.08.09 14:21:20 | 000,808,176 | ---- | C] () -- C:\windows\SysNative\Cmeau106.exe [2012.08.09 14:21:20 | 000,000,133 | ---- | C] () -- C:\windows\System\Dlap.pfx [2012.08.09 14:19:07 | 000,359,424 | ---- | C] () -- C:\windows\SysNative\CmiInstallResAll64.dll [2012.08.09 11:10:14 | 000,189,248 | ---- | C] () -- C:\windows\SysWow64\PnkBstrB.exe [2012.08.09 11:10:14 | 000,189,248 | ---- | C] () -- C:\windows\SysWow64\PnkBstrB.ex0 [2012.08.09 11:10:10 | 000,076,888 | ---- | C] () -- C:\windows\SysWow64\PnkBstrA.exe [2012.08.09 04:12:44 | 000,001,864 | ---- | C] () -- C:\Users\Patty\Desktop\APBLauncher - Verknüpfung.lnk [2012.08.06 14:17:17 | 000,002,247 | ---- | C] () -- C:\Users\Public\Desktop\Ship Simulator Extremes.lnk [2012.08.05 17:17:12 | 000,002,409 | ---- | C] () -- C:\Users\Public\Desktop\Railworks 3 Train Simulator 2012 Deluxe.lnk [2012.08.05 15:26:47 | 000,001,164 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk [2012.08.05 15:26:47 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\GamersFirst LIVE!.lnk [2012.08.05 06:24:18 | 000,011,776 | ---- | C] () -- C:\Users\Patty\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.08.05 06:23:31 | 000,000,131 | ---- | C] () -- C:\Users\Public\Desktop\Emoticons for your messenger!.url [2012.07.31 10:08:38 | 000,037,968 | ---- | C] () -- C:\Users\Patty\Documents\Colin.odt [2012.07.31 07:26:30 | 000,105,054 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_24737.jpg [2012.07.31 07:25:02 | 000,079,566 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_16862.jpg [2012.07.31 07:24:15 | 000,083,001 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_75443.jpg [2012.07.31 07:24:14 | 000,076,969 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_87561.jpg [2012.07.31 07:23:33 | 000,079,525 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_39538.jpg [2012.07.31 07:18:01 | 000,080,626 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_91947.jpg [2012.07.31 07:14:57 | 000,080,603 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_59933.jpg [2012.07.31 07:13:51 | 000,080,340 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_12583.jpg [2012.07.31 07:12:14 | 000,104,213 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_8293.jpg [2012.07.31 07:11:43 | 000,103,947 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_21134.jpg [2012.07.31 07:11:31 | 000,103,873 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_63998.jpg [2012.07.31 07:09:41 | 000,093,831 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_3232.jpg [2012.07.31 07:07:32 | 000,084,617 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_99150.jpg [2012.07.31 07:07:31 | 000,093,831 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_50305.jpg [2012.07.31 07:05:01 | 000,076,966 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_37039.jpg [2012.07.31 07:04:57 | 000,104,210 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_68910.jpg [2012.07.31 07:04:47 | 000,101,057 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_55054.jpg [2012.07.31 07:00:26 | 000,079,548 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_62165.jpg [2012.07.31 06:59:21 | 000,057,658 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_11327.jpg [2012.07.31 06:58:58 | 000,077,043 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_69895.jpg [2012.07.31 06:57:06 | 000,077,942 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_51895.jpg [2012.07.30 14:53:37 | 000,117,591 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_80839.jpg [2012.07.29 17:59:35 | 000,001,549 | ---- | C] () -- C:\Users\Patty\Desktop\Apps.lnk [2012.07.29 17:59:33 | 000,001,883 | ---- | C] () -- C:\Users\Patty\Desktop\Start BlueStacks.lnk [2012.07.19 16:24:19 | 000,001,828 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Internet Security Suite.lnk [2012.07.16 18:40:11 | 000,002,469 | ---- | C] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EverQuest II.lnk [2012.07.16 18:40:11 | 000,002,441 | ---- | C] () -- C:\Users\Patty\Desktop\EverQuest II.lnk [2012.05.30 13:54:51 | 000,005,191 | ---- | C] () -- C:\Users\Patty\.recently-used.xbel [2012.03.12 19:41:18 | 000,077,653 | ---- | C] () -- C:\Users\Patty\ESt2011_Mustermann_Max.elfo [2012.01.11 00:03:11 | 000,002,048 | -HS- | C] () -- C:\windows\Installer\{0ea5a4af-1013-3216-c893-c1d3f1639e8c}\@ [2011.06.05 21:20:00 | 000,005,120 | ---- | C] () -- C:\Users\Patty\AppData\Local\Databases.db [2011.04.28 12:00:32 | 000,001,201 | ---- | C] () -- C:\windows\cm106.ini [2011.04.03 20:41:07 | 001,528,528 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI [2010.12.17 12:30:39 | 000,201,728 | ---- | C] () -- C:\windows\SetDrive.exe [2010.12.17 12:30:37 | 000,036,864 | ---- | C] () -- C:\windows\WinWait.exe [2010.12.17 03:40:36 | 000,139,264 | ---- | C] () -- C:\windows\SysWow64\ustor.dll [2010.12.17 03:40:36 | 000,040,960 | ---- | C] () -- C:\windows\SysWow64\UMonit.exe [2010.12.17 03:40:33 | 000,001,393 | ---- | C] () -- C:\windows\SysWow64\IconCfg0.ini [2010.12.17 03:40:33 | 000,000,722 | ---- | C] () -- C:\windows\SysWow64\ProductName.ini [2010.12.17 03:38:01 | 000,008,192 | ---- | C] () -- C:\windows\SysWow64\drivers\IntelMEFWVer.dll < End of report > Die restlichen Logs hab ich mal komplett gezippt und in den Anhang gepostet. Hoffe ihr könnt mir helfen, danke schonmal im Voraus! Gruß Patty80LE Achso, wichtig vllt auch noch zu Wissen: Ich habe in der ersten Panik die befallene Datei gelöscht, und zwar die Desktop.ini ... Habe erst danach hier im Forum nachgelesen und dabei fiel mir auf das man eigentlich nichts löschen soll ohne Anweisung. Nunja, nicht mehr zu ändern, dachte nur könnte vllt von Interesse sein. |
|
12.08.2012, 21:59
| #2 |
| | ZeroAccess Trojaner in der Desktop.ini gefunden Natürlich die Logfiles noch vergessen, sorry -.-
__________________ |
|
22.08.2012, 01:07
| #3 |
| /// Helfer-Team  | ZeroAccess Trojaner in der Desktop.ini gefunden Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
O4:64bit: - HKLM..\Run: [UMonit] C:\Windows\SysWOW64\UMonit.exe ()
O4:64bit: - HKLM..\Run: [Unattend0000000001{BFA3D12B-66DD-4617-923A-E864BC7D20B5}] C:\Windows\test.bat File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Patty\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
[2012.08.11 17:59:13 | 000,000,804 | ---- | C] () -- C:\windows\Installer\{0ea5a4af-1013-3216-c893-c1d3f1639e8c}\L\00000004.@
[2012.01.11 00:03:11 | 000,002,048 | -HS- | C] () -- C:\windows\Installer\{0ea5a4af-1013-3216-c893-c1d3f1639e8c}\@
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ |
|
28.08.2012, 19:07
| #4 |
| | ZeroAccess Trojaner in der Desktop.ini gefunden Hallo nochmal, komme leider erst jetzt dazu mich wieder um das PC-Problem zu kümmern. Ich glaube in der zwischenzeit ist noch ein BKA-Trojaner aktiv geworden, mir wurde heute eine Seite angezeigt auf der zur eingabe eines Pasafe-Codes aufgefordert wurde und der PC angeblich gesperrt wurde. Daher nochmal die aktuelle MWB-Log anbei. Code:
ATTFilter Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.28.06 Windows 7 x64 NTFS Internet Explorer 8.0.7600.16385 Patty :: PATTY-PC [Administrator] 28.08.2012 17:35:37 mbam-log-2012-08-28 (20-03-23).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|Q:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 891945 Laufzeit: 2 Stunde(n), 25 Minute(n), 39 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 1 HKCR\regfile\shell\open\command| (Broken.OpenCommand) -> Bösartig: ("regedit.exe" "%1") Gut: (regedit.exe "%1") -> Keine Aktion durchgeführt. Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 5 C:\Users\Patty\AppData\Local\Temp\roper0dun.exe (Trojan.PWS) -> Keine Aktion durchgeführt. C:\Users\Patty\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\5441db48-4192fdbe (Trojan.PWS) -> Keine Aktion durchgeführt. C:\Users\Patty\Documents\MusicConverterSetup.exe (Adware.Agent) -> Keine Aktion durchgeführt. C:\Users\Patty\Downloads\mymusictubesetup_FF.exe (Adware.RKN) -> Keine Aktion durchgeführt. C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt. (Ende) LG |
|
29.08.2012, 01:38
| #5 |
| /// Helfer-Team | ZeroAccess Trojaner in der Desktop.ini gefunden Wo ist das Log vom Fix? Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log> Broken.OpenCommand HKCR\regfile\shell\open\command|Trojan.PWS C:\Users\Patty\AppData\Local\Temp\roper0dun.exeAdware.Agent C:\Users\Patty\Documents\MusicConverterSetup.exeAdware.RKN C:\Users\Patty\Downloads\mymusictubesetup_FF.exeTrojan.Ransom.Gen C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk |
|
29.08.2012, 02:29
| #6 |
| | ZeroAccess Trojaner in der Desktop.ini gefunden Naja, wie gesagt, ich habe den fix nun nicht durchgeführt weil ich dachte das der nun nicht mehr aktuell ist nach so langer zeit... Daher auch kein logfile. Soll ich den fix denn trotzdem so durchführen wie beschrieben? |
|
29.08.2012, 03:09
| #7 |
| /// Helfer-Team | ZeroAccess Trojaner in der Desktop.ini gefunden Woher weiss ich, dass ich nicht wieder vergeblich einen Fix erstelle? |
|
29.08.2012, 04:32
| #8 |
| | ZeroAccess Trojaner in der Desktop.ini gefunden ja wie gesagt, tut mir leid , ich kam aus Real-Life gründen vorher dazu das problem zu beseitigen...  |
|
29.08.2012, 05:06
