| |
| |||||||
Log-Analyse und Auswertung: Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
04.06.2013, 20:02
| #1 |
 |  Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Hallo, ich hoffe Ihr könnte mir helfen. Wenn ja und dauerhaft ohne kompletten systemreset werde ich einen 2-3stelligen Betrag an Euch spenden da (verlorene) Zeit Geld ist. Nach dem ich alles was rund um Firefox möglich ist getan habe, fällt der Verdacht auf Malware. Faktenlage: - Rechner W7, Firefox stürzt nach wenigen Minuten bis Stunden Betrieb ab - Crash-Report verfügbar, Situation so seit mehreren Tagen ohne erinnerbaren Anlass - sämtliche Fehlerbehebungsmassnahmen der Mozillapage wurden abgearbeitet: - starten in save modus, refresh und ohne add-ons usw. - kompletter deinstall, re-install und neustart clean ohne Altlasten Kein Erfolg. FFox stürzt immer wieder ab. Betreibe Vollversion Symantec Endpoint Protection sowie Malwarebytes seit Jahren immer aktuell. Full-scans heute morgen ohne Erfolg. Habe defogger gemacht. OTL hat aber nur OTL.txt ausgeworfen, keine Extra.txt. Gmer läuft nicht durch und wird unter Fehlermeldung beendet. Ich habe nach Neustart keine Prg. laufen, alles wie in eurer Anleitung und berühre den Rechner nicht. Nach 5-10 Minuten fullscan kommt die Fehlermeldung "Programm wird beendet". Habe es 3x probiert und vorher jegliches ausschaltbares Programm ausgeschaltet. Die einzige Auffälligkeit für mich als Laie ist: im Task Manager ist der Firefox Prozess der einzige der keine "Description" ganz rechts im Task Manager hat. Dort ist blank, statt wie sonst eben "Firefox". Viell. hängt dies auch damit zusammen, dass im OTL.txt unten bei den Mozilla logs auch "no name found" steht ? Danke für eine baldige Hilfe. Auch wie ich den GMER und das extra.txt produzieren kann für Euch. Hier die Anhänge: ************************************ OTL logfile created on: 04.06.2013 19:01:46 - Run 5 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\IBM_ADMIN\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy 7,89 Gb Total Physical Memory | 2,95 Gb Available Physical Memory | 37,46% Memory free 15,77 Gb Paging File | 12,29 Gb Available in Paging File | 77,92% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 298,09 Gb Total Space | 69,81 Gb Free Space | 23,42% Space Free | Partition Type: NTFS Drive G: | 298,06 Gb Total Space | 176,83 Gb Free Space | 59,33% Space Free | Partition Type: NTFS Computer Name: IBM-IF34NF70CTV | User Name: xxxxxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.04 18:56:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe PRC - [2013.06.04 18:24:53 | 000,917,400 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2013.04.04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2013.01.15 19:46:09 | 000,184,528 | ---- | M] (IBM Corp.) -- c:\sdwork\issimsvc.exe PRC - [2012.11.07 18:28:31 | 000,326,968 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\C4ebreg\isamtray.exe PRC - [2012.11.07 18:27:16 | 000,511,288 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\C4ebreg\c4ebreg.exe PRC - [2012.07.21 16:05:20 | 001,588,544 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe PRC - [2012.07.21 16:05:14 | 003,935,944 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe PRC - [2011.12.05 20:49:22 | 004,678,552 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe PRC - [2011.12.05 20:49:22 | 001,471,896 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe PRC - [2011.12.01 04:05:00 | 000,064,576 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE PRC - [2011.11.17 02:36:22 | 001,231,472 | ---- | M] (ACD Systems) -- C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe PRC - [2011.11.14 00:43:12 | 000,180,848 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-unity-helper.exe PRC - [2011.11.14 00:43:10 | 004,118,128 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmplayer.exe PRC - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe PRC - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe PRC - [2011.11.13 23:36:38 | 000,011,264 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vprintproxy.exe PRC - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe PRC - [2011.09.16 09:31:34 | 000,189,832 | ---- | M] (IBM Corp) -- c:\notes\SUService.exe PRC - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe PRC - [2011.07.22 13:21:34 | 000,060,264 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe PRC - [2011.07.22 13:21:32 | 000,042,344 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe PRC - [2011.07.22 13:21:18 | 000,041,832 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe PRC - [2011.05.27 02:43:12 | 000,328,040 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe PRC - [2011.05.19 12:00:40 | 002,062,680 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe PRC - [2011.04.19 17:12:22 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe PRC - [2011.04.19 17:12:18 | 000,408,576 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe PRC - [2011.04.14 20:24:26 | 000,410,984 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe PRC - [2011.04.14 20:22:42 | 000,361,832 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe PRC - [2011.04.14 20:22:36 | 000,193,896 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe PRC - [2011.04.14 20:22:30 | 000,431,464 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe PRC - [2011.04.14 20:22:28 | 000,263,528 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe PRC - [2011.04.14 20:22:26 | 000,124,264 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe PRC - [2011.04.07 23:41:32 | 000,138,680 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\ZOOM\TpScrex.exe PRC - [2011.04.04 17:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\micmute.exe PRC - [2011.03.29 20:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe PRC - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe PRC - [2011.03.24 22:11:32 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe PRC - [2011.03.24 22:11:30 | 001,839,776 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe PRC - [2011.03.24 22:11:30 | 000,050,544 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe PRC - [2011.02.18 12:47:12 | 000,079,192 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe PRC - [2011.02.17 22:49:12 | 000,577,536 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe PRC - [2010.09.09 19:40:38 | 000,079,200 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe PRC - [2010.09.09 19:40:24 | 000,476,000 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe PRC - [2010.09.09 19:40:02 | 000,349,536 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe PRC - [2010.04.07 21:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe PRC - [2010.04.01 21:50:44 | 000,043,960 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe PRC - [2009.06.18 16:19:30 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2009.04.27 14:37:18 | 000,025,256 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe PRC - [2008.09.18 09:30:54 | 000,122,880 | ---- | M] () -- C:\Windows\wrtService.exe PRC - [2006.11.22 11:11:24 | 000,082,864 | ---- | M] (Lexmark International Inc.) -- C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe PRC - [2006.11.22 11:11:22 | 000,291,760 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe ========== Modules (No Company Name) ========== MOD - [2013.06.04 18:24:53 | 002,401,688 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2013.05.27 08:09:32 | 002,297,856 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\3c2ed368e1f3889997dfb42a5ca77284\System.Core.ni.dll MOD - [2013.05.27 08:09:18 | 000,181,248 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Common\087705bc24370a204f2c6255fc68ad0e\Vodafone.Common.ni.dll MOD - [2013.05.27 08:09:17 | 000,673,280 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Data\d509111dd6accedf8942eb2b6b83fec6\Vodafone.Data.ni.dll MOD - [2013.05.26 20:24:57 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5dabd015d753b028750e4853dde12178\System.Windows.Forms.ni.dll MOD - [2013.05.26 20:24:49 | 003,347,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll MOD - [2013.05.26 20:24:45 | 000,687,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\23673bbebe3c0ca7c894e614bb3ffd1a\System.Security.ni.dll MOD - [2013.05.26 20:24:40 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll MOD - [2013.02.18 12:00:50 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Manag#\6c4e587713b061a12ee470864ca4fb97\Vodafone.View.ManagedToolTip.ni.dll MOD - [2013.02.18 12:00:49 | 000,876,544 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Shared\0e762a83572c331f3475b6c20722f4fb\Vodafone.View.Shared.ni.dll MOD - [2013.02.18 12:00:45 | 000,606,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Secon#\32cf63de2f013751cd1874dc1fd9debf\Vodafone.View.SecondaryWindows.ni.dll MOD - [2013.02.18 12:00:43 | 000,031,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\cc6f7fbebb0748b98dfce775d95005c6\Vodafone.DeviceAccess.Factory.ni.dll MOD - [2013.02.18 12:00:42 | 000,499,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\fd8de9d227b25a729338f4fdca7571b0\Vodafone.DeviceAccess.Internals.ni.dll MOD - [2013.02.18 12:00:40 | 000,674,304 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\b53a516b601a9dc1c183a48339e7a92e\Vodafone.ConnectionServices.ni.dll MOD - [2013.02.18 12:00:37 | 000,050,176 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\c3058f2d5d8b4717e85d530f54463e0d\Vodafone.Contracts.Adapter.ni.dll MOD - [2013.02.18 12:00:32 | 001,304,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\eb027595e692626525390ae831f4934e\Infragistics2.Win.UltraWinEditors.v9.2.ni.dll MOD - [2013.02.18 12:00:29 | 003,348,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.M#\2a1a484a011c63a38d01cba92f641890\Infragistics2.Win.Misc.v9.2.ni.dll MOD - [2013.02.18 12:00:22 | 011,053,056 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.v#\9c3e7a0a80452bab80237eafcc576389\Infragistics2.Win.v9.2.ni.dll MOD - [2013.02.18 12:00:02 | 000,871,424 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Share#\8edb485e7273579bb217330f8ba7fb98\Infragistics2.Shared.v9.2.ni.dll MOD - [2013.02.18 11:59:59 | 007,137,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\4c43791aeb4aede26a3bd89d86bc89b5\Infragistics2.Win.UltraWinToolbars.v9.2.ni.dll MOD - [2013.02.18 11:59:46 | 000,037,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\74f8482ed000aed6d9057d4f2d5dc2f3\Vodafone.Contracts.Presenter.ni.dll MOD - [2013.02.18 11:59:45 | 000,132,608 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\5f8ef1464fd770130f9715f485bf94bc\Vodafone.Contracts.Model.ni.dll MOD - [2013.02.18 11:59:44 | 000,105,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\acb2ca5e34236615024edcdcc4fa6b2b\Vodafone.Contracts.View.ni.dll MOD - [2013.02.18 11:59:43 | 000,094,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\9ec5cec32e8e823f78144fcb9a47fb64\Vodafone.Contracts.Common.ni.dll MOD - [2013.02.18 11:59:39 | 000,342,016 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.CommonDial#\30b0a9cd1f814f94fa0de09349a7e4d7\Vodafone.CommonDialogs.ni.dll MOD - [2013.02.18 11:59:37 | 000,947,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Applicatio#\6a874bbee313ab4f3ab630a2e6855d58\Vodafone.ApplicationHost.Impl.ni.dll MOD - [2013.02.18 11:59:34 | 000,326,656 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DataAccess#\d9173324d53199cabf7f663060356804\Vodafone.DataAccessor.ni.dll MOD - [2013.02.18 11:59:16 | 000,158,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Contr#\0a6abb05d1f030b0aca6c78857f130ae\Vodafone.Base.Contracts.ni.dll MOD - [2013.02.18 11:59:13 | 001,368,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Platform\7ee6c9cdec2c6eee428213bb5646b97c\Vodafone.Platform.ni.dll MOD - [2013.02.18 11:59:09 | 000,283,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\MobileBroadband\e6c36364416e40614eac2b777471961d\MobileBroadband.ni.exe MOD - [2013.02.17 17:50:08 | 000,212,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\7ff638de44686eab4afaa8b3c8a9cfca\System.ServiceProcess.ni.dll MOD - [2013.01.16 14:13:48 | 001,065,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\d602f7a5bbd392dddbc07c2f5f083a11\System.Management.ni.dll MOD - [2013.01.16 14:13:43 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d908c91e24616e6b8d38c9da61038b25\Accessibility.ni.dll MOD - [2013.01.16 14:13:32 | 005,459,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\fa022967bdd1030211f9cadcab797520\System.Xml.ni.dll MOD - [2013.01.16 14:13:27 | 007,989,760 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll MOD - [2013.01.16 14:13:08 | 000,774,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\83265111769de5cd294df17e6d762958\System.Runtime.Remoting.ni.dll MOD - [2013.01.16 14:13:07 | 000,627,712 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\7e584aeb8aa941f7f9bce2a31ea750f0\System.Transactions.ni.dll MOD - [2013.01.16 14:13:06 | 006,638,592 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\81f61d2c8af0d34385679aa2465c609a\System.Data.ni.dll MOD - [2013.01.16 14:12:40 | 012,678,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\09594e500a32cd9a1e4ddf33b45b4e44\PresentationCore.ni.dll MOD - [2013.01.16 10:25:55 | 000,080,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsProfile#\037db27d8cacfabe7ed7b999e14552c4\Vodafone.SmsProfileManager.ni.dll MOD - [2013.01.16 10:25:55 | 000,031,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.OutlookCon#\8c256f277b654a2421f817711d72a72f\Vodafone.OutlookConnector.ni.dll MOD - [2013.01.16 10:25:45 | 000,321,536 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Win32\4fc713e9bd132a9c0e0b177b9eceddf3\Vodafone.Base.Win32.ni.dll MOD - [2013.01.16 10:25:45 | 000,197,120 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsContact#\2e27dae10259458ed19ab28802d6d435\Vodafone.SmsContactManager.ni.dll MOD - [2013.01.15 22:16:27 | 000,252,928 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.FNCClient11#\fd734656ee66b5253483a686d6d679d8\Interop.FNCClient11Lib.ni.dll MOD - [2013.01.15 22:16:26 | 000,219,648 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Conn#\9365c6b816ac5d118accc3e870ec8759\Vodafone.Model.Connection.ni.dll MOD - [2013.01.15 22:16:26 | 000,033,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.UpdateMana#\ec56e9bcdd353278994778ebfa8f5aab\Vodafone.UpdateManager.ni.dll MOD - [2013.01.15 22:16:23 | 000,082,432 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Remot#\552e346f1bc27fa324a710072104ab0f\Vodafone.Core.Remoting.ni.dll MOD - [2013.01.15 22:16:23 | 000,054,784 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.TrafficOpt#\f6bb1fbd008e4be503a15a0633fa694b\Vodafone.TrafficOptimiser.ni.dll MOD - [2013.01.15 22:16:23 | 000,024,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.CoreI#\06cf2695acff680bd5008e4bd1cb5375\Vodafone.Core.CoreInstanceProvider.ni.dll MOD - [2013.01.15 22:16:22 | 000,119,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\d65e3892ff3bfd90b6b37f7ef0c8761c\Interop.Shell32.ni.dll MOD - [2013.01.15 22:16:22 | 000,106,496 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LanWlanMan#\c1a004ae9c01857bccbdaa343e885422\Vodafone.LanWlanManager.ni.dll MOD - [2013.01.15 22:16:22 | 000,072,704 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Vpn\1f2f44b9c1e6f8d028b5005fc7658972\Vodafone.Vpn.ni.dll MOD - [2013.01.15 22:16:21 | 000,393,728 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MbbManagem#\64bd72f4e684ee7fd460fe4c65f2bc0d\Vodafone.MbbManagement.ni.dll MOD - [2013.01.15 22:16:21 | 000,081,408 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.MbnApi\f450d8d019b097372ed1dea56de0e5a2\Interop.MbnApi.ni.dll MOD - [2013.01.15 22:16:21 | 000,039,936 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\e3be5dd41dd4f191b99353a091afbb2f\Vodafone.DeviceAccess.Interfaces.ni.dll MOD - [2013.01.15 22:16:20 | 000,733,696 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.WwanWrapper\657dd7faab285319de359b2fa0706558\Vodafone.WwanWrapper.ni.dll MOD - [2013.01.15 22:16:19 | 000,020,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Inter#\f70562c22e9a0d5d45171b13d6c56b7f\Vodafone.Core.Interfaces.ni.dll MOD - [2013.01.15 22:16:18 | 000,942,080 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.BusinessLo#\02c5bea3c3542435991367afd45d0ae9\Vodafone.BusinessLogic.ni.dll MOD - [2013.01.15 22:16:17 | 002,110,976 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Spring.Core\b559dd7a2b0f458d9e89412c4728b824\Spring.Core.ni.dll MOD - [2013.01.15 22:16:17 | 000,047,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Common.Logging\e1f5430a5664ac36d30136ffe1339bc2\Common.Logging.ni.dll MOD - [2013.01.15 22:16:15 | 000,042,496 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.InstancePr#\eb9e8b0000726b973085e44c1e8e3ec8\Vodafone.InstanceProvider.Impl.ni.dll MOD - [2013.01.15 22:15:59 | 000,098,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Contr#\4648622b8786e9df320724f55d507421\Vodafone.Core.Contracts.ni.dll MOD - [2013.01.15 22:15:59 | 000,026,112 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\e5f971684a0cfdbade27c8a77b94c1dc\Vodafone.DeviceAccess.Contracts.ni.dll MOD - [2013.01.15 22:15:58 | 000,089,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Inter#\cce3a30a9dc0d6b0d0817ac8c539cb1c\Vodafone.Base.Internals.ni.dll MOD - [2013.01.15 22:15:58 | 000,017,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Facto#\5ea47d1f504e95a19ea37b2d56bb32bd\Vodafone.Base.Factory.ni.dll MOD - [2013.01.15 22:15:57 | 000,153,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\014e1457c2135de51d117bb23bde328c\Vodafone.ConnectionManagement.ni.dll MOD - [2013.01.15 22:15:55 | 000,350,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.ReportingM#\8e36bfb3548a969d0431c4c7f6d273e9\Vodafone.ReportingManager.ni.dll MOD - [2013.01.15 22:15:53 | 000,055,296 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SettingsMa#\378a6b2759e2c491e34cc6cfef7a46d6\Vodafone.SettingsManager.ni.dll MOD - [2013.01.15 22:15:52 | 000,074,240 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.NtServiceM#\7bebcfbb3c250b011b8b5e70a3e15cba\Vodafone.NtServiceMessaging.ni.dll MOD - [2013.01.15 22:15:51 | 002,003,456 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\MobileBroadbandReso#\36c482b2fb56d28a66adf894213b43df\MobileBroadbandResources.ni.dll MOD - [2013.01.15 22:15:31 | 000,019,456 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MobileBroa#\a898a34cb3613fe42c5a502f01773c2e\Vodafone.MobileBroadband.CallbackHandler.ni.dll MOD - [2013.01.15 22:15:26 | 000,096,256 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LogEngine\a455bcf66b06fd85fd03f7560979b37f\Vodafone.LogEngine.ni.dll MOD - [2013.01.15 19:06:15 | 001,597,440 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\229b5280b4e310f5e83657abbf257632\System.Drawing.ni.dll MOD - [2013.01.15 19:05:50 | 011,493,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll MOD - [2012.12.12 07:32:26 | 005,025,792 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll MOD - [2012.10.05 12:53:24 | 003,198,976 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll MOD - [2012.10.05 12:53:24 | 000,630,784 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll MOD - [2012.08.31 12:59:19 | 004,550,656 | ---- | M] () -- C:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll MOD - [2011.11.14 00:43:22 | 000,329,328 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libcurl.dll MOD - [2011.11.14 00:43:18 | 000,144,496 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\liblber.dll MOD - [2011.11.14 00:43:18 | 000,122,992 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libcds.dll MOD - [2011.11.14 00:43:16 | 001,229,424 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libxml2.dll MOD - [2011.11.14 00:43:06 | 000,317,552 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libldap_r.dll MOD - [2011.11.14 00:43:00 | 000,069,232 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\zlib1.dll MOD - [2011.11.14 00:42:44 | 000,644,720 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\glibmm-2.4.dll MOD - [2011.04.19 17:12:12 | 000,308,736 | ---- | M] () -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\Vodafone.View.Taskbar.dll MOD - [2011.04.14 19:15:52 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll MOD - [2010.11.05 03:58:14 | 002,048,000 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll MOD - [2010.11.05 03:58:10 | 000,303,104 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll MOD - [2010.11.05 03:58:04 | 000,425,984 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll MOD - [2009.07.14 03:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\SysWOW64\msjetoledb40.dll MOD - [2009.06.10 23:23:19 | 000,261,632 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll MOD - [2009.06.10 23:22:40 | 000,010,752 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll MOD - [2009.04.27 14:37:18 | 000,025,256 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe MOD - [2008.05.16 13:35:22 | 000,040,960 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.Monitor.Core.dll MOD - [2008.05.16 13:35:22 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.Monitor.Common.dll MOD - [2008.05.16 13:34:18 | 000,057,344 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.MCMDevMon.dll MOD - [2007.04.30 09:20:26 | 000,011,776 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.MCMDevMon.AutoPlayUtil.dll MOD - [2007.04.30 09:19:52 | 000,020,480 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.ScanDevMon.dll MOD - [2007.04.30 09:19:48 | 000,020,480 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.NetworkCardDevMon.dll MOD - [2006.11.22 11:11:22 | 000,291,760 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe MOD - [2006.08.08 17:54:18 | 000,278,528 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctscw.dll MOD - [2006.06.09 04:39:54 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctdrec.dll MOD - [2006.05.25 18:20:44 | 000,241,664 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\iptk.dll ========== Services (SafeList) ========== SRV:64bit: - [2013.05.01 17:02:26 | 002,280,960 | ---- | M] (Proxy Labs) [Auto | Running] -- C:\Program Files\Proxy Labs\ProxyCap\pcapsvc.exe -- (pcapsvc) SRV:64bit: - [2012.12.11 07:22:08 | 000,060,272 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC) SRV:64bit: - [2011.10.17 16:48:24 | 000,970,016 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe -- (btwdins) SRV:64bit: - [2011.08.08 08:39:18 | 001,166,848 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3) SRV:64bit: - [2011.07.27 22:04:48 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV:64bit: - [2011.07.27 21:44:18 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV:64bit: - [2011.07.22 13:21:34 | 000,060,264 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe -- (LENOVO.TPKNRSVC) SRV:64bit: - [2011.07.22 13:21:18 | 000,041,832 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe -- (LENOVO.CAMMUTE) SRV:64bit: - [2011.06.03 13:51:38 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr) SRV:64bit: - [2011.04.20 17:04:38 | 000,144,232 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD) SRV:64bit: - [2011.04.04 17:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE) SRV:64bit: - [2011.03.29 20:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC) SRV:64bit: - [2011.03.29 20:15:36 | 000,047,728 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Windows\SysNative\TPHDEXLG64.exe -- (TPHDEXLGSVC) SRV:64bit: - [2010.04.07 21:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC) SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV:64bit: - [2007.05.25 10:42:22 | 000,034,224 | ---- | M] () [Auto | Stopped] -- C:\windows\SysNative\spool\DRIVERS\x64\3\\lxddserv.exe -- (lxddCATSCustConnectService) SRV:64bit: - [2007.05.25 10:42:12 | 000,567,216 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxddcoms.exe -- (lxdd_device) SRV:64bit: - [2006.11.22 11:11:54 | 000,566,192 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxctcoms.exe -- (lxct_device) SRV - [2013.06.04 18:24:53 | 000,116,632 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.28 08:45:11 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2013.01.15 19:46:09 | 000,184,528 | ---- | M] (IBM Corp.) [Auto | Running] -- c:\sdwork\issimsvc.exe -- (ISSIMon) SRV - [2012.11.07 18:27:16 | 000,511,288 | ---- | M] (IBM Corp.) [Auto | Running] -- C:\Program Files (x86)\C4ebreg\c4ebreg.exe -- (ISAMSvc) SRV - [2012.07.21 16:05:20 | 001,588,544 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe -- (PGP RDD Service) SRV - [2012.07.19 14:38:28 | 004,448,256 | ---- | M] (IBM) [Auto | Stopped] -- c:\notes\nsd.exe -- (Lotus Notes Diagnostics) SRV - [2012.02.09 16:30:04 | 000,745,472 | ---- | M] (IBM Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\IBM\Tivoli\Remote Control\Target\trc_base.exe -- (TRCTARGET) SRV - [2011.12.05 20:49:22 | 004,678,552 | ---- | M] (IBM Corp.) [Auto | Running] -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe -- (BESClient) SRV - [2011.12.01 04:05:00 | 000,478,056 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE -- (DozeSvc) SRV - [2011.12.01 04:05:00 | 000,175,168 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe -- (PwmEWSvc) SRV - [2011.12.01 04:05:00 | 000,089,152 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service) SRV - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP) SRV - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service) SRV - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService) SRV - [2011.09.16 09:31:34 | 000,189,832 | ---- | M] (IBM Corp) [Auto | Running] -- c:\notes\SUService.exe -- (LNSUSvc) SRV - [2011.09.16 09:29:18 | 000,071,048 | ---- | M] (IBM Corp) [Auto | Stopped] -- c:\notes\ntmulti.exe -- (Multi-user Cleanup Service) SRV - [2011.08.29 23:11:04 | 