| #9 |
| /// Helfer-Team | ZeroAccess Trojaner in der Desktop.ini gefunden CustomScan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.*
%APPDATA%\*AcroIEH*.*
%APPDATA%\*.exe
%APPDATA%\*.tmp
CREATERESTOREPOINT
|
|
29.08.2012, 12:55
| #10 |
| | ZeroAccess Trojaner in der Desktop.ini gefunden Hallo, hier das Ergebnis des Scans mit OTL: Code:
ATTFilter OTL logfile created on: 29.08.2012 13:32:28 - Run 2 OTL by OldTimer - Version 3.2.59.1 Folder = C:\Users\Patty\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,98 Gb Total Physical Memory | 4,88 Gb Available Physical Memory | 81,62% Memory free 11,96 Gb Paging File | 9,74 Gb Available in Paging File | 81,39% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 906,34 Gb Total Space | 384,84 Gb Free Space | 42,46% Space Free | Partition Type: NTFS Drive E: | 3,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Drive G: | 1,57 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Drive I: | 1,87 Gb Total Space | 0,13 Gb Free Space | 6,85% Space Free | Partition Type: FAT Computer Name: PATTY-PC | User Name: Patty | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.28 17:43:43 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe PRC - [2012.08.09 11:10:21 | 000,189,248 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrB.exe PRC - [2012.08.09 11:10:10 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2012.07.10 14:18:10 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2011.03.18 09:11:51 | 000,031,744 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe PRC - [2011.03.09 14:30:08 | 000,092,592 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe PRC - [2011.02.24 17:06:42 | 000,511,448 | ---- | M] (TomTom) -- C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe PRC - [2011.01.20 11:20:12 | 001,305,408 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe PRC - [2010.09.17 11:14:50 | 000,098,304 | ---- | M] (Firebird Project) -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe PRC - [2010.09.17 11:14:42 | 003,735,552 | ---- | M] (Firebird Project) -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe PRC - [2010.09.13 19:32:32 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2010.09.01 06:26:04 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe PRC - [2010.08.30 00:07:34 | 000,096,752 | ---- | M] () -- C:\Program Files (x86)\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe PRC - [2010.01.21 08:40:59 | 000,040,960 | ---- | M] () -- C:\Windows\SysWOW64\UMonit.exe PRC - [2009.09.30 12:19:30 | 000,049,152 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Power Dial\LenovoCOMSvc.exe PRC - [2006.11.03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\Pac207\Monitor.exe ========== Modules (No Company Name) ========== MOD - [2011.03.18 09:11:51 | 000,031,744 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\hcdll2_ex_Win32.exe MOD - [2011.02.24 17:06:44 | 000,161,240 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\TomTomSupporterProxy.dll MOD - [2011.02.24 17:06:44 | 000,047,576 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\TomTomSupporterBase.dll MOD - [2011.02.24 17:06:34 | 007,508,480 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtGui4.dll MOD - [2011.02.24 17:06:34 | 002,101,760 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtCore4.dll MOD - [2011.02.24 17:06:34 | 000,911,872 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtNetwork4.dll MOD - [2011.02.24 17:06:34 | 000,334,848 | ---- | M] () -- C:\Program Files (x86)\MyTomTom 3\QtXml4.dll MOD - [2010.04.21 11:00:35 | 000,058,368 | ---- | M] () -- C:\Program Files (x86)\Hardcopy\HcDLL2_30_Win32.dll MOD - [2010.01.21 08:40:59 | 000,040,960 | ---- | M] () -- C:\Windows\SysWOW64\UMonit.exe MOD - [2009.10.26 09:52:38 | 000,139,264 | ---- | M] () -- C:\Windows\SysWOW64\ustor.dll ========== Services (SafeList) ========== SRV:64bit: - [2012.05.25 17:13:54 | 000,162,224 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Windows\SysNative\mfevtps.exe -- (mfevtp) SRV:64bit: - [2012.05.25 16:59:02 | 000,210,616 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire) SRV:64bit: - [2012.05.25 16:58:32 | 000,199,304 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (MSK80Service) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McProxy) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNASvc) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McMPFSvc) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service) SRV - [2012.08.23 11:57:48 | 000,502,064 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee\VirusScan\mcods.exe -- (McODS) SRV - [2012.08.09 11:10:21 | 000,189,248 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB) SRV - [2012.08.09 11:10:10 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2012.08.07 00:07:41 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.07.10 20:31:31 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai) SRV - [2012.07.10 14:18:10 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc) SRV - [2012.07.10 14:17:20 | 000,397,704 | ---- | M] (BlueStack Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc) SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2011.07.05 11:20:12 | 002,428,968 | ---- | M] (mobile concepts GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\CyberGhost VPN\CGVPNCliService.exe -- (CGVPNCliSrvc) SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2011.03.09 14:30:08 | 000,092,592 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService) SRV - [2011.03.01 18:29:58 | 000,130,976 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service) SRV - [2010.09.29 18:47:00 | 004,032,992 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc) SRV - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.09.17 11:14:50 | 000,098,304 | ---- | M] (Firebird Project) [Auto | Running] -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance) SRV - [2010.09.17 11:14:42 | 003,735,552 | ---- | M] (Firebird Project) [On_Demand | Running] -- C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe -- (FirebirdServerDefaultInstance) SRV - [2010.09.13 19:32:32 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2010.09.09 12:46:14 | 000,081,920 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Programme\Lenovo\Power Dial\LitModeCtrl.exe -- (LitModeCtrl) SRV - [2010.08.30 00:07:34 | 000,096,752 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe -- (CEEBC40A-FDED-4C59-B354-939132350B01) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.09.30 12:19:30 | 000,049,152 | ---- | M] (Lenovo) [Auto | Running] -- C:\Programme\Lenovo\Power Dial\LenovoCOMSvc.exe -- (LenovoCOMSvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.22 13:29:46 | 000,647,208 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk) DRV:64bit: - [2012.02.22 13:29:46 | 000,487,296 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek) DRV:64bit: - [2012.02.22 13:29:46 | 000,289,664 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk) DRV:64bit: - [2012.02.22 13:29:46 | 000,229,528 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk) DRV:64bit: - [2012.02.22 13:29:46 | 000,160,792 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk) DRV:64bit: - [2012.02.22 13:29:46 | 000,100,912 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mferkdet.sys -- (mferkdet) DRV:64bit: - [2012.02.22 13:29:46 | 000,075,936 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfenlfk.sys -- (mfenlfk) DRV:64bit: - [2012.02.22 13:29:46 | 000,065,264 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids) DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2011.05.30 14:02:12 | 000,046,112 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tbhsd.sys -- (tbhsd) DRV:64bit: - [2011.05.08 16:20:10 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2010.11.12 01:10:49 | 000,155,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2010.10.20 10:58:44 | 000,015,360 | ---- | M] (Siliten) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MouFilter_FlexDef4.sys -- (MouFilter_Mou_FlexDef4) DRV:64bit: - [2010.09.21 08:34:18 | 000,313,520 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress) DRV:64bit: - [2010.09.21 03:59:38 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2010.09.13 19:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2010.06.19 08:36:04 | 000,017,920 | ---- | M] (Siliten) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\InputFilter_FlexDef2b.sys -- (InputFilter_Hid_FlexDef2b) DRV:64bit: - [2010.02.25 18:51:02 | 000,029,696 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901) DRV:64bit: - [2010.02.22 04:49:58 | 000,052,224 | ---- | M] (Genesys Logic) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ustor2k.sys -- (USTOR2K) DRV:64bit: - [2009.12.01 15:49:52 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc) DRV:64bit: - [2009.07.21 15:20:06 | 000,121,840 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd) DRV:64bit: - [2009.07.14 15:36:28 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx) DRV:64bit: - [2009.07.13 23:59:33 | 005,020,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2009.07.01 11:54:54 | 000,030,728 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGPBTDD.sys -- (LGPBTDD) DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009.06.10 22:35:53 | 000,051,712 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rtnic64.sys -- (RTL8023x64) DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer) DRV:64bit: - [2008.04.08 07:43:04 | 000,020,832 | ---- | M] (Nicomsoft Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ddcdrv.sys -- (WinI2C-DDC) DRV:64bit: - [2006.12.05 11:34:26 | 000,572,416 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PFC027.SYS -- (PAC207) DRV:64bit: - [2006.09.19 15:43:54 | 000,018,224 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2012.07.10 14:18:02 | 000,075,144 | ---- | M] (BlueStack Systems) [Kernel | Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys -- (BstHdDrv) DRV - [2010.03.22 19:13:08 | 000,015,712 | ---- | M] (Nicomsoft Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysWOW64\drivers\ddcdrv.sys -- (WinI2C-DDC) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2004.12.31 08:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data] IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ [binary data] IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=102875&gct=hp IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{BB0E13C0-0E3B-4F5F-B31B-48697D1BA5AA}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=HIP&o=102875&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=6F&apn_dtid=YYYYYYYYDE&apn_uid=434a70d5-6584-4c56-9114-95d72b6672f1&apn_sauid=689AA487-0083-4700-8AE2-C6C3A6F3E2E7 IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=;ftp=;https=; ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q=" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=102875&gct=hp" FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.3&q=" FF - prefs.js..network.proxy.gopher: "" FF - prefs.js..network.proxy.gopher_port: 0 FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.type: 0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\windows\system32\npDeployJava1.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL () FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll () FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll File not found FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~2\mcafee\msc\npmcsn~1.dll () FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.9: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Users\Patty\AppData\LocalLow\Sony Online Entertainment\npsoe.dll () FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Nightly 17.0a1\extensions\\Components: C:\PROGRAM FILES\NIGHTLY\COMPONENTS [2012.08.14 04:00:23 | 000,000,000 | ---D | M] 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Nightly 17.0a1\extensions\\Plugins: C:\PROGRAM FILES\NIGHTLY\PLUGINS FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore [2012.07.19 16:23:40 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2012.08.14 02:48:27 | 000,000,000 | ---D | M] [2011.04.11 17:54:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Extensions [2011.04.11 17:54:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com [2012.08.05 22:17:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions [2012.07.25 21:29:41 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2011.06.12 20:18:27 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.03.30 02:42:30 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012.07.17 22:09:05 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\extensions\toolbar@ask.com [2012.07.17 22:09:05 | 000,002,325 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\askcom.xml [2012.08.23 12:38:29 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-1.xml [2011.10.30 14:47:09 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-10.xml [2011.11.02 22:10:31 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-11.xml [2011.11.10 18:49:21 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-12.xml [2011.12.07 20:16:25 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-13.xml [2011.12.23 16:57:23 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-14.xml [2011.12.29 22:06:52 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-15.xml [2012.02.03 21:54:08 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-16.xml [2012.02.09 21:06:57 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-17.xml [2011.08.11 04:23:30 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-2.xml [2011.08.19 16:46:11 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-3.xml [2011.09.03 13:08:10 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-4.xml [2011.09.04 14:32:11 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-5.xml [2011.09.13 04:30:28 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-6.xml [2011.09.18 06:24:58 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-7.xml [2011.10.12 19:53:18 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-8.xml [2011.10.20 21:34:39 | 000,000,950 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin-9.xml [2011.07.25 01:19:29 | 000,001,056 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Mozilla\Firefox\Profiles\jgzy3w0y.default\searchplugins\icqplugin.xml [2012.02.09 21:02:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.10.12 16:14:05 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.08.05 22:17:28 | 000,314,397 | ---- | M] () (No name found) -- C:\USERS\PATTY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JGZY3W0Y.DEFAULT\EXTENSIONS\{C50CA3C4-5656-43C2-A061-13E717F73FC8}.XPI [2011.04.14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll [2011.03.17 21:57:30 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Common Files\mcafee\systemcore\ScriptSn.20120719162333.dll (McAfee, Inc.) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120719162333.dll (McAfee, Inc.) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [UMonit] C:\Windows\SysWOW64\UMonit.exe () O4:64bit: - HKLM..\Run: [Unattend0000000001{BFA3D12B-66DD-4617-923A-E864BC7D20B5}] C:\Windows\test.bat File not found O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [jmekey] C:\Program Files (x86)\jmesoft\hotkey.exe (JME) O4 - HKLM..\Run: [Launch SilverCrest SOML 807 A1] C:\Program Files (x86)\SilverCrest SOML 807 A1 Driver\MouClient_FD2_9063RL.exe (Siliten) O4 - HKLM..\Run: [Lenovo Dynamic Brightness System] C:\Program Files\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe (Lenovo) O4 - HKLM..\Run: [Lenovo Eye Distance System] C:\Program Files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe (Lenovo) O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [ModeSwitch] C:\Program Files\Lenovo\Power Dial\LitModeSwitch.exe (Lenovo) O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [Akamai NetSession Interface] C:\Users\Patty\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [ICQ] C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.) O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [MyTomTomSA.exe] C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe (TomTom) O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [Steam] C:\Program Files (x86)\Steam2\steam.exe (Valve Corporation) O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [TomTomHOME.exe] C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK = C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Free YouTube Download - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: freerealms.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: soe.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: sony.com ([]* in Trusted sites) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{47052FC8-237A-4868-A7AD-EF5D2AF3A5F8}: DhcpNameServer = 192.168.2.1 192.168.2.1 O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.) O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011.09.25 19:27:45 | 000,000,098 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O32 - AutoRun File - [2010.08.25 22:57:19 | 000,000,070 | R--- | M] () - G:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell - "" = AutoRun O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2011.09.25 19:27:45 | 003,811,542 | R--- | M] (RailSimulator.com ) O33 - MountPoints2\{8e6cfc5a-8575-11e1-8576-406186747ef6}\Shell - "" = AutoRun O33 - MountPoints2\{8e6cfc5a-8575-11e1-8576-406186747ef6}\Shell\AutoRun\command - "" = G:\Setup.exe -- [2010.08.25 22:57:19 | 001,518,798 | R--- | M] (Paradox Interactive ) O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell - "" = AutoRun O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell\AutoRun\command - "" = F:\autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) SafeBootMin:64bit: AppMgmt - Service SafeBootMin:64bit: Base - Driver Group SafeBootMin:64bit: Boot Bus Extender - Driver Group SafeBootMin:64bit: Boot file system - Driver Group SafeBootMin:64bit: File system - Driver Group SafeBootMin:64bit: Filter - Driver Group SafeBootMin:64bit: HelpSvc - Service SafeBootMin:64bit: mcmscsvc - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.) SafeBootMin:64bit: PCI Configuration - Driver Group SafeBootMin:64bit: PNP Filter - Driver Group SafeBootMin:64bit: Primary disk - Driver Group SafeBootMin:64bit: sacsvr - Service SafeBootMin:64bit: SCSI Class - Driver Group SafeBootMin:64bit: System