000,846,448 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe -- (VMUSBArbService) SRV - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService) SRV - [2011.04.19 17:12:22 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService) SRV - [2011.04.14 20:22:28 | 000,263,528 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe -- (AcSvc) SRV - [2011.04.14 20:22:26 | 000,124,264 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe -- (AcPrfMgrSvc) SRV - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr) SRV - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr) SRV - [2011.03.24 22:11:32 | 000,428,912 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE -- (SNAC) SRV - [2011.03.24 22:11:30 | 003,249,768 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService) SRV - [2011.03.24 22:11:30 | 001,839,776 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus) SRV - [2010.09.09 19:40:38 | 000,079,200 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe -- (NetLogSvc) SRV - [2010.09.09 19:40:24 | 000,476,000 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe -- (netcfgsvr) SRV - [2010.09.09 19:40:02 | 000,349,536 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe -- (NetClientSvc) SRV - [2010.09.07 22:05:51 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate) SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.06.18 16:19:30 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.04.29 02:00:00 | 000,436,736 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\XAudio64.dll -- (HsfXAudioService) SRV - [2008.09.18 09:30:54 | 000,122,880 | ---- | M] () [Auto | Running] -- C:\Windows\wrtService.exe -- (WRTService) SRV - [2007.05.25 10:42:22 | 000,034,224 | ---- | M] () [Auto | Stopped] -- C:\windows\system32\spool\DRIVERS\x64\3\\lxddserv.exe -- (lxddCATSCustConnectService) SRV - [2007.05.25 10:41:38 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxddcoms.exe -- (lxdd_device) SRV - [2006.11.22 11:11:36 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxctcoms.exe -- (lxct_device) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AnyDVD.sys -- (AnyDVD) DRV:64bit: - [2013.04.04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2013.03.04 14:24:27 | 000,040,344 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2012.12.11 07:22:08 | 000,042,824 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV) DRV:64bit: - [2012.09.30 18:05:08 | 000,233,120 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wpshelper.sys -- (WpsHelper) DRV:64bit: - [2012.09.27 07:00:40 | 000,052,320 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0) DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012.08.23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012.07.21 16:05:34 | 000,015,848 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\PGPwdefs.sys -- (Pgpwdefs) DRV:64bit: - [2012.07.21 16:05:32 | 000,372,704 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\PGPwded.sys -- (PGPwded) DRV:64bit: - [2012.07.21 16:05:30 | 000,051,856 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\PGPsdk.sys -- (PGPsdkDriver) DRV:64bit: - [2012.07.21 16:05:22 | 000,273,848 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\windows\SysNative\drivers\PGPdisk.sys -- (PGPdisk) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.20 15:28:25 | 000,039,552 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tcpipBM.sys -- (tcpipBM) DRV:64bit: - [2012.02.20 15:28:25 | 000,016,512 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BMLoad.sys -- (BMLoad) DRV:64bit: - [2011.12.01 04:05:00 | 000,031,344 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\DZHDD64.SYS -- (DzHDD64) DRV:64bit: - [2011.12.01 04:05:00 | 000,014,960 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\TPPWR64V.SYS -- (TPPWRIF) DRV:64bit: - [2011.11.14 00:43:36 | 000,063,088 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86) DRV:64bit: - [2011.11.14 00:42:40 | 000,032,880 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd) DRV:64bit: - [2011.11.14 00:42:12 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif) DRV:64bit: - [2011.11.13 22:33:56 | 000,045,680 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge) DRV:64bit: - [2011.11.13 22:33:56 | 000,020,080 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter) DRV:64bit: - [2011.10.17 17:24:50 | 000,437,288 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (BTWAMPFL) DRV:64bit: - [2011.10.17 17:24:44 | 000,164,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt) DRV:64bit: - [2011.10.17 17:24:44 | 000,146,984 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio) DRV:64bit: - [2011.10.17 17:24:44 | 000,039,976 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap) DRV:64bit: - [2011.10.17 17:24:44 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid) DRV:64bit: - [2011.10.03 23:46:40 | 001,577,088 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2011.09.26 03:40:28 | 012,309,440 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2011.08.29 23:11:04 | 000,039,024 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon) DRV:64bit: - [2011.08.29 23:01:10 | 000,037,680 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmusb.sys -- (vmusb) DRV:64bit: - [2011.08.23 07:12:56 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) DRV:64bit: - [2011.08.08 15:59:12 | 000,116,336 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci) DRV:64bit: - [2011.08.08 08:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP) DRV:64bit: - [2011.08.08 08:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL) DRV:64bit: - [2011.08.04 16:45:24 | 000,341,680 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress) DRV:64bit: - [2011.08.03 18:28:32 | 008,604,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) DRV:64bit: - [2011.05.25 18:23:00 | 000,101,888 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdxc64.sys -- (risdxc) DRV:64bit: - [2011.04.18 16:43:30 | 000,086,528 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gt72ubus.sys -- (GT72UBUS) DRV:64bit: - [2011.04.18 16:43:28 | 000,130,048 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Gt51Ip.sys -- (GT72NDISIPXP) DRV:64bit: - [2011.04.18 16:43:28 | 000,010,496 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gtptser.sys -- (GTPTSER) DRV:64bit: - [2011.04.18 16:43:26 | 000,085,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV:64bit: - [2011.03.29 20:13:40 | 000,139,888 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsX64.sys -- (Shockprf) DRV:64bit: - [2011.03.29 20:11:48 | 000,023,664 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsHM64.sys -- (TPDIGIMN) DRV:64bit: - [2011.03.28 21:52:12 | 000,173,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent) DRV:64bit: - [2011.03.25 02:00:00 | 001,423,408 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2011.03.24 22:11:36 | 000,053,808 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\WPSDRVnt.sys -- (WPS) DRV:64bit: - [2011.03.24 22:11:34 | 000,482,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\srtspl64.sys -- (SRTSPL) DRV:64bit: - [2011.03.24 22:11:34 | 000,449,072 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\srtsp64.sys -- (SRTSP) DRV:64bit: - [2011.03.24 22:11:34 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\srtspx64.sys -- (SRTSPX) DRV:64bit: - [2011.03.24 22:11:32 | 000,064,048 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Teefer2.sys -- (Teefer2) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.03.05 02:00:00 | 000,166,016 | ---- | M] (Ricoh co.,Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\5U877.sys -- (5U877) DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2011.02.16 19:23:46 | 000,074,240 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb) DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone) DRV:64bit: - [2010.12.10 02:00:00 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2010.12.10 02:00:00 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2010.12.02 02:00:00 | 000,101,416 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\l36wgps64.sys -- (l36wgps) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 11:57:43 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc) DRV:64bit: - [2010.11.05 02:00:00 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iastor) DRV:64bit: - [2010.10.31 02:00:00 | 000,419,912 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Mbm3DevMt.sys -- (Mbm3DevMt) DRV:64bit: - [2010.10.31 02:00:00 | 000,411,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Mbm3CBus.sys -- (Mbm3CBus) DRV:64bit: - [2010.10.19 02:00:00 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2010.10.19 02:00:00 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) DRV:64bit: - [2010.09.09 22:24:04 | 000,190,464 | R--- | M] (AT&T) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\agnfilt.sys -- (agnfilt) DRV:64bit: - [2010.09.07 21:09:34 | 000,015,472 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\smiifx64.sys -- (lenovo.smi) DRV:64bit: - [2010.09.01 15:33:12 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K3805-z_dc_enum.sys -- (vodafone_K3805-z_dc_enum) DRV:64bit: - [2010.08.24 02:00:00 | 000,091,648 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_jucdcacm.sys -- (huawei_cdcacm) DRV:64bit: - [2010.08.07 02:00:00 | 000,121,600 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard) DRV:64bit: - [2010.07.27 02:00:00 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV:64bit: - [2010.07.27 02:00:00 | 000,029,696 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_juextctrl.sys -- (huawei_ext_ctrl) DRV:64bit: - [2010.06.30 01:22:50 | 000,014,848 | ---- | M] (AT&T) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avpnnic.sys -- (avpnnic) DRV:64bit: - [2010.05.04 02:00:00 | 000,022,528 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwupgrade.sys -- (huawei_update) DRV:64bit: - [2010.03.20 02:00:00 | 000,013,952 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter) DRV:64bit: - [2010.03.03 02:00:00 | 000,030,248 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wwussf64.sys -- (ecnssndisfltr) DRV:64bit: - [2010.03.03 02:00:00 | 000,026,664 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wwuss64.sys -- (ecnssndis) DRV:64bit: - [2009.10.26 02:00:00 | 000,061,952 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimspe64.sys -- (rimspci) DRV:64bit: - [2009.09.28 02:00:00 | 000,055,808 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rixdpe64.sys -- (rixdpcie) DRV:64bit: - [2009.09.04 02:00:00 | 000,067,072 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk) DRV:64bit: - [2009.09.04 02:00:00 | 000,057,856 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp) DRV:64bit: - [2009.09.04 02:00:00 | 000,054,784 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM) DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM) DRV:64bit: - [2009.06.30 02:00:00 | 001,486,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV) DRV:64bit: - [2009.06.30 02:00:00 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf) DRV:64bit: - [2009.06.30 02:00:00 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL) DRV:64bit: - [2009.06.10 22:35:02 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\e1k60x64.sys -- (e1kexpress) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.11 02:00:00 | 000,118,016 | ---- | M] (Lenovo) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LenovoRd.sys -- (LenovoRd) DRV:64bit: - [2009.04.29 02:00:00 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio) DRV:64bit: - [2009.01.09 16:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort) DRV:64bit: - [2008.05.06 17:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM) DRV:64bit: - [2007.02.19 07:56:38 | 000,027,136 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\psadd.sys -- (psadd) DRV:64bit: - [2006.06.19 02:00:00 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk) DRV - [2013.05.24 10:00:00 | 002,098,776 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130603.023\ex64.sys -- (NAVEX15) DRV - [2013.05.24 10:00:00 | 000,126,040 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130603.023\eng64.sys -- (NAVENG) DRV - [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\AnyDVD.sys -- (AnyDVD) DRV - [2012.08.09 09:46:25 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl) DRV - [2012.08.09 09:46:25 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2011.03.24 22:11:34 | 000,482,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\srtspl64.sys -- (SRTSPL) DRV - [2011.03.24 22:11:34 | 000,449,072 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysWOW64\drivers\srtsp64.sys -- (SRTSP) DRV - [2011.03.24 22:11:34 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysWOW64\drivers\srtspx64.sys -- (SRTSPX) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2002.07.18 06:00:00 | 000,007,012 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\PMEMNT.SYS -- (PMEM) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [String data over 1000 bytes] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C ED 65 D5 DD 17 CB 01 [binary data] IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.) IE - HKCU\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = w3-501.ibm.com;<local> ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: ietab%40ip.cn:2.04.20110724.3ibm FF - prefs.js..extensions.enabledAddons: langpack-en-US%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: langpack-fr%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: langpack-ja%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: langpack-ko%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: langpack-zh-CN%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: langpack-zh-TW%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: %7B25A1388B-6B18-46c3-BEBA-A81915D0DE8F%7D:1.7.8.3 FF - prefs.js..extensions.enabledAddons: IBM-cck%40firefox-extensions.ibm.com:2.1.11 FF - prefs.js..extensions.enabledAddons: bpaddtonab%40firefox-extensions.ibm.com:1.1.2 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.6 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@IBM.com/Java60: C:\Program Files\IBM\Java60\jre\bin\new_plugin\npjp2.dll (IBM) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF - HKLM\Software\MozillaPlugins\@IBM.com/Java,version=1.6.0: C:\Program Files (x86)\IBM\Java60\jre\bin\new_plugin\npjp2.dll File not found FF - HKLM\Software\MozillaPlugins\@IBM.com/JavaPlugin: C:\Program Files (x86)\IBM\Java60\jre\bin\plugin2\npjp2.dll (IBM) FF - HKLM\Software\MozillaPlugins\@IBM.com/WDPlugin,version=1: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M] FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@rim.com/npappworld: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll () FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll () FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@IBM.com/WDPlugin,version=1: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\ [2012.02.20 15:27:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [2012.12.27 10:31:08 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.04 18:24:53 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.04 18:24:53 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M] [2010.07.14 01:32:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Extensions [2013.06.04 09:09:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions [2013.06.04 09:09:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2013.06.04 09:09:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2013.06.04 09:08:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-en-US@firefox.mozilla.org [2013.06.04 09:08:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-fr@firefox.mozilla.org [2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-ja@firefox.mozilla.org [2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-zh-CN@firefox.mozilla.org [2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-zh-TW@firefox.mozilla.org [2013.06.04 18:49:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions [2013.06.04 18:36:30 | 000,000,000 | ---D | M] (Quick Locale Switcher) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F} [2013.06.04 18:36:51 | 000,000,000 | ---D | M] (IBM Add To Notes Address Book BluePages Plugin) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com [2013.06.04 18:36:48 | 000,000,000 | ---D | M] (IBM CCK) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com [2013.06.04 18:36:19 | 000,000,000 | ---D | M] (IE Tab + (IBM Edition)) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\ietab@ip.cn [2013.06.04 18:36:20 | 000,000,000 | ---D | M] ("English (US) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org [2013.06.04 18:36:21 | 000,000,000 | ---D | M] ("Français Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org [2013.06.04 18:36:22 | 000,000,000 | ---D | M] ("Japanese Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org [2013.06.04 18:36:23 | 000,000,000 | ---D | M] ("Korean (KR) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org [2013.06.04 18:36:24 | 000,000,000 | ---D | M] ("Chinese Simplified (zh-CN) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org [2013.06.04 18:36:26 | 000,000,000 | ---D | M] ("Traditional Chinese (zh-TW) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org [2013.06.04 18:49:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\staged [2013.06.04 18:36:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com\defaults [2013.06.04 18:36:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com\plugins [2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\chrome [2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\components [2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\defaults [2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\modules [2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\searchplugins [2013.06.04 18:36:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\extensions [2013.06.04 18:36:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\extensions [2013.06.04 18:36:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\extensions [2013.06.04 18:36:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\extensions [2013.06.04 18:36:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\extensions [2013.06.04 18:36:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\extensions [2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions [2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions\langpack-zh-CN@firefox.mozilla.org [2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions\langpack-zh-TW@firefox.mozilla.org [2013.03.28 22:01:51 | 000,002,906 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\global\xpinstall\xpinstall.properties [2013.03.28 22:01:51 | 000,000,580 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.28 22:01:51 | 000,000,639 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstallConfirm.properties [2013.03.29 01:22:59 | 000,003,417 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\global\xpinstall\xpinstall.properties [2013.03.29 01:22:59 | 000,000,623 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.29 01:22:59 | 000,000,706 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\xpinstall\xpinstallConfirm.properties [2013.03.29 00:24:11 | 000,004,294 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\global\xpinstall\xpinstall.properties [2013.03.29 00:24:11 | 000,000,726 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.29 00:24:11 | 000,000,842 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\xpinstall\xpinstallConfirm.properties [2013.03.29 00:51:01 | 000,002,817 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\global\xpinstall\xpinstall.properties [2013.03.29 00:51:01 | 000,000,642 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.29 00:51:01 | 000,000,642 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\xpinstall\xpinstallConfirm.properties [2013.03.29 02:03:55 | 000,002,927 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\global\xpinstall\xpinstall.properties [2013.03.29 02:03:55 | 000,000,575 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.29 02:03:55 | 000,000,584 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\xpinstall\xpinstallConfirm.properties [2013.03.29 02:10:39 | 000,002,948 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\global\xpinstall\xpinstall.properties [2013.03.29 02:10:40 | 000,000,588 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.29 02:10:40 | 000,000,541 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\xpinstall\xpinstallConfirm.properties [2013.06.04 18:49:14 | 000,504,298 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\staged\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}.xpi [2013.06.04 18:24:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2013.06.04 18:24:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9} [2013.06.04 18:24:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions [2013.06.04 18:24:44 | 000,000,000 | ---D | M] (Quick Locale Switcher) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F} [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (IBM CCK) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (IE Tab + (IBM Edition)) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\ietab@ip.cn [2013.06.04 18:24:23 | 000,000,000 | ---D | M] ("English (US) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org [2013.06.04 18:24:24 | 000,000,000 | ---D | M] ("Français Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-fr@firefox.mozilla.org [2013.06.04 18:24:26 | 000,000,000 | ---D | M] ("Japanese Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ja@firefox.mozilla.org [2013.06.04 18:24:28 | 000,000,000 | ---D | M] ("Korean (KR) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ko@firefox.mozilla.org [2013.06.04 18:24:32 | 000,000,000 | ---D | M] ("Chinese Simplified (zh-CN) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-CN@firefox.mozilla.org [2013.06.04 18:24:39 | 000,000,000 | ---D | M] ("Traditional Chinese (zh-TW) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-TW@firefox.mozilla.org [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\chrome [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\components [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\defaults [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\modules [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\searchplugins [2013.06.04 18:24:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\extensions [2013.06.04 18:24:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\extensions [2013.06.04 18:24:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\extensions [2013.06.04 18:24:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\extensions [2013.06.04 18:24:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\extensions [2013.06.04 18:24:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\extensions [2013.06.04 18:24:53 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2010.08.02 19:01:32 | 000,122,880 | ---- | M] (IBM ) -- C:\Program Files (x86)\mozilla firefox\plugins\npcpsweb.dll [2011.12.09 19:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2011.11.11 15:10:34 | 000,297,864 | ---- | M] (IBM ) -- C:\Program Files (x86)\mozilla firefox\plugins\npwdplugin821.dll [2013.03.28 23:50:17 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2013.03.28 23:50:17 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml O1 HOSTS File: ([2012.03.19 00:21:52 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\IBM\Java60\jre\bin\ssv.dll (IBM) O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\IBM\Java60\jre\bin\jp2ssv.dll (IBM) O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.) O4:64bit: - HKLM..\Run: [AcWin7Hlpr] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe (Lenovo) O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe (Lexmark International Inc.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe (Lenovo Group Limited) O4:64bit: - HKLM..\Run: [LXCTCATS] C:\windows\SysNative\spool\DRIVERS\x64\3\LXCTtime.DLL (Lexmark International Inc.) O4:64bit: - HKLM..\Run: [lxctmon.exe] C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe () O4:64bit: - HKLM..\Run: [lxddamon] C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe () O4:64bit: - HKLM..\Run: [lxddmon.exe] C:\Program Files (x86)\Lexmark 2500 Series\lxddmon.exe () O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [ProxyCap] C:\Program Files\Proxy Labs\ProxyCap\pcapui.exe (Proxy Labs) O4:64bit: - HKLM..\Run: [TpShocks] C:\windows\SysNative\TpShocks.exe (Lenovo.) O4 - HKLM..\Run: [ACSW14DE] C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (ACD Systems) O4 - HKLM..\Run: [ACTray] C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe (Lenovo) O4 - HKLM..\Run: [ACWLIcon] C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe (Lenovo) O4 - HKLM..\Run: [ALTOOLS] AccessL.exe File not found O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [C4EBReg] C:\Program Files (x86)\C4ebreg\c4ebreg.exe (IBM Corp.) O4 - HKLM..\Run: [ccApp] C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation) O4 - HKLM..\Run: [Isamtray] C:\Program Files (x86)\C4ebreg\isamtray.exe (IBM Corp.) O4 - HKLM..\Run: [Lexmark 5400 Series] C:\Program Files (x86)\Lexmark 5400 Series\fm3032.exe () O4 - HKLM..\Run: [lxddamon] C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddamon.exe () O4 - HKLM..\Run: [lxddmon.exe] C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddmon.exe () O4 - HKLM..\Run: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone) O4 - HKLM..\Run: [PWMTRV] C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL (Lenovo Group Limited) O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited) O4 - HKLM..\Run: [stgclean] c:\sdwork\w32maing.exe (IBM Corp.) O4 - HKCU..\Run: [NetSP - restore settings on power failure] C:\Program Files (x86)\AT&T Network Client\NetSP.exe (AT&T) O4 - HKCU..\Run: [SymphonyPreLoad] "C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.standard.launcher.win32.x86_3.0.1.20120110-2000\IBM Lotus Symphony" -nogui -nosplash File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 3 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Activities present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Safety present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm () O8:64bit: - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: Free YouTube Download - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra Button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\windows\SysNative\pcapwsp.dll (Proxy Labs) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - ppcapwsp.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - ppcapwsp.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - ppcapwsp.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - ppcapwsp.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - ppcapwsp.dll File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\windows\SysWow64\pcapwsp.dll (Proxy Labs) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - pcapwsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - pcapwsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - pcapwsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - pcapwsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - pcapwsp.dll File not found O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: ibm.com ([]* in Local intranet) O15 - HKCU\..Trusted Domains: ibm.com ([w3-03] http in Local intranet) O15 - HKCU\..Trusted Domains: ibm.com ([w3-03] https in Trusted sites) O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {1ACECAFE-0016-0000-0000-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp:// (Java Plug-in 1.6.0) O16 - DPF: {8B8A0588-356B-431E-A4C3-A56553266DAA} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Smartscript.cab (Siebel SmartScript) O16 - DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Desktop_Integration.cab (Siebel Desktop Integration) O16 - DPF: {A6F9E1F5-780D-42F6-9644-3FC630A7AB39} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_HI_Client.cab (Siebel High Interactivity Framework) O16 - DPF: {AD4EA0DC-8CC7-4F7B-B730-267823DCE9B7} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_OutBound_mail.cab (Siebel Email Support for Microsoft Outlook and Lotus Notes) O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0169DF91-D033-43F4-A7DA-F04CD0C87DA4}: DhcpNameServer = 9.0.136.50 9.0.138.50 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: DhcpNameServer = 139.7.30.125 139.7.30.126 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: NameServer = 127.0.0.1,139.7.30.125,139.7.30.126 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: Domain = ibm.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: NameServer = 9.64.163.21,9.64.162.21 O18:64bit: - Protocol\Handler\gopher - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml - No CLSID value found O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~1\GO36F4~1.DLL) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.06.04 18:56:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe [2013.06.04 18:35:32 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Desktop\Old Firefox Data-1 [2013.06.04 18:24:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013.06.04 16:02:08 | 000,000,000 | ---D | C] -- C:\swd [2013.06.04 15:59:53 | 000,000,000 | ---D | C] -- C:\sdwork [2013.06.04 12:40:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2013.06.04 09:07:19 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Desktop\Old Firefox Data [2013.06.03 19:09:00 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Documents\S [2013.05.28 16:20:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Workstation Security Tool [2013.05.28 15:41:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\C4ebreg [2013.05.28 14:31:36 | 000,158,016 | ---- | C] (IBM) -- C:\windows\SysWow64\javaws.exe [2013.05.28 14:31:35 | 000,149,824 | ---- | C] (IBM) -- C:\windows\SysWow64\javaw.exe [2013.05.28 14:31:35 | 000,149,824 | ---- | C] (IBM) -- C:\windows\SysWow64\java.exe [2013.05.28 14:31:33 | 000,084,288 | ---- | C] (IBM) -- C:\windows\SysWow64\javacplIBM60.cpl [2013.05.28 14:09:42 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2013.05.26 18:01:24 | 038,944,576 | ---- | C] (Atomix Productions) -- C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe [2013.05.19 13:04:48 | 000,142,424 | ---- | C] (SlySoft, Inc.) -- C:\windows\SysWow64\drivers\AnyDVD.sys [2013.05.19 13:04:48 | 000,142,424 | ---- | C] (SlySoft, Inc.) -- C:\windows\SysNative\drivers\AnyDVD.sys [2013.05.19 12:54:27 | 000,097,176 | ---- | C] (Elaborate Bytes AG) -- C:\windows\SysWow64\ElbyCDIO.dll [2012.07.12 10:28:44 | 002,174,976 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Program Files (x86)\Common Files\atimpenc.dll [8 C:\Users\IBM_ADMIN\Documents\*.tmp files -> C:\Users\IBM_ADMIN\Documents\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.06.04 19:12:00 | 000,783,562 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI [2013.06.04 19:12:00 | 000,663,252 | ---- | M] () -- C:\windows\SysNative\perfh009.dat [2013.06.04 19:12:00 | 000,122,674 | ---- | M] () -- C:\windows\SysNative\perfc009.dat [2013.06.04 18:58:15 | 000,000,000 | ---- | M] () -- C:\Users\IBM_ADMIN\defogger_reenable [2013.06.04 18:56:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe [2013.06.04 18:56:34 | 000,050,477 | ---- | M] () -- C:\Users\IBM_ADMIN\Desktop\Defogger.exe [2013.06.04 18:36:50 | 000,001,151 | ---- | M] () -- C:\Users\IBM_ADMIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2013.06.04 18:23:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2013.06.04 16:01:15 | 000,000,134 | ---- | M] () -- C:\windows\issiunin.bat [2013.06.04 16:01:13 | 000,000,590 | ---- | M] () -- C:\Users\Public\Desktop\ISSI EZUpdate.lnk [2013.06.04 16:01:02 | 000,000,112 | ---- | M] () -- C:\Users\Public\Desktop\IBM Standard Software Installer.url [2013.06.04 12:40:39 | 000,001,151 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.06.04 08:31:46 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2013.06.03 23:05:02 | 000,016,528 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.03 23:05:02 | 000,016,528 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.03 15:48:42 | 000,316,215 | ---- | M] () -- C:\Users\IBM_ADMIN\Documents\ANGEBOT 13000238.pdf [2013.06.03 09:55:36 | 2055,655,423 | -HS- | M] () -- C:\hiberfil.sys [2013.05.28 15:22:52 | 000,373,888 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT [2013.05.28 13:43:50 | 000,002,116 | ---- | M] () -- C:\Users\Public\Desktop\IBM Lotus Symphony.lnk [2013.05.27 17:10:40 | 000,000,160 | ---- | M] () -- C:\Users\IBM_ADMIN\AppData\Roaming\default.rss [2013.05.26 18:01:54 | 038,944,576 | ---- | M] (Atomix Productions) -- C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) -- C:\windows\SysWow64\drivers\AnyDVD.sys [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) -- C:\windows\SysNative\drivers\AnyDVD.sys [2013.05.19 12:54:27 | 000,097,176 | ---- | M] (Elaborate Bytes AG) -- C:\windows\SysWow64\ElbyCDIO.dll [8 C:\Users\IBM_ADMIN\Documents\*.tmp files -> C:\Users\IBM_ADMIN\Documents\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.06.04 18:58:15 | 000,000,000 | ---- | C] () -- C:\Users\IBM_ADMIN\defogger_reenable [2013.06.04 18:56:34 | 000,050,477 | ---- | C] () -- C:\Users\IBM_ADMIN\Desktop\Defogger.exe [2013.06.04 16:03:55 | 000,001,151 | ---- | C] () -- C:\Users\IBM_ADMIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2013.06.04 12:40:39 | 000,001,163 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2013.06.04 12:40:39 | 000,001,151 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.06.03 15:48:41 | 000,316,215 | ---- | C] () -- C:\Users\IBM_ADMIN\Documents\ANGEBOT 13000238.pdf [2013.05.31 15:08:46 | 000,002,601 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ProxyCap.lnk [2013.05.28 08:45:11 | 000,000,830 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2013.05.01 17:08:02 | 000,331,776 | ---- | C] ( ) -- C:\windows\SysWow64\sbcrreag.dll [2012.12.27 13:35:03 | 000,000,000 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\downloads.m3u [2012.12.04 22:39:57 | 000,413,696 | ---- | C] ( ) -- C:\windows\SysWow64\lxddinpa.dll [2012.12.04 22:39:57 | 000,397,312 | ---- | C] ( ) -- C:\windows\SysWow64\lxddiesc.dll [2012.12.04 22:39:57 | 000,385,024 | ---- | C] () -- C:\windows\SysWow64\lxddcomx.dll [2012.12.04 22:39:57 | 000,286,720 | ---- | C] () -- C:\windows\SysWow64\LXDDinst.dll [2012.12.04 22:39:56 | 001,232,896 | ---- | C] ( ) -- C:\windows\SysWow64\lxddserv.dll [2012.12.04 22:39:56 | 000,999,424 | ---- | C] ( ) -- C:\windows\SysWow64\lxddusb1.dll [2012.12.04 22:39:56 | 000,643,072 | ---- | C] ( ) -- C:\windows\SysWow64\lxddpmui.dll [2012.12.04 22:39:56 | 000,163,840 | ---- | C] ( ) -- C:\windows\SysWow64\lxddprox.dll [2012.12.04 22:39:55 | 000,700,416 | ---- | C] ( ) -- C:\windows\SysWow64\lxddhbn3.dll [2012.12.04 22:39:55 | 000,684,032 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcomc.dll [2012.12.04 22:39:55 | 000,585,728 | ---- | C] ( ) -- C:\windows\SysWow64\lxddlmpm.dll [2012.12.04 22:39:55 | 000,537,520 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcoms.exe [2012.12.04 22:39:55 | 000,425,984 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcomm.dll [2012.12.04 22:39:55 | 000,394,160 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcfg.exe [2012.12.04 22:39:55 | 000,385,968 | ---- | C] ( ) -- C:\windows\SysWow64\lxddih.exe [2012.12.04 22:39:55 | 000,181,168 | ---- | C] ( ) -- C:\windows\SysWow64\lxddppls.exe [2012.12.04 22:39:55 | 000,094,208 | ---- | C] ( ) -- C:\windows\SysWow64\lxddpplc.dll [2012.11.20 15:57:53 | 000,059,487 | ---- | C] () -- C:\Users\IBM_ADMIN\install.xml [2012.10.17 18:37:16 | 000,000,600 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\PUTTY.RND [2012.10.09 15:35:25 | 000,000,600 | ---- | C] () -- C:\Users\IBM_ADMIN\PUTTY.RND [2012.07.21 16:07:34 | 000,000,280 | ---- | C] () -- C:\windows\SysWow64\PGPsdk.dll.sig [2012.06.01 13:36:53 | 000,001,057 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\vso_ts_preview.xml [2012.04.05 10:20:35 | 000,007,600 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\Resmon.ResmonCfg [2012.03.20 16:11:35 | 000,000,632 | RHS- | C] () -- C:\Users\IBM_ADMIN\ntuser.pol [2012.03.18 21:24:10 | 000,000,460 | ---- | C] () -- C:\windows\win_bak.ini [2012.03.01 14:22:44 | 000,000,160 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\default.rss [2012.02.21 14:50:01 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib [2012.02.20 17:06:15 | 000,005,120 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.02.20 12:08:51 | 000,122,880 | ---- | C] () -- C:\windows\wrtService.exe [2012.02.20 12:08:51 | 000,000,156 | ---- | C] () -- C:\windows\SysWow64\wrtservice.ini [2012.02.18 20:15:49 | 000,274,432 | ---- | C] () -- C:\windows\SysWow64\LXCTinst.dll [2012.02.18 20:15:48 | 000,413,696 | ---- | C] ( ) -- C:\windows\SysWow64\lxctinpa.dll [2012.02.18 20:15:48 | 000,397,312 | ---- | C] ( ) -- C:\windows\SysWow64\lxctiesc.dll [2012.02.18 20:15:46 | 000,643,072 | ---- | C] ( ) -- C:\windows\SysWow64\lxctpmui.dll [2012.02.18 20:15:44 | 000,991,232 | ---- | C] ( ) -- C:\windows\SysWow64\lxctusb1.dll [2012.02.18 20:15:43 | 001,224,704 | ---- | C] ( ) -- C:\windows\SysWow64\lxctserv.dll [2012.02.18 20:15:42 | 000,163,840 | ---- | C] ( ) -- C:\windows\SysWow64\lxctprox.dll [2012.02.18 20:15:41 | 000,585,728 | ---- | C] ( ) -- C:\windows\SysWow64\lxctlmpm.dll [2012.02.18 20:15:41 | 000,181,168 | ---- | C] ( ) -- C:\windows\SysWow64\lxctppls.exe [2012.02.18 20:15:41 | 000,094,208 | ---- | C] ( ) -- C:\windows\SysWow64\lxctpplc.dll [2012.02.18 20:15:40 | 000,696,320 | ---- | C] ( ) -- C:\windows\SysWow64\lxcthbn3.dll [2012.02.18 20:15:40 | 000,385,968 | ---- | C] ( ) -- C:\windows\SysWow64\lxctih.exe [2012.02.18 20:15:39 | 000,537,520 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcoms.exe [2012.02.18 20:15:39 | 000,421,888 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcomm.dll [2012.02.18 20:15:38 | 000,684,032 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcomc.dll [2012.02.18 20:15:37 | 000,381,872 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcfg.exe [2012.02.18 14:08:24 | 000,004,767 | ---- | C] () -- C:\windows\Irremote.ini [2012.02.18 10:27:46 | 000,204,800 | ---- | C] () -- C:\windows\SysWow64\IVIresizeW7.dll [2012.02.18 10:27:46 | 000,200,704 | ---- | C] () -- C:\windows\SysWow64\IVIresizeA6.dll [2012.02.18 10:27:46 | 000,192,512 | ---- | C] () -- C:\windows\SysWow64\IVIresizeP6.dll [2012.02.18 10:27:46 | 000,192,512 | ---- | C] () -- C:\windows\SysWow64\IVIresizeM6.dll [2012.02.18 10:27:46 | 000,188,416 | ---- | C] () -- C:\windows\SysWow64\IVIresizePX.dll [2012.02.18 10:27:46 | 000,020,480 | ---- | C] () -- C:\windows\SysWow64\IVIresize.dll [2012.02.18 10:25:57 | 000,831,600 | ---- | C] () -- C:\windows\SysWow64\Ctaa1.dat [2012.02.18 10:25:52 | 000,122,880 | ---- | C] () -- C:\windows\SysWow64\cddvdint.dll [2012.02.15 17:47:03 | 000,000,376 | ---- | C] () -- C:\windows\ODBC.INI [2012.02.15 16:21:38 | 000,216,000 | ---- | C] () -- C:\windows\SysWow64\igfcg600m.bin [2012.02.15 16:21:37 | 000,056,832 | ---- | C] () -- C:\windows\SysWow64\igdde32.dll [2012.02.15 16:21:35 | 013,903,360 | ---- | C] () -- C:\windows\SysWow64\ig4icd32.dll [2012.02.15 16:20:56 | 000,777,778 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI [2011.12.09 22:41:04 | 000,000,033 | ---- | C] () -- C:\windows\Uninst.ini [2011.12.09 22:35:14 | 000,039,424 | ---- | C] () -- C:\windows\SysWow64\pdresrc.dll [2011.12.09 22:35:07 | 000,786,432 | ---- | C] () -- C:\windows\SysWow64\pdclntif.dll [2011.12.09 22:35:07 | 000,270,336 | ---- | C] () -- C:\windows\SysWow64\pdprDlg.dll [2011.12.09 22:35:07 | 000,208,896 | ---- | C] () -- C:\windows\SysWow64\selpms.dll [2011.12.09 22:35:07 | 000,106,496 | ---- | C] () -- C:\windows\SysWow64\IBMMenu.dll [2011.12.09 22:35:07 | 000,086,016 | ---- | C] () -- C:\windows\SysWow64\selpmcui.dll [2011.12.09 14:24:23 | 000,066,856 | ---- | C] () -- C:\windows\SysWow64\SynTPEnhPS.dll [2011.12.09 14:23:48 | 000,963,116 | ---- | C] () -- C:\windows\SysWow64\igkrng600.bin [2011.12.09 14:23:46 | 000,145,804 | ---- | C] () -- C:\windows\SysWow64\igcompkrng600.bin [2011.04.18 16:39:56 | 000,226,364 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4 [2010.07.03 01:50:13 | 000,000,566 | RHS- | C] () -- C:\ProgramData\ntuser.pol ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.02.18 20:30:47 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\5400 Series [2012.02.24 20:28:04 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\ACD Systems [2012.10.12 12:35:05 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Azureus [2013.02.06 12:27:12 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\calibre [2012.07.05 09:34:15 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\com.unitedinternet.ums.sms-mms-manager [2013.01.01 18:06:03 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Dropbox [2012.12.27 10:34:19 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoft [2012.12.27 10:34:36 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers [2012.07.30 10:59:59 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\IBM [2012.03.14 10:54:48 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\IBMERS [2012.11.28 16:38:23 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\JawboneUpdater [2012.12.04 22:46:28 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Lexmark Productivity Studio [2011.12.09 22:17:22 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Lotus [2012.02.16 09:04:43 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\pdfforge [2012.11.14 18:00:43 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\PGP Corporation [2012.02.15 17:10:34 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\PwrMgr [2012.02.20 17:01:05 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Research In Motion [2010.07.14 01:18:48 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Sierra Wireless [2012.02.20 15:35:49 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Vodafone [2013.01.01 18:04:23 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Vso [2012.12.17 18:13:32 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\WDPlugin [2010.11.12 02:36:49 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\WinBatch [2012.12.27 14:10:09 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Xilisoft ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 76 bytes -> C:\Users\IBM_ADMIN\Documents\Liste 2.doc:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\IBM_ADMIN\Documents\checkliste travel.xls:Roxio EMC Stream < End of report > |
|
04.06.2013, 20:07
| #2 |
| /// the machine /// TB-Ausbilder    | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Hi,
__________________Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches OTL log. LOgs bitte in Codetags posten.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
04.06.2013, 20:56
| #3 |
| | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Hallo Schrauber,
__________________danke für das sehr schnell melden. Ich hoffe Du bist mein Rettungsengel. Habe alles haarklein so gemacht, hier das Ergebnis: Danke mailmeback ************************ Code:
ATTFilter # AdwCleaner v2.301 - Logfile created 06/04/2013 at 21:21:18
# Updated 16/05/2013 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : xxx - IBM-IF34NF70CTV
# Boot Mode : Normal
# Running from : C:\Users\IBM_ADMIN\Desktop\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
File Deleted : C:\END
Folder Deleted : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\Vuze_Remote
Folder Deleted : C:\Users\IBM_ADMIN\AppData\Local\Conduit
Folder Deleted : C:\Users\IBM_ADMIN\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\IBM_ADMIN\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\IBM_ADMIN\AppData\LocalLow\Vuze_Remote
Folder Deleted : C:\Users\IBM_ADMIN\AppData\Roaming\dvdvideosoftiehelpers
Folder Deleted : C:\Users\IBM_ADMIN\AppData\Roaming\pdfforge
***** [Registry] *****
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\AppDataLow\Software\Vuze_Remote
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E30ED111-BD63-48C2-A6CB-AB3C9FFFB07C}
Key Deleted : HKCU\Software\OCS
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2504091
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E30ED111-BD63-48C2-A6CB-AB3C9FFFB07C}
Key Deleted : HKLM\Software\Vuze_Remote
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E30ED111-BD63-48C2-A6CB-AB3C9FFFB07C}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABEF8EAA-76C1-4BF8-A21E-2C98D498CD0B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BABEBD82-9B49-4397-BDAC-0B1618E25AB7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Vuze_Remote Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{acaa314b-eeba-48e4-ad47-84e31c44796c}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.7601.17514
[OK] Registry is clean.
-\\ Mozilla Firefox v17.0.6 (en-US)
File : C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\prefs.js
[OK] File is clean.
File : C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\prefs.js
[OK] File is clean.
File : C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\prefs.js
[OK] File is clean.
File : C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\prefs.js
[OK] File is clean.
*************************
AdwCleaner[S1].txt - [4639 octets] - [04/06/2013 21:21:18]
########## EOF - C:\AdwCleaner[S1].txt - [4699 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Professional x64
Ran by xxx on 04.06.2013 at 21:33:21,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Failed to delete: [Folder] "C:\ProgramData\bigfix"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.06.2013 at 21:36:44,30
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
OTL Logfile: Code:
ATTFilter OTL logfile created on: 04.06.2013 21:39:27 - Run 6 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\IBM_ADMIN\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy 7,89 Gb Total Physical Memory | 5,64 Gb Available Physical Memory | 71,49% Memory free 15,77 Gb Paging File | 13,53 Gb Available in Paging File | 85,80% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 298,09 Gb Total Space | 68,73 Gb Free Space | 23,06% Space Free | Partition Type: NTFS Computer Name: IBM-IF34NF70CTV | User Name: xxxxxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.04 18:56:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.01.15 19:46:09 | 000,184,528 | ---- | M] (IBM Corp.) -- c:\sdwork\issimsvc.exe PRC - [2012.11.16 13:28:17 | 011,296,768 | ---- | M] (IBM) -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.brand.win32_3.0.1.20120110-2000\program\soffice.bin PRC - [2012.11.07 18:28:31 | 000,326,968 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\C4ebreg\isamtray.exe PRC - [2012.11.07 18:27:16 | 000,511,288 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\C4ebreg\c4ebreg.exe PRC - [2012.07.21 16:05:20 | 001,588,544 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe PRC - [2012.07.21 16:05:14 | 003,935,944 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe PRC - [2012.07.19 14:38:28 | 004,448,256 | ---- | M] (IBM) -- c:\notes\nsd.exe PRC - [2011.12.05 20:49:22 | 004,678,552 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe PRC - [2011.12.05 20:49:22 | 001,471,896 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe PRC - [2011.12.01 04:05:00 | 000,064,576 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE PRC - [2011.11.17 02:36:22 | 001,231,472 | ---- | M] (ACD Systems) -- C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe PRC - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe PRC - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe PRC - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe PRC - [2011.09.16 09:31:34 | 000,189,832 | ---- | M] (IBM Corp) -- c:\notes\SUService.exe PRC - [2011.09.16 09:29:18 | 000,071,048 | ---- | M] (IBM Corp) -- c:\notes\ntmulti.exe PRC - [2011.09.15 17:19:14 | 000,079,232 | ---- | M] (IBM) -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\symphony.exe PRC - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe PRC - [2011.07.22 13:21:34 | 000,060,264 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe PRC - [2011.07.22 13:21:32 | 000,042,344 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe PRC - [2011.07.22 13:21:18 | 000,041,832 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe PRC - [2011.05.27 02:43:12 | 000,328,040 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe PRC - [2011.04.19 17:12:22 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe PRC - [2011.04.19 17:12:18 | 000,408,576 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe PRC - [2011.04.14 20:24:26 | 000,410,984 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe PRC - [2011.04.14 20:22:42 | 000,361,832 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe PRC - [2011.04.14 20:22:36 | 000,193,896 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe PRC - [2011.04.14 20:22:30 | 000,431,464 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe PRC - [2011.04.14 20:22:28 | 000,263,528 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe PRC - [2011.04.14 20:22:26 | 000,124,264 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe PRC - [2011.04.07 23:41:32 | 000,138,680 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\ZOOM\TpScrex.exe PRC - [2011.04.04 17:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\micmute.exe PRC - [2011.03.29 20:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe PRC - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe PRC - [2011.03.24 22:11:32 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe PRC - [2011.03.24 22:11:30 | 001,839,776 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe PRC - [2011.03.24 22:11:30 | 000,050,544 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe PRC - [2011.02.18 12:47:12 | 000,079,192 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe PRC - [2010.09.09 19:40:38 | 000,079,200 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe PRC - [2010.09.09 19:40:24 | 000,476,000 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe PRC - [2010.09.09 19:40:02 | 000,349,536 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe PRC - [2010.04.07 21:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe PRC - [2010.04.01 21:50:44 | 000,043,960 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe PRC - [2009.06.18 16:19:30 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2009.04.27 14:37:18 | 000,025,256 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe PRC - [2008.09.18 09:30:54 | 000,122,880 | ---- | M] () -- C:\Windows\wrtService.exe PRC - [2006.11.22 11:11:24 | 000,082,864 | ---- | M] (Lexmark International Inc.) -- C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe PRC - [2006.11.22 11:11:22 | 000,291,760 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe ========== Modules (No Company Name) ========== MOD - [2013.05.28 15:26:45 | 000,077,824 | ---- | M] () -- C:\Users\IBM_ADMIN\IBM\Lotus\Symphony\.config\org.eclipse.osgi\bundles\529\1\.cp\officebean.dll MOD - [2013.05.28 15:26:43 | 000,073,728 | ---- | M] () -- C:\Users\IBM_ADMIN\IBM\Lotus\Symphony\.config\org.eclipse.osgi\bundles\280\1\.cp\swtIbmWrapper.dll MOD - [2013.05.27 08:09:32 | 002,297,856 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\3c2ed368e1f3889997dfb42a5ca77284\System.Core.ni.dll MOD - [2013.05.27 08:09:18 | 000,181,248 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Common\087705bc24370a204f2c6255fc68ad0e\Vodafone.Common.ni.dll