Bus Extender - Driver Group SafeBootMin:64bit: vmms - Service SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet:64bit: AppMgmt - Service SafeBootNet:64bit: Base - Driver Group SafeBootNet:64bit: Boot Bus Extender - Driver Group SafeBootNet:64bit: Boot file system - Driver Group SafeBootNet:64bit: File system - Driver Group SafeBootNet:64bit: Filter - Driver Group SafeBootNet:64bit: HelpSvc - Service SafeBootNet:64bit: McMPFSvc - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.) SafeBootNet:64bit: mcmscsvc - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.) SafeBootNet:64bit: Messenger - Service SafeBootNet:64bit: mfefire - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe () SafeBootNet:64bit: mfefirek - C:\Windows\SysNative\drivers\mfefirek.sys (McAfee, Inc.) SafeBootNet:64bit: mfefirek.sys - C:\Windows\SysNative\drivers\mfefirek.sys (McAfee, Inc.) SafeBootNet:64bit: mfehidk - C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.) SafeBootNet:64bit: mfehidk.sys - C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.) SafeBootNet:64bit: mfevtp - C:\Windows\SysNative\mfevtps.exe (McAfee, Inc.) SafeBootNet:64bit: NDIS Wrapper - Driver Group SafeBootNet:64bit: NetBIOSGroup - Driver Group SafeBootNet:64bit: NetDDEGroup - Driver Group SafeBootNet:64bit: Network - Driver Group SafeBootNet:64bit: NetworkProvider - Driver Group SafeBootNet:64bit: PCI Configuration - Driver Group SafeBootNet:64bit: PNP Filter - Driver Group SafeBootNet:64bit: PNP_TDI - Driver Group SafeBootNet:64bit: Primary disk - Driver Group SafeBootNet:64bit: rdsessmgr - Service SafeBootNet:64bit: sacsvr - Service SafeBootNet:64bit: SCSI Class - Driver Group SafeBootNet:64bit: Streams Drivers - Driver Group SafeBootNet:64bit: System Bus Extender - Driver Group SafeBootNet:64bit: TDI - Driver Group SafeBootNet:64bit: vmms - Service SafeBootNet:64bit: WudfUsbccidDriver - Driver SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L) Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.l3codec - C:\windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.vorbis - C:\windows\SysWow64\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/) Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.) Drivers32: VIDC.FPS1 - C:\windows\SysWow64\frapsvid.dll (Beepa P/L) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.08.29 13:07:25 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F27CA0D7-EA74-46DC-87E3-76A5F385290A} [2012.08.29 01:07:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8A0A13CF-B84A-4D32-B950-6E30A7267008} [2012.08.28 18:39:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee [2012.08.28 17:43:37 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe [2012.08.28 17:33:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.28 17:33:52 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys [2012.08.28 13:06:51 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{66EFFEE9-1421-4959-B26C-C65CF52647F3} [2012.08.28 01:06:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{FDF3A868-9559-4E48-B3CF-762C40E60161} [2012.08.27 13:06:16 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{A8A3D581-F6C2-45FC-825C-7F0796F45FC6} [2012.08.27 01:06:04 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{21A39D6D-EA71-4283-B9F1-744FD0D96DC7} [2012.08.26 13:05:53 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F76A08CF-E493-4B6C-9C5A-8A9DDB6CD96B} [2012.08.26 01:05:42 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4B0E1CB6-7612-44FC-9C58-6E1F75750D81} [2012.08.25 13:05:18 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{006FFBF3-68AF-46EB-982D-F1258387A17F} [2012.08.25 01:05:07 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{01345E16-A15F-4424-B2BD-0F5CDADA05EA} [2012.08.24 13:04:56 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EF932FC5-629B-4B57-838F-C25CD2664552} [2012.08.23 23:46:19 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D7925CF1-3ACE-4D50-9A67-859E76FD0B70} [2012.08.23 11:46:08 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{16FCAC01-B339-4BF3-B6C2-E7D905629C32} [2012.08.22 23:45:57 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{B099A377-1808-4070-A9AC-1E044839615E} [2012.08.22 11:45:46 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{77EF1655-0284-485B-8022-71B13756B933} [2012.08.21 21:58:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{861D9AA2-A23C-450A-9F0B-1FC04D17B9E5} [2012.08.21 21:16:00 | 000,000,000 | ---D | C] -- C:\Users\Patty\Desktop\Bilder2 [2012.08.21 21:14:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\Desktop\Bilder PCNEU [2012.08.20 12:14:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment [2012.08.20 11:54:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft [2012.08.20 10:56:09 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{313764A7-09F4-41AB-AA8D-2E8C704B5813} [2012.08.20 10:12:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard [2012.08.20 10:11:31 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Blizzard Entertainment [2012.08.20 10:04:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment [2012.08.19 22:55:58 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8F99F755-7A42-4CA6-B8F9-9D3F025103FB} [2012.08.19 21:47:28 | 000,000,000 | ---D | C] -- C:\WoW [2012.08.19 21:46:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WoW [2012.08.19 10:55:47 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{39AA1D65-9D57-4BFE-BD40-F7B15A9A8F10} [2012.08.18 15:27:52 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D6072E7D-F25F-489D-BB2D-C05536D64B63} [2012.08.18 15:27:42 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{408129A9-7E22-41E7-97AF-92A28AF41A8B} [2012.08.17 04:23:32 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EA54E2DE-3447-4DD0-9176-EFCA0F659AE1} [2012.08.17 04:23:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{E3956F9D-366A-44FF-B796-675B2BE0F4DE} [2012.08.16 16:23:06 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{94CF0498-3A43-42E2-86B6-ED587FA6736A} [2012.08.16 16:22:55 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D9118002-AA53-4B97-84F6-8D45771D2483} [2012.08.16 04:22:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EA7252BB-4101-4B9E-B571-839EEE989921} [2012.08.16 04:22:29 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{878426E6-1655-45C7-87E7-EE238CDADFB2} [2012.08.15 16:22:16 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{9B622767-A61B-46C5-926C-6D5224DD67C7} [2012.08.15 16:22:02 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CEABADBC-252D-42F1-A48D-20D5A5CEBBCE} [2012.08.15 04:21:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CDA0A941-DC90-43A7-BD51-EF4353F49F7E} [2012.08.15 04:21:34 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C623443A-8CC5-4484-B4E7-DE7FD33C7591} [2012.08.14 16:21:22 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{62722B0D-B2DF-439A-B21F-F03827FE4413} [2012.08.14 16:21:12 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D2532EA9-6606-4158-B3DF-0E3CD2DF7CCB} [2012.08.14 03:58:25 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SAM Broadcaster [2012.08.13 21:30:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firestorm-Release [2012.08.13 21:28:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Firestorm-Release [2012.08.13 18:53:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Second Life Viewer [2012.08.13 18:52:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SecondLifeViewer [2012.08.13 12:43:24 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{8A311A33-C09D-4946-BC8C-335D6D0BC2BC} [2012.08.13 12:43:13 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{AF2ED083-8313-4343-A62F-F64F2A9FF9C6} [2012.08.13 00:42:59 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{6AC2517B-9545-4C63-B112-8880C78C95A2} [2012.08.13 00:42:48 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{1CF3849B-4908-4ABA-A7AE-66DC82569A7C} [2012.08.12 12:42:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{43788298-41EE-4C8F-93F5-AFA140732A1A} [2012.08.12 12:42:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CDA71FB9-9609-4782-BEDD-454E9D35A85E} [2012.08.12 06:26:10 | 000,000,000 | ---D | C] -- C:\ProgramData\A2AC [2012.08.11 22:30:50 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C4169238-5F16-4C58-9E78-7844607B1626} [2012.08.11 22:30:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{10422F33-6829-4482-8025-37F4E70B1147} [2012.08.11 18:16:28 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Malwarebytes [2012.08.11 18:16:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.11 18:16:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.08.11 17:25:26 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\SpacialAudio [2012.08.11 05:50:18 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{0784EFAA-C5F6-41F1-9739-BC9F188BA877} [2012.08.11 05:50:07 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{644D5883-53A7-43C8-84FB-BB16238D36E4} [2012.08.10 17:49:55 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{77ACB6B2-1CFD-40F2-8DBE-791EA1EBD762} [2012.08.10 17:49:45 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4829B077-9FF2-4EAC-A9FA-C083A8923AEF} [2012.08.09 17:26:49 | 000,000,000 | ---D | C] -- C:\Drivers [2012.08.09 17:04:59 | 000,000,000 | -H-D | C] -- C:\Lenovo [2012.08.09 16:32:16 | 000,000,000 | ---D | C] -- C:\download [2012.08.09 16:00:30 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\MySQL [2012.08.09 15:50:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MySQL [2012.08.09 15:50:06 | 000,000,000 | ---D | C] -- C:\Program Files\MySQL [2012.08.09 15:45:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MySQL [2012.08.09 15:45:57 | 000,000,000 | ---D | C] -- C:\ProgramData\MySQL [2012.08.09 15:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Recorder Pro [2012.08.09 15:30:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audio Recorder Pro [2012.08.09 11:02:36 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{50D3CD2F-5BBD-4AEB-9F4D-D0FD715938B6} [2012.08.09 11:02:23 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C52C50E4-B394-4C78-9B63-EE1DCC4A1748} [2012.08.08 16:51:15 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{67AE11BC-0FA1-4FE9-9D77-A929C16A50DA} [2012.08.08 16:51:05 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5B3F7AF5-9622-49BC-978C-1DFC8FE167DC} [2012.08.08 04:50:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2DE48A7F-13FA-4B3C-867A-B5BED8D89584} [2012.08.08 04:50:38 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{EB2430D0-09F2-4E7D-AC17-C596C5A10753} [2012.08.07 16:50:25 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{902A8010-2BC0-4E14-8D56-52B786DCED97} [2012.08.07 16:50:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{537784A7-F7C9-40B0-B2A9-35F7E49F7EEB} [2012.08.07 04:49:49 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{B22EC84C-C099-4204-A814-A18A458B8848} [2012.08.07 04:49:39 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C12CB901-8C4B-4C59-B76B-BA18B51DEC2A} [2012.08.06 17:32:41 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Quest3D [2012.08.06 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\Documents\ShipSimExtremes Userdata [2012.08.06 17:32:40 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Roaming [2012.08.06 14:17:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paradox Interactive [2012.08.06 14:13:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Paradox Interactive [2012.08.06 12:14:42 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5A103BE2-412A-4173-94DC-C862626DB820} [2012.08.06 12:14:32 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{9FD4CA43-867E-4AC6-AD33-B24F3A5515BC} [2012.08.06 00:14:20 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{80060651-833A-40A4-B494-3334B2C965F3} [2012.08.06 00:14:10 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{C1A30172-67EE-4408-8E58-B9AEB4F9677D} [2012.08.05 21:20:14 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\SKIDROW [2012.08.05 21:17:27 | 000,000,000 | ---D | C] -- C:\Users\Patty\Desktop\Railworks.3.Train.Simulator.2012.Deluxe.Update.1.and.2-SKIDROW [2012.08.05 17:17:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RailSimulator.com [2012.08.05 17:05:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RailSimulator.com [2012.08.05 15:27:12 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\GamersFirst LIVE! [2012.08.05 15:26:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GamersFirst [2012.08.05 15:26:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GamersFirst [2012.08.05 12:13:54 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{03FD720F-DBF9-401B-8189-B4261869619C} [2012.08.05 12:13:44 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5CB3ED4C-F39C-4B0D-A543-02C55297BEEC} [2012.08.05 06:23:43 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\MusicNet [2012.08.05 06:23:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\Documents\My Received Files [2012.08.05 06:23:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\BearShare [2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BearShare Applications [2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BearShare [2012.08.05 06:22:36 | 000,000,000 | ---D | C] -- C:\ProgramData\BearShare [2012.08.05 06:22:11 | 000,000,000 | -H-D | C] -- C:\ProgramData\{D79D348D-B804-455D-BF34-7E3989C8E84D} [2012.08.04 23:04:02 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{08D5B1B0-1FF4-4217-89D8-6D5A547F9A90} [2012.08.04 23:03:52 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{CA4E7870-57B6-4EE8-8AB7-C4AB8E20EF0F} [2012.08.04 11:03:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4D6D8287-0E4E-4567-9C9A-9A6673AED2FA} [2012.08.04 11:03:26 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{5716A376-6562-40E7-8DAA-E80653258772} [2012.08.03 22:11:31 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{E2A6B2BB-5165-47F7-81AA-E8A006577E27} [2012.08.03 22:11:21 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{F656B47B-DF56-4D13-BFEF-4F5A9F68E0D0} [2012.08.03 10:11:04 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{2F8186E0-6AA5-4D6C-AF02-BE2FA4A1C64D} [2012.08.03 10:10:54 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D96B8060-E668-4431-AFF7-66D0EFF62369} [2012.08.02 11:40:19 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{654C4470-7FE1-4437-A839-57ECB2E26E2D} [2012.08.02 11:40:09 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{9B3B93E1-8BBA-4B62-A032-1C5483A1D256} [2012.08.01 18:44:47 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D70A40D9-3417-4B1C-AE92-15F8E591EDB3} [2012.08.01 18:44:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{369E81AD-2CD6-4B11-A78B-8BDDD055D357} [2012.08.01 10:50:53 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Roaming\Apple Computer [2012.07.31 14:27:17 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{AE30EF49-1B32-4C60-B0FD-AF1B4713DEDF} [2012.07.31 14:27:07 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{4588A487-460C-4323-B9C6-34CA4AE3F1B3} [2012.07.31 07:52:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2012.07.31 07:52:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime [2012.07.31 07:52:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer [2012.07.31 07:49:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [2012.07.31 02:26:37 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{06EC3F31-BDA1-47F1-9170-24201BCC7E6C} [2012.07.31 02:26:27 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{DA00BCF8-7CE7-4C2F-B00B-DAEEA95FAE9A} [2012.07.30 14:26:09 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{33A1E426-B16E-4A42-A223-E0F4CC3F8F1E} [2012.07.30 14:25:59 | 000,000,000 | ---D | C] -- C:\Users\Patty\AppData\Local\{D71F5E38-247B-4C63-A710-38AC32792AD2} [2010.12.17 04:20:16 | 001,914,000 | ---- | C] (Adobe Systems Incorporated) -- C:\ProgramData\flashax10.exe [1 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ] [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.08.29 13:26:00 | 000,001,108 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job [2012.08.29 13:04:37 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2012.08.28 23:26:00 | 000,001,104 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2012.08.28 18:39:48 | 000,001,828 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Internet Security Suite.lnk [2012.08.28 17:47:45 | 000,001,469 | ---- | M] () -- C:\Users\Patty\.recently-used.xbel [2012.08.28 17:43:43 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Patty\Desktop\OTL.exe [2012.08.28 17:33:53 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.28 17:29:39 | 001,500,294 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI [2012.08.28 17:29:39 | 000,654,602 | ---- | M] () -- C:\windows\SysNative\perfh007.dat [2012.08.28 17:29:39 | 000,616,484 | ---- | M] () -- C:\windows\SysNative\perfh009.dat [2012.08.28 17:29:39 | 000,130,216 | ---- | M] () -- C:\windows\SysNative\perfc007.dat [2012.08.28 17:29:39 | 000,106,606 | ---- | M] () -- C:\windows\SysNative\perfc009.dat [2012.08.28 17:23:40 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad [2012.08.28 17:17:05 | 000,001,887 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.08.27 18:59:45 | 000,017,360 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.27 18:59:45 | 000,017,360 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.27 18:51:37 | 523,132,927 | -HS- | M] () -- C:\hiberfil.sys [2012.08.23 14:47:34 | 008,606,816 | ---- | M] () -- C:\Users\Patty\Desktop\Jasi-Micha-Patty-Berlin.xcf [2012.08.21 22:01:26 | 000,195,220 | ---- | M] () -- C:\Users\Patty\Desktop\002.jpg [2012.08.21 22:01:26 | 000,185,694 | ---- | M] () -- C:\Users\Patty\Desktop\003.jpg [2012.08.21 20:04:04 | 000,659,538 | ---- | M] () -- C:\Users\Patty\Desktop\DSC_0255.JPG [2012.08.21 20:03:52 | 000,575,254 | ---- | M] () -- C:\Users\Patty\Desktop\DSC_0254.JPG [2012.08.21 20:03:08 | 000,541,123 | ---- | M] () -- C:\Users\Patty\Desktop\DSC_0253.JPG [2012.08.21 20:02:48 | 000,616,760 | ---- | M] () -- C:\Users\Patty\Desktop\DSC_0252.JPG [2012.08.20 22:23:50 | 559,250,716 | ---- | M] () -- C:\windows\MEMORY.DMP [2012.08.20 12:09:41 | 000,000,803 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk [2012.08.20 10:12:03 | 000,001,293 | ---- | M] () -- C:\Users\Patty\Desktop\World of Warcraft-Installationsprogramm.lnk [2012.08.17 07:37:17 | 000,288,360 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT [2012.08.14 03:58:25 | 000,002,032 | ---- | M] () -- C:\Users\Patty\Desktop\SAM Broadcaster.lnk [2012.08.14 00:10:09 | 023,393,101 | ---- | M] () -- C:\Users\Patty\Desktop\sambc-fb-v492.exe [2012.08.14 00:05:49 | 000,128,512 | ---- | M] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.9.2-RES-patch.exe [2012.08.13 21:30:55 | 000,001,321 | ---- | M] () -- C:\Users\Public\Desktop\Firestorm-Release.lnk [2012.08.12 20:52:25 | 000,000,000 | ---- | M] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.2.2-1 [2012.08.12 12:48:57 | 000,000,168 | ---- | M] () -- C:\Users\Patty\defogger_reenable [2012.08.12 03:58:56 | 000,215,763 | ---- | M] () -- C:\Users\Patty\Desktop\Leck mich.jpg [2012.08.12 03:56:56 | 003,145,746 | ---- | M] () -- C:\Users\Patty\Desktop\Leck mich.tga [2012.08.09 18:14:48 | 000,076,813 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt444444.wma [2012.08.09 17:47:06 | 000,049,873 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt222.wma [2012.08.09 17:43:27 | 000,103,753 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt1111.wma [2012.08.09 17:30:08 | 000,045,383 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt5678.wma [2012.08.09 17:03:51 | 000,072,323 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt4567.wma [2012.08.09 16:57:07 | 000,067,833 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt3456.wma [2012.08.09 16:53:13 | 000,085,793 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt2345.wma [2012.08.09 16:49:32 | 000,274,373 | ---- | M] () -- C:\Users\Patty\Documents\Unbenannt1234.wma [2012.08.09 16:47:30 | 000,103,753 | ---- | M] () -- C:\Users\Patty\Documents\Test123.wma [2012.08.09 14:19:07 | 000,001,138 | ---- | M] () -- C:\windows\Cm106.ini.imi [2012.08.09 14:19:07 | 000,001,138 | ---- | M] () -- C:\windows\System\Cm106.ini [2012.08.09 11:10:21 | 000,189,248 | ---- | M] () -- C:\windows\SysWow64\PnkBstrB.exe [2012.08.09 11:10:14 | 000,189,248 | ---- | M] () -- C:\windows\SysWow64\PnkBstrB.ex0 [2012.08.09 11:10:10 | 000,076,888 | ---- | M] () -- C:\windows\SysWow64\PnkBstrA.exe [2012.08.09 04:12:44 | 000,001,864 | ---- | M] () -- C:\Users\Patty\Desktop\APBLauncher - Verknüpfung.lnk [2012.08.07 23:24:54 | 000,001,164 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk [2012.08.07 23:24:54 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\GamersFirst LIVE!.lnk [2012.08.06 14:17:17 | 000,002,247 | ---- | M] () -- C:\Users\Public\Desktop\Ship Simulator Extremes.lnk [2012.08.05 17:17:12 | 000,002,409 | ---- | M] () -- C:\Users\Public\Desktop\Railworks 3 Train Simulator 2012 Deluxe.lnk [2012.08.05 06:24:30 | 000,011,264 | ---- | M] () -- C:\Users\Patty\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.08.05 06:23:31 | 000,000,131 | ---- | M] () -- C:\Users\Public\Desktop\Emoticons for your messenger!.url [2012.07.31 10:08:52 | 000,037,968 | ---- | M] () -- C:\Users\Patty\Documents\Colin.odt [2012.07.31 07:26:30 | 000,105,054 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_24737.jpg [2012.07.31 07:25:02 | 000,079,566 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_16862.jpg [2012.07.31 07:24:15 | 000,083,001 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_75443.jpg [2012.07.31 07:24:14 | 000,076,969 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_87561.jpg [2012.07.31 07:23:33 | 000,079,525 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_39538.jpg [2012.07.31 07:18:01 | 000,080,626 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_91947.jpg [2012.07.31 07:14:57 | 000,080,603 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_59933.jpg [2012.07.31 07:13:51 | 000,080,340 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_12583.jpg [2012.07.31 07:12:14 | 000,104,213 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_8293.jpg [2012.07.31 07:11:43 | 000,103,947 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_21134.jpg [2012.07.31 07:11:31 | 000,103,873 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_63998.jpg [2012.07.31 07:09:41 | 000,093,831 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_3232.jpg [2012.07.31 07:07:32 | 000,084,617 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_99150.jpg [2012.07.31 07:07:31 | 000,093,831 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_50305.jpg [2012.07.31 07:05:01 | 000,076,966 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_37039.jpg [2012.07.31 07:04:57 | 000,104,210 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_68910.jpg [2012.07.31 07:04:47 | 000,101,057 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_55054.jpg [2012.07.31 07:00:26 | 000,079,548 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_62165.jpg [2012.07.31 06:59:21 | 000,057,658 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_11327.jpg [2012.07.31 06:58:58 | 000,077,043 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_69895.jpg [2012.07.31 06:57:06 | 000,077,942 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_51895.jpg [2012.07.30 14:53:37 | 000,117,591 | ---- | M] () -- C:\Users\Patty\final_bstSnapshot_80839.jpg [1 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ] [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.08.28 17:47:45 | 000,001,469 | ---- | C] () -- C:\Users\Patty\.recently-used.xbel [2012.08.28 17:33:53 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.28 17:17:05 | 004,503,728 | ---- | C] () -- C:\ProgramData\nud0repor.pad [2012.08.28 17:17:05 | 000,001,887 | ---- | C] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.08.23 14:46:15 | 008,606,816 | ---- | C] () -- C:\Users\Patty\Desktop\Jasi-Micha-Patty-Berlin.xcf [2012.08.21 22:00:30 | 000,659,538 | ---- | C] () -- C:\Users\Patty\Desktop\DSC_0255.JPG [2012.08.21 22:00:30 | 000,616,760 | ---- | C] () -- C:\Users\Patty\Desktop\DSC_0252.JPG [2012.08.21 22:00:30 | 000,575,254 | ---- | C] () -- C:\Users\Patty\Desktop\DSC_0254.JPG [2012.08.21 22:00:30 | 000,541,123 | ---- | C] () -- C:\Users\Patty\Desktop\DSC_0253.JPG [2012.08.20 15:01:22 | 000,185,694 | ---- | C] () -- C:\Users\Patty\Desktop\003.jpg [2012.08.20 15:00:58 | 000,195,220 | ---- | C] () -- C:\Users\Patty\Desktop\002.jpg [2012.08.20 10:12:03 | 000,001,293 | ---- | C] () -- C:\Users\Patty\Desktop\World of Warcraft-Installationsprogramm.lnk [2012.08.20 10:04:05 | 000,000,803 | ---- | C] () -- C:\Users\Public\Desktop\World of Warcraft.lnk [2012.08.15 01:11:31 | 000,135,205 | ---- | C] () -- C:\Users\Patty\Desktop\17072011062.jpg [2012.08.15 01:10:04 | 000,873,695 | ---- | C] () -- C:\Users\Patty\Desktop\SNC00030.jpg [2012.08.15 01:09:34 | 000,858,118 | ---- | C] () -- C:\Users\Patty\Desktop\SNC00031.jpg [2012.08.15 01:08:32 | 000,189,617 | ---- | C] () -- C:\Users\Patty\Desktop\12032012075.jpg [2012.08.15 01:07:38 | 000,039,143 | ---- | C] () -- C:\Users\Patty\Desktop\12032012077.jpg [2012.08.14 03:58:25 | 000,002,032 | ---- | C] () -- C:\Users\Patty\Desktop\SAM Broadcaster.lnk [2012.08.14 00:04:13 | 000,128,512 | ---- | C] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.9.2-RES-patch.exe [2012.08.14 00:04:08 | 023,393,101 | ---- | C] () -- C:\Users\Patty\Desktop\sambc-fb-v492.exe [2012.08.13 21:30:55 | 000,001,321 | ---- | C] () -- C:\Users\Public\Desktop\Firestorm-Release.lnk [2012.08.12 20:52:25 | 000,000,000 | ---- | C] () -- C:\Users\Patty\Desktop\SAM.Broadcaster.v4.2.2-1 [2012.08.12 12:48:57 | 000,000,168 | ---- | C] () -- C:\Users\Patty\defogger_reenable [2012.08.12 03:58:56 | 000,215,763 | ---- | C] () -- C:\Users\Patty\Desktop\Leck mich.jpg [2012.08.12 03:56:56 | 003,145,746 | ---- | C] () -- C:\Users\Patty\Desktop\Leck mich.tga [2012.08.09 18:14:48 | 000,076,813 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt444444.wma [2012.08.09 17:47:06 | 000,049,873 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt222.wma [2012.08.09 17:43:27 | 000,103,753 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt1111.wma [2012.08.09 17:30:08 | 000,045,383 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt5678.wma [2012.08.09 17:03:51 | 000,072,323 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt4567.wma [2012.08.09 16:57:07 | 000,067,833 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt3456.wma [2012.08.09 16:53:13 | 000,085,793 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt2345.wma [2012.08.09 16:49:32 | 000,274,373 | ---- | C] () -- C:\Users\Patty\Documents\Unbenannt1234.wma [2012.08.09 16:47:30 | 000,103,753 | ---- | C] () -- C:\Users\Patty\Documents\Test123.wma [2012.08.09 14:19:07 | 000,359,424 | ---- | C] () -- C:\windows\SysNative\CmiInstallResAll64.dll [2012.08.09 14:19:07 | 000,002,853 | ---- | C] () -- C:\windows\Cm106.ini.cfg [2012.08.09 14:19:07 | 000,001,138 | ---- | C] () -- C:\windows\Cm106.ini.imi [2012.08.09 11:10:14 | 000,189,248 | ---- | C] () -- C:\windows\SysWow64\PnkBstrB.exe [2012.08.09 11:10:14 | 000,189,248 | ---- | C] () -- C:\windows\SysWow64\PnkBstrB.ex0 [2012.08.09 11:10:10 | 000,076,888 | ---- | C] () -- C:\windows\SysWow64\PnkBstrA.exe [2012.08.09 04:12:44 | 000,001,864 | ---- | C] () -- C:\Users\Patty\Desktop\APBLauncher - Verknüpfung.lnk [2012.08.06 14:17:17 | 000,002,247 | ---- | C] () -- C:\Users\Public\Desktop\Ship Simulator Extremes.lnk [2012.08.05 17:17:12 | 000,002,409 | ---- | C] () -- C:\Users\Public\Desktop\Railworks 3 Train Simulator 2012 Deluxe.lnk [2012.08.05 15:26:47 | 000,001,164 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk [2012.08.05 15:26:47 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\GamersFirst LIVE!.lnk [2012.08.05 06:24:18 | 000,011,264 | ---- | C] () -- C:\Users\Patty\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.08.05 06:23:31 | 000,000,131 | ---- | C] () -- C:\Users\Public\Desktop\Emoticons for your messenger!.url [2012.07.31 10:08:38 | 000,037,968 | ---- | C] () -- C:\Users\Patty\Documents\Colin.odt [2012.07.31 07:26:30 | 000,105,054 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_24737.jpg [2012.07.31 07:25:02 | 000,079,566 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_16862.jpg [2012.07.31 07:24:15 | 000,083,001 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_75443.jpg [2012.07.31 07:24:14 | 000,076,969 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_87561.jpg [2012.07.31 07:23:33 | 000,079,525 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_39538.jpg [2012.07.31 07:18:01 | 000,080,626 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_91947.jpg [2012.07.31 07:14:57 | 000,080,603 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_59933.jpg [2012.07.31 07:13:51 | 000,080,340 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_12583.jpg [2012.07.31 07:12:14 | 000,104,213 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_8293.jpg [2012.07.31 07:11:43 | 000,103,947 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_21134.jpg [2012.07.31 07:11:31 | 000,103,873 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_63998.jpg [2012.07.31 07:09:41 | 000,093,831 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_3232.jpg [2012.07.31 07:07:32 | 000,084,617 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_99150.jpg [2012.07.31 07:07:31 | 000,093,831 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_50305.jpg [2012.07.31 07:05:01 | 000,076,966 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_37039.jpg [2012.07.31 07:04:57 | 000,104,210 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_68910.jpg [2012.07.31 07:04:47 | 000,101,057 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_55054.jpg [2012.07.31 07:00:26 | 000,079,548 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_62165.jpg [2012.07.31 06:59:21 | 000,057,658 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_11327.jpg [2012.07.31 06:58:58 | 000,077,043 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_69895.jpg [2012.07.31 06:57:06 | 000,077,942 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_51895.jpg [2012.07.30 14:53:37 | 000,117,591 | ---- | C] () -- C:\Users\Patty\final_bstSnapshot_80839.jpg [2012.03.12 19:41:18 | 000,077,653 | ---- | C] () -- C:\Users\Patty\ESt2011_Saalmann_Patrice.elfo [2011.06.05 21:20:00 | 000,005,120 | ---- | C] () -- C:\Users\Patty\AppData\Local\Databases.db [2011.04.28 12:00:32 | 000,001,201 | R--- | C] () -- C:\windows\cm106.ini [2011.04.03 20:41:07 | 001,526,976 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI [2010.12.17 12:30:39 | 000,201,728 | ---- | C] () -- C:\windows\SetDrive.exe [2010.12.17 12:30:37 | 000,036,864 | ---- | C] () -- C:\windows\WinWait.exe [2010.12.17 03:40:36 | 000,139,264 | ---- | C] () -- C:\windows\SysWow64\ustor.dll [2010.12.17 03:40:36 | 000,040,960 | ---- | C] () -- C:\windows\SysWow64\UMonit.exe [2010.12.17 03:40:33 | 000,001,393 | ---- | C] () -- C:\windows\SysWow64\IconCfg0.ini [2010.12.17 03:40:33 | 000,000,722 | ---- | C] () -- C:\windows\SysWow64\ProductName.ini [2010.12.17 03:38:01 | 000,008,192 | ---- | C] () -- C:\windows\SysWow64\drivers\IntelMEFWVer.dll ========== LOP Check ========== [2011.09.13 04:40:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Ashampoo [2012.04.21 03:45:21 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Avnex [2011.09.16 03:28:17 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\BitTorrent [2011.05.08 16:21:31 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DAEMON Tools Lite [2012.01.04 18:36:29 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DVDVideoSoft [2011.06.12 20:18:27 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers [2012.03.05 15:53:41 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\elsterformular [2012.08.01 20:07:23 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Firestorm [2011.12.13 02:28:19 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\FreeHideIP [2012.08.23 14:47:34 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\gtk-2.0 [2012.08.11 18:00:37 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\ICQ [2011.12.29 00:21:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Imprudence [2012.08.13 21:13:44 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\IrfanView [2011.05.15 15:10:28 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Laconic Software [2012.08.05 06:23:43 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\MusicNet [2012.08.09 16:00:30 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\MySQL [2012.05.30 14:22:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Pamela [2012.08.06 17:32:41 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Quest3D [2012.08.06 17:32:40 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Roaming [2012.04.21 09:23:37 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Screaming Bee [2012.08.19 22:23:14 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\SecondLife [2012.07.17 22:00:39 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\SoftGrid Client [2012.08.13 21:13:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\streamripper [2011.11.29 20:18:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TeamViewer [2011.04.13 14:35:58 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\The Creative Assembly [2011.11.29 17:03:57 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TL-Player [2011.04.11 17:54:50 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TomTom [2011.04.03 20:41:40 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TP [2011.04.02 18:05:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Windows Live Writer [2012.07.06 03:11:19 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Z-Software [2012.08.11 18:57:11 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\Firestorm [2012.07.23 16:36:40 | 000,032,620 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2011.04.03 13:54:17 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Adobe [2012.08.01 10:50:53 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Apple Computer [2011.09.13 04:40:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Ashampoo [2012.04.21 03:45:21 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Avnex [2011.09.16 03:28:17 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\BitTorrent [2011.04.04 23:08:18 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\CyberLink [2011.05.08 16:21:31 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DAEMON Tools Lite [2012.01.04 18:36:29 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DVDVideoSoft [2011.06.12 20:18:27 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\DVDVideoSoftIEHelpers [2012.03.05 15:53:41 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\elsterformular [2012.08.01 20:07:23 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Firestorm [2011.12.13 02:28:19 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\FreeHideIP [2012.08.23 14:47:34 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\gtk-2.0 [2012.08.11 18:00:37 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\ICQ [2011.04.02 16:37:37 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Identities [2011.12.29 00:21:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Imprudence [2011.04.13 13:06:16 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\InstallShield [2011.04.02 16:38:10 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Intel Corporation [2012.08.13 21:13:44 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\IrfanView [2011.05.15 15:10:28 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Laconic Software [2011.04.02 16:48:05 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Macromedia [2012.08.11 18:16:28 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Malwarebytes [2009.07.26 06:47:55 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Media Center Programs [2011.12.04 05:34:27 | 000,000,000 | --SD | M] -- C:\Users\Patty\AppData\Roaming\Microsoft [2011.12.10 17:19:50 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\MixMeister Technology [2011.04.02 17:04:24 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Mozilla [2011.05.15 15:20:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Mozilla-Cache [2012.08.05 06:23:43 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\MusicNet [2012.08.09 16:00:30 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\MySQL [2011.04.24 19:33:11 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\NVIDIA [2012.05.30 14:22:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Pamela [2012.08.06 17:32:41 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Quest3D [2012.08.06 17:32:40 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Roaming [2011.06.25 13:33:27 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Roxio Log Files [2012.04.21 09:23:37 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Screaming Bee [2012.08.19 22:23:14 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\SecondLife [2011.05.09 14:35:19 | 000,000,000 | RH-D | M] -- C:\Users\Patty\AppData\Roaming\SecuROM [2012.08.29 09:37:32 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Skype [2012.07.17 22:00:39 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\SoftGrid Client [2012.08.13 21:13:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\streamripper [2011.11.29 20:18:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TeamViewer [2011.04.13 14:35:58 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\The Creative Assembly [2011.11.29 17:03:57 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TL-Player [2011.04.11 17:54:50 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TomTom [2011.04.03 20:41:40 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\TP [2012.08.24 13:36:44 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\vlc [2012.08.13 21:13:45 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Winamp [2011.04.02 18:05:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Windows Live Writer [2011.04.04 21:15:46 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\WinRAR [2012.07.06 03:11:19 | 000,000,000 | ---D | M] -- C:\Users\Patty\AppData\Roaming\Z-Software < %APPDATA%\*.exe /s > [2012.08.29 03:55:43 | 000,000,000 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Firestorm\logs\Firestorm-Release_4_1_1_28744.exec_marker [2011.12.10 17:19:41 | 000,000,766 | R--- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Installer\{50CBBEC7-1010-41C5-8718-A1A6FEDD9C3A}\ARPPRODUCTICON.exe [2011.05.08 16:36:50 | 000,049,152 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Patty\AppData\Roaming\Microsoft\Installer\{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0}\ARPPRODUCTICON.exe [2011.05.08 16:26:44 | 000,010,134 | R--- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Installer\{C920EFB6-59DB-472D-B445-21821477AD17}\ARPPRODUCTICON.exe [2011.05.08 16:26:44 | 000,008,854 | R--- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Installer\{C920EFB6-59DB-472D-B445-21821477AD17}\UNINST_Uninstall_Tru_C920EFB659DB472DB44521821477AD17.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\windows\SysNative\drivers\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\drivers\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_b230b4f1ea781c27\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.20621_none_39f398b8542b6259\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\windows\SysNative\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: IASTOR.SYS > [2010.09.13 19:24:26 | 000,437,272 | ---- | M] (Intel Corporation) MD5=F7CE9BE72EDAC499B713ECA6DAE5D26F -- C:\windows\SysNative\drivers\iaStor.sys [2010.09.13 19:24:26 | 000,437,272 | ---- | M] (Intel Corporation) MD5=F7CE9BE72EDAC499B713ECA6DAE5D26F -- C:\windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_2b0c50dc63f09dae\iaStor.sys < MD5 for: IASTORV.SYS > [2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys [2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys [2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\windows\SysNative\drivers\iaStorV.sys [2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys [2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys [2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\windows\SysNative\netlogon.dll [2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys [2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\windows\SysNative\drivers\nvstor.sys [2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys [2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys [2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys [2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys [2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll [2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\windows\SysNative\scecli.dll [2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\windows\SysNative\user32.dll [2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll [2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll [2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll < MD5 for: USERINIT.EXE > [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\windows\SysNative\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\windows\SysNative\wininit.exe [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\windows\SysNative\winlogon.exe [2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\windows\SysNative\drivers\ws2ifsl.sys [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [1 C:\windows\system32\*.tmp files -> C:\windows\system32\*.tmp -> ] < %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.* > [2012.08.28 17:17:05 | 000,001,887 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.07.12 13:12:54 | 000,000,174 | -HS- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini [2011.04.16 18:32:29 | 000,002,389 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK < %APPDATA%\*AcroIEH*.* > < %APPDATA%\*.exe > < %APPDATA%\*.tmp > < End of report > LG |
|
29.08.2012, 18:57
| #11 |
| /// Helfer-Team | ZeroAccess Trojaner in der Desktop.ini gefunden Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
SRV - [2012.07.10 20:31:31 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai)
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://de.ask.com/?l=dis&o=102875&gct=hp
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook: - No CLSID value found
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\SearchScopes\{BB0E13C0-0E3B-4F5F-B31B-48697D1BA5AA}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=HIP&o=102875&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=6F&apn_dtid=YYYYYYYYDE&apn_uid=434a70d5-6584-4c56-9114-95d72b6672f1&apn_sauid=689AA487-0083-4700-8AE2-C6C3A6F3E2E7
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=;ftp=;https=;
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://de.ask.com/?l=dis&o=102875&gct=hp"
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.3&q="
FF - prefs.js..network.proxy.gopher: ""
FF - prefs.js..network.proxy.gopher_port: 0
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [Unattend0000000001{BFA3D12B-66DD-4617-923A-E864BC7D20B5}] C:\Windows\test.bat File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001..\Run: [Akamai NetSession Interface] C:\Users\Patty\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1817871884-2824289404-3138286328-1001\..Trusted Domains: sony.com ([]* in Trusted sites)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.09.25 19:27:45 | 000,000,098 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2010.08.25 22:57:19 | 000,000,070 | R--- | M] () - G:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell - "" = AutoRun
O33 - MountPoints2\{1132f4ce-7800-11e0-8e34-406186747ef6}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2011.09.25 19:27:45 | 003,811,542 | R--- | M] (RailSimulator.com )
O33 - MountPoints2\{8e6cfc5a-8575-11e1-8576-406186747ef6}\Shell - "" = AutoRun
O33 - MountPoints2\{8e6cfc5a-8575-11e1-8576-406186747ef6}\Shell\AutoRun\command - "" = G:\Setup.exe -- [2010.08.25 22:57:19 | 001,518,798 | R--- | M] (Paradox Interactive )
O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell - "" = AutoRun
O33 - MountPoints2\{c8d7830c-5dd8-11e0-9c52-406186747ef6}\Shell\AutoRun\command - "" = F:\autorun.exe
[2012.08.05 06:22:11 | 000,000,000 | -H-D | C] -- C:\ProgramData\{D79D348D-B804-455D-BF34-7E3989C8E84D}
[1 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]
[2012.08.28 17:23:40 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad
[2012.08.28 17:17:05 | 000,001,887 | ---- | M] () -- C:\Users\Patty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
:Files
C:\Users\Patty\AppData\Local\{*}
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\Patty\AppData\Local\Temp\*.exe
C:\Users\Patty\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
%SystemRoot%\System32\*.tmp
%SystemRoot%\SysWOW64\*.tmp
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! |
|
17.10.2012, 14:54
| #12 |
| /// Helfer-Team | ZeroAccess Trojaner in der Desktop.ini gefunden Fehlende Rückmeldung Gibt es Probleme beim Abarbeiten obiger Anleitung? Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen. Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema. http://www.trojaner-board.de/69886-a...-beachten.html Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist. |
|
| Themen zu ZeroAccess Trojaner in der Desktop.ini gefunden |
| adware.agent, adware.rkn, akamai, autorun, bluestacks, broken.opencommand, converter, cyberghost, datei gelöscht, desktop.ini, explorer, firewall, format, google earth, home, lenovo, logfile, neuaufsetzung, nodrives, nvidia, plug-in, programme, realtek, scan, siteadvisor, symantec, trojan.pws, trojan.ransom.gen, trojaner, zeroaccess, ändern |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