MOD - [2013.05.27 08:09:17 | 000,673,280 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Data\d509111dd6accedf8942eb2b6b83fec6\Vodafone.Data.ni.dll MOD - [2013.05.26 20:24:57 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5dabd015d753b028750e4853dde12178\System.Windows.Forms.ni.dll MOD - [2013.05.26 20:24:49 | 003,347,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll MOD - [2013.05.26 20:24:45 | 000,687,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\23673bbebe3c0ca7c894e614bb3ffd1a\System.Security.ni.dll MOD - [2013.05.26 20:24:40 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll MOD - [2013.02.18 12:00:50 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Manag#\6c4e587713b061a12ee470864ca4fb97\Vodafone.View.ManagedToolTip.ni.dll MOD - [2013.02.18 12:00:49 | 000,876,544 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Shared\0e762a83572c331f3475b6c20722f4fb\Vodafone.View.Shared.ni.dll MOD - [2013.02.18 12:00:45 | 000,606,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Secon#\32cf63de2f013751cd1874dc1fd9debf\Vodafone.View.SecondaryWindows.ni.dll MOD - [2013.02.18 12:00:43 | 000,031,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\cc6f7fbebb0748b98dfce775d95005c6\Vodafone.DeviceAccess.Factory.ni.dll MOD - [2013.02.18 12:00:42 | 000,499,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\fd8de9d227b25a729338f4fdca7571b0\Vodafone.DeviceAccess.Internals.ni.dll MOD - [2013.02.18 12:00:40 | 000,674,304 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\b53a516b601a9dc1c183a48339e7a92e\Vodafone.ConnectionServices.ni.dll MOD - [2013.02.18 12:00:37 | 000,050,176 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\c3058f2d5d8b4717e85d530f54463e0d\Vodafone.Contracts.Adapter.ni.dll MOD - [2013.02.18 12:00:32 | 001,304,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\eb027595e692626525390ae831f4934e\Infragistics2.Win.UltraWinEditors.v9.2.ni.dll MOD - [2013.02.18 12:00:29 | 003,348,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.M#\2a1a484a011c63a38d01cba92f641890\Infragistics2.Win.Misc.v9.2.ni.dll MOD - [2013.02.18 12:00:22 | 011,053,056 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.v#\9c3e7a0a80452bab80237eafcc576389\Infragistics2.Win.v9.2.ni.dll MOD - [2013.02.18 12:00:02 | 000,871,424 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Share#\8edb485e7273579bb217330f8ba7fb98\Infragistics2.Shared.v9.2.ni.dll MOD - [2013.02.18 11:59:59 | 007,137,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\4c43791aeb4aede26a3bd89d86bc89b5\Infragistics2.Win.UltraWinToolbars.v9.2.ni.dll MOD - [2013.02.18 11:59:46 | 000,037,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\74f8482ed000aed6d9057d4f2d5dc2f3\Vodafone.Contracts.Presenter.ni.dll MOD - [2013.02.18 11:59:45 | 000,132,608 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\5f8ef1464fd770130f9715f485bf94bc\Vodafone.Contracts.Model.ni.dll MOD - [2013.02.18 11:59:44 | 000,105,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\acb2ca5e34236615024edcdcc4fa6b2b\Vodafone.Contracts.View.ni.dll MOD - [2013.02.18 11:59:43 | 000,094,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\9ec5cec32e8e823f78144fcb9a47fb64\Vodafone.Contracts.Common.ni.dll MOD - [2013.02.18 11:59:39 | 000,342,016 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.CommonDial#\30b0a9cd1f814f94fa0de09349a7e4d7\Vodafone.CommonDialogs.ni.dll MOD - [2013.02.18 11:59:37 | 000,947,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Applicatio#\6a874bbee313ab4f3ab630a2e6855d58\Vodafone.ApplicationHost.Impl.ni.dll MOD - [2013.02.18 11:59:34 | 000,326,656 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DataAccess#\d9173324d53199cabf7f663060356804\Vodafone.DataAccessor.ni.dll MOD - [2013.02.18 11:59:16 | 000,158,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Contr#\0a6abb05d1f030b0aca6c78857f130ae\Vodafone.Base.Contracts.ni.dll MOD - [2013.02.18 11:59:13 | 001,368,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Platform\7ee6c9cdec2c6eee428213bb5646b97c\Vodafone.Platform.ni.dll MOD - [2013.02.18 11:59:09 | 000,283,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\MobileBroadband\e6c36364416e40614eac2b777471961d\MobileBroadband.ni.exe MOD - [2013.02.17 17:50:08 | 000,212,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\7ff638de44686eab4afaa8b3c8a9cfca\System.ServiceProcess.ni.dll MOD - [2013.01.16 14:13:48 | 001,065,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\d602f7a5bbd392dddbc07c2f5f083a11\System.Management.ni.dll MOD - [2013.01.16 14:13:43 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d908c91e24616e6b8d38c9da61038b25\Accessibility.ni.dll MOD - [2013.01.16 14:13:32 | 005,459,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\fa022967bdd1030211f9cadcab797520\System.Xml.ni.dll MOD - [2013.01.16 14:13:27 | 007,989,760 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll MOD - [2013.01.16 14:13:08 | 000,774,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\83265111769de5cd294df17e6d762958\System.Runtime.Remoting.ni.dll MOD - [2013.01.16 14:13:07 | 000,627,712 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\7e584aeb8aa941f7f9bce2a31ea750f0\System.Transactions.ni.dll MOD - [2013.01.16 14:13:06 | 006,638,592 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\81f61d2c8af0d34385679aa2465c609a\System.Data.ni.dll MOD - [2013.01.16 14:12:40 | 012,678,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\09594e500a32cd9a1e4ddf33b45b4e44\PresentationCore.ni.dll MOD - [2013.01.16 10:25:55 | 000,080,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsProfile#\037db27d8cacfabe7ed7b999e14552c4\Vodafone.SmsProfileManager.ni.dll MOD - [2013.01.16 10:25:55 | 000,031,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.OutlookCon#\8c256f277b654a2421f817711d72a72f\Vodafone.OutlookConnector.ni.dll MOD - [2013.01.16 10:25:45 | 000,321,536 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Win32\4fc713e9bd132a9c0e0b177b9eceddf3\Vodafone.Base.Win32.ni.dll MOD - [2013.01.16 10:25:45 | 000,197,120 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsContact#\2e27dae10259458ed19ab28802d6d435\Vodafone.SmsContactManager.ni.dll MOD - [2013.01.15 22:16:27 | 000,252,928 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.FNCClient11#\fd734656ee66b5253483a686d6d679d8\Interop.FNCClient11Lib.ni.dll MOD - [2013.01.15 22:16:26 | 000,219,648 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Conn#\9365c6b816ac5d118accc3e870ec8759\Vodafone.Model.Connection.ni.dll MOD - [2013.01.15 22:16:26 | 000,033,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.UpdateMana#\ec56e9bcdd353278994778ebfa8f5aab\Vodafone.UpdateManager.ni.dll MOD - [2013.01.15 22:16:23 | 000,082,432 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Remot#\552e346f1bc27fa324a710072104ab0f\Vodafone.Core.Remoting.ni.dll MOD - [2013.01.15 22:16:23 | 000,054,784 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.TrafficOpt#\f6bb1fbd008e4be503a15a0633fa694b\Vodafone.TrafficOptimiser.ni.dll MOD - [2013.01.15 22:16:23 | 000,024,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.CoreI#\06cf2695acff680bd5008e4bd1cb5375\Vodafone.Core.CoreInstanceProvider.ni.dll MOD - [2013.01.15 22:16:22 | 000,119,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\d65e3892ff3bfd90b6b37f7ef0c8761c\Interop.Shell32.ni.dll MOD - [2013.01.15 22:16:22 | 000,106,496 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LanWlanMan#\c1a004ae9c01857bccbdaa343e885422\Vodafone.LanWlanManager.ni.dll MOD - [2013.01.15 22:16:22 | 000,072,704 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Vpn\1f2f44b9c1e6f8d028b5005fc7658972\Vodafone.Vpn.ni.dll MOD - [2013.01.15 22:16:21 | 000,393,728 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MbbManagem#\64bd72f4e684ee7fd460fe4c65f2bc0d\Vodafone.MbbManagement.ni.dll MOD - [2013.01.15 22:16:21 | 000,081,408 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.MbnApi\f450d8d019b097372ed1dea56de0e5a2\Interop.MbnApi.ni.dll MOD - [2013.01.15 22:16:21 | 000,039,936 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\e3be5dd41dd4f191b99353a091afbb2f\Vodafone.DeviceAccess.Interfaces.ni.dll MOD - [2013.01.15 22:16:20 | 000,733,696 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.WwanWrapper\657dd7faab285319de359b2fa0706558\Vodafone.WwanWrapper.ni.dll MOD - [2013.01.15 22:16:19 | 000,020,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Inter#\f70562c22e9a0d5d45171b13d6c56b7f\Vodafone.Core.Interfaces.ni.dll MOD - [2013.01.15 22:16:18 | 000,942,080 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.BusinessLo#\02c5bea3c3542435991367afd45d0ae9\Vodafone.BusinessLogic.ni.dll MOD - [2013.01.15 22:16:17 | 002,110,976 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Spring.Core\b559dd7a2b0f458d9e89412c4728b824\Spring.Core.ni.dll MOD - [2013.01.15 22:16:17 | 000,047,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Common.Logging\e1f5430a5664ac36d30136ffe1339bc2\Common.Logging.ni.dll MOD - [2013.01.15 22:16:15 | 000,042,496 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.InstancePr#\eb9e8b0000726b973085e44c1e8e3ec8\Vodafone.InstanceProvider.Impl.ni.dll MOD - [2013.01.15 22:15:59 | 000,098,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Contr#\4648622b8786e9df320724f55d507421\Vodafone.Core.Contracts.ni.dll MOD - [2013.01.15 22:15:59 | 000,026,112 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\e5f971684a0cfdbade27c8a77b94c1dc\Vodafone.DeviceAccess.Contracts.ni.dll MOD - [2013.01.15 22:15:58 | 000,089,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Inter#\cce3a30a9dc0d6b0d0817ac8c539cb1c\Vodafone.Base.Internals.ni.dll MOD - [2013.01.15 22:15:58 | 000,017,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Facto#\5ea47d1f504e95a19ea37b2d56bb32bd\Vodafone.Base.Factory.ni.dll MOD - [2013.01.15 22:15:57 | 000,153,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\014e1457c2135de51d117bb23bde328c\Vodafone.ConnectionManagement.ni.dll MOD - [2013.01.15 22:15:55 | 000,350,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.ReportingM#\8e36bfb3548a969d0431c4c7f6d273e9\Vodafone.ReportingManager.ni.dll MOD - [2013.01.15 22:15:53 | 000,055,296 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SettingsMa#\378a6b2759e2c491e34cc6cfef7a46d6\Vodafone.SettingsManager.ni.dll MOD - [2013.01.15 22:15:52 | 000,074,240 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.NtServiceM#\7bebcfbb3c250b011b8b5e70a3e15cba\Vodafone.NtServiceMessaging.ni.dll MOD - [2013.01.15 22:15:51 | 002,003,456 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\MobileBroadbandReso#\36c482b2fb56d28a66adf894213b43df\MobileBroadbandResources.ni.dll MOD - [2013.01.15 22:15:31 | 000,019,456 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MobileBroa#\a898a34cb3613fe42c5a502f01773c2e\Vodafone.MobileBroadband.CallbackHandler.ni.dll MOD - [2013.01.15 22:15:26 | 000,096,256 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LogEngine\a455bcf66b06fd85fd03f7560979b37f\Vodafone.LogEngine.ni.dll MOD - [2013.01.15 19:06:15 | 001,597,440 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\229b5280b4e310f5e83657abbf257632\System.Drawing.ni.dll MOD - [2013.01.15 19:05:50 | 011,493,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll MOD - [2012.12.12 07:32:26 | 005,025,792 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll MOD - [2012.11.16 13:28:17 | 000,967,168 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.brand.win32_3.0.1.20120110-2000\program\libxml2.dll MOD - [2012.11.16 13:28:10 | 000,163,840 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.basis.system.win32_3.0.1.20120110-2000\basis\program\libxslt.dll MOD - [2012.11.16 13:27:48 | 000,139,264 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.basis.base.win32_3.0.1.20120110-2000\basis\program\nsldap32v50.dll MOD - [2012.11.16 13:27:27 | 000,077,824 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.filetype.win32.x86_3.0.1.20120110-2000\seditorReg.dll MOD - [2012.11.16 13:26:35 | 000,106,496 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\eclipse\plugins\com.ibm.rcp.swt.browser.dom.ie_6.2.3.20110915-1350\os\win32\x86\comex.dll MOD - [2012.10.05 12:53:24 | 003,198,976 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll MOD - [2012.10.05 12:53:24 | 000,630,784 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll MOD - [2012.08.31 12:59:19 | 004,550,656 | ---- | M] () -- C:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll MOD - [2012.02.17 07:47:08 | 000,034,816 | ---- | M] () -- C:\Program Files (x86)\Google\Google Desktop Search\gzlib.dll MOD - [2011.09.15 17:19:14 | 000,081,920 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\eclipse_1118.dll MOD - [2011.09.15 17:19:12 | 000,110,592 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\pipeserver.dll MOD - [2011.04.19 17:12:12 | 000,308,736 | ---- | M] () -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\Vodafone.View.Taskbar.dll MOD - [2011.04.14 19:15:52 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll MOD - [2010.11.05 03:58:14 | 002,048,000 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll MOD - [2010.11.05 03:58:10 | 000,303,104 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll MOD - [2010.11.05 03:58:04 | 000,425,984 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll MOD - [2009.07.14 03:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\SysWOW64\msjetoledb40.dll MOD - [2009.06.10 23:23:19 | 000,261,632 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll MOD - [2009.06.10 23:22:40 | 000,010,752 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll MOD - [2009.04.27 14:37:18 | 000,025,256 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe MOD - [2008.05.16 13:35:22 | 000,040,960 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.Monitor.Core.dll MOD - [2008.05.16 13:35:22 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.Monitor.Common.dll MOD - [2008.05.16 13:34:18 | 000,057,344 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.MCMDevMon.dll MOD - [2007.04.30 09:20:26 | 000,011,776 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.MCMDevMon.AutoPlayUtil.dll MOD - [2007.04.30 09:19:52 | 000,020,480 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.ScanDevMon.dll MOD - [2007.04.30 09:19:48 | 000,020,480 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.NetworkCardDevMon.dll MOD - [2006.11.22 11:11:22 | 000,291,760 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe MOD - [2006.08.08 17:54:18 | 000,278,528 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctscw.dll MOD - [2006.06.09 04:39:54 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctdrec.dll MOD - [2006.05.25 18:20:44 | 000,241,664 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\iptk.dll ========== Services (SafeList) ========== SRV:64bit: - [2013.05.01 17:02:26 | 002,280,960 | ---- | M] (Proxy Labs) [Auto | Running] -- C:\Program Files\Proxy Labs\ProxyCap\pcapsvc.exe -- (pcapsvc) SRV:64bit: - [2012.12.11 07:22:08 | 000,060,272 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC) SRV:64bit: - [2011.10.17 16:48:24 | 000,970,016 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe -- (btwdins) SRV:64bit: - [2011.08.08 08:39:18 | 001,166,848 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3) SRV:64bit: - [2011.07.27 22:04:48 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV:64bit: - [2011.07.27 21:44:18 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV:64bit: - [2011.07.22 13:21:34 | 000,060,264 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe -- (LENOVO.TPKNRSVC) SRV:64bit: - [2011.07.22 13:21:18 | 000,041,832 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe -- (LENOVO.CAMMUTE) SRV:64bit: - [2011.06.03 13:51:38 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr) SRV:64bit: - [2011.04.20 17:04:38 | 000,144,232 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD) SRV:64bit: - [2011.04.04 17:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE) SRV:64bit: - [2011.03.29 20:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC) SRV:64bit: - [2011.03.29 20:15:36 | 000,047,728 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Windows\SysNative\TPHDEXLG64.exe -- (TPHDEXLGSVC) SRV:64bit: - [2010.04.07 21:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC) SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV:64bit: - [2007.05.25 10:42:22 | 000,034,224 | ---- | M] () [Auto | Stopped] -- C:\windows\SysNative\spool\DRIVERS\x64\3\\lxddserv.exe -- (lxddCATSCustConnectService) SRV:64bit: - [2007.05.25 10:42:12 | 000,567,216 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxddcoms.exe -- (lxdd_device) SRV:64bit: - [2006.11.22 11:11:54 | 000,566,192 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxctcoms.exe -- (lxct_device) SRV - [2013.06.04 18:24:53 | 000,116,632 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.28 08:45:11 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2013.01.15 19:46:09 | 000,184,528 | ---- | M] (IBM Corp.) [Auto | Running] -- c:\sdwork\issimsvc.exe -- (ISSIMon) SRV - [2012.11.07 18:27:16 | 000,511,288 | ---- | M] (IBM Corp.) [Auto | Running] -- C:\Program Files (x86)\C4ebreg\c4ebreg.exe -- (ISAMSvc) SRV - [2012.07.21 16:05:20 | 001,588,544 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe -- (PGP RDD Service) SRV - [2012.07.19 14:38:28 | 004,448,256 | ---- | M] (IBM) [Auto | Running] -- c:\notes\nsd.exe -- (Lotus Notes Diagnostics) SRV - [2012.02.09 16:30:04 | 000,745,472 | ---- | M] (IBM Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\IBM\Tivoli\Remote Control\Target\trc_base.exe -- (TRCTARGET) SRV - [2011.12.05 20:49:22 | 004,678,552 | ---- | M] (IBM Corp.) [Auto | Running] -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe -- (BESClient) SRV - [2011.12.01 04:05:00 | 000,478,056 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE -- (DozeSvc) SRV - [2011.12.01 04:05:00 | 000,175,168 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe -- (PwmEWSvc) SRV - [2011.12.01 04:05:00 | 000,089,152 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service) SRV - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP) SRV - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service) SRV - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService) SRV - [2011.09.16 09:31:34 | 000,189,832 | ---- | M] (IBM Corp) [Auto | Running] -- c:\notes\SUService.exe -- (LNSUSvc) SRV - [2011.09.16 09:29:18 | 000,071,048 | ---- | M] (IBM Corp) [Auto | Running] -- c:\notes\ntmulti.exe -- (Multi-user Cleanup Service) SRV - [2011.08.29 23:11:04 | 000,846,448 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe -- (VMUSBArbService) SRV - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService) SRV - [2011.04.19 17:12:22 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService) SRV - [2011.04.14 20:22:28 | 000,263,528 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe -- (AcSvc) SRV - [2011.04.14 20:22:26 | 000,124,264 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe -- (AcPrfMgrSvc) SRV - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr) SRV - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr) SRV - [2011.03.24 22:11:32 | 000,428,912 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE -- (SNAC) SRV - [2011.03.24 22:11:30 | 003,249,768 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService) SRV - [2011.03.24 22:11:30 | 001,839,776 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus) SRV - [2010.09.09 19:40:38 | 000,079,200 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe -- (NetLogSvc) SRV - [2010.09.09 19:40:24 | 000,476,000 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe -- (netcfgsvr) SRV - [2010.09.09 19:40:02 | 000,349,536 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe -- (NetClientSvc) SRV - [2010.09.07 22:05:51 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate) SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.06.18 16:19:30 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.04.29 02:00:00 | 000,436,736 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\XAudio64.dll -- (HsfXAudioService) SRV - [2008.09.18 09:30:54 | 000,122,880 | ---- | M] () [Auto | Running] -- C:\Windows\wrtService.exe -- (WRTService) SRV - [2007.05.25 10:42:22 | 000,034,224 | ---- | M] () [Auto | Stopped] -- C:\windows\system32\spool\DRIVERS\x64\3\\lxddserv.exe -- (lxddCATSCustConnectService) SRV - [2007.05.25 10:41:38 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxddcoms.exe -- (lxdd_device) SRV - [2006.11.22 11:11:36 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxctcoms.exe -- (lxct_device) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AnyDVD.sys -- (AnyDVD) DRV:64bit: - [2013.04.04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2013.03.04 14:24:27 | 000,040,344 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2012.12.11 07:22:08 | 000,042,824 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV) DRV:64bit: - [2012.09.30 18:05:08 | 000,233,120 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wpshelper.sys -- (WpsHelper) DRV:64bit: - [2012.09.27 07:00:40 | 000,052,320 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0) DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012.08.23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012.07.21 16:05:34 | 000,015,848 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\PGPwdefs.sys -- (Pgpwdefs) DRV:64bit: - [2012.07.21 16:05:32 | 000,372,704 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\PGPwded.sys -- (PGPwded) DRV:64bit: - [2012.07.21 16:05:30 | 000,051,856 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\PGPsdk.sys -- (PGPsdkDriver) DRV:64bit: - [2012.07.21 16:05:22 | 000,273,848 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\windows\SysNative\drivers\PGPdisk.sys -- (PGPdisk) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.20 15:28:25 | 000,039,552 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tcpipBM.sys -- (tcpipBM) DRV:64bit: - [2012.02.20 15:28:25 | 000,016,512 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BMLoad.sys -- (BMLoad) DRV:64bit: - [2011.12.01 04:05:00 | 000,031,344 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\DZHDD64.SYS -- (DzHDD64) DRV:64bit: - [2011.12.01 04:05:00 | 000,014,960 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\TPPWR64V.SYS -- (TPPWRIF) DRV:64bit: - [2011.11.14 00:43:36 | 000,063,088 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86) DRV:64bit: - [2011.11.14 00:42:40 | 000,032,880 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd) DRV:64bit: - [2011.11.14 00:42:12 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif) DRV:64bit: - [2011.11.13 22:33:56 | 000,045,680 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge) DRV:64bit: - [2011.11.13 22:33:56 | 000,020,080 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter) DRV:64bit: - [2011.10.17 17:24:50 | 000,437,288 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (BTWAMPFL) DRV:64bit: - [2011.10.17 17:24:44 | 000,164,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt) DRV:64bit: - [2011.10.17 17:24:44 | 000,146,984 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio) DRV:64bit: - [2011.10.17 17:24:44 | 000,039,976 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap) DRV:64bit: - [2011.10.17 17:24:44 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid) DRV:64bit: - [2011.10.03 23:46:40 | 001,577,088 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2011.09.26 03:40:28 | 012,309,440 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2011.08.29 23:11:04 | 000,039,024 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon) DRV:64bit: - [2011.08.29 23:01:10 | 000,037,680 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmusb.sys -- (vmusb) DRV:64bit: - [2011.08.23 07:12:56 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) DRV:64bit: - [2011.08.08 15:59:12 | 000,116,336 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci) DRV:64bit: - [2011.08.08 08:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP) DRV:64bit: - [2011.08.08 08:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL) DRV:64bit: - [2011.08.04 16:45:24 | 000,341,680 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress) DRV:64bit: - [2011.08.03 18:28:32 | 008,604,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) DRV:64bit: - [2011.05.25 18:23:00 | 000,101,888 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdxc64.sys -- (risdxc) DRV:64bit: - [2011.04.18 16:43:30 | 000,086,528 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gt72ubus.sys -- (GT72UBUS) DRV:64bit: - [2011.04.18 16:43:28 | 000,130,048 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Gt51Ip.sys -- (GT72NDISIPXP) DRV:64bit: - [2011.04.18 16:43:28 | 000,010,496 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gtptser.sys -- (GTPTSER) DRV:64bit: - [2011.04.18 16:43:26 | 000,085,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV:64bit: - [2011.03.29 20:13:40 | 000,139,888 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsX64.sys -- (Shockprf) DRV:64bit: - [2011.03.29 20:11:48 | 000,023,664 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsHM64.sys -- (TPDIGIMN) DRV:64bit: - [2011.03.28 21:52:12 | 000,173,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent) DRV:64bit: - [2011.03.25 02:00:00 | 001,423,408 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2011.03.24 22:11:36 | 000,053,808 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\WPSDRVnt.sys -- (WPS) DRV:64bit: - [2011.03.24 22:11:34 | 000,482,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\srtspl64.sys -- (SRTSPL) DRV:64bit: - [2011.03.24 22:11:34 | 000,449,072 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\srtsp64.sys -- (SRTSP) DRV:64bit: - [2011.03.24 22:11:34 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\srtspx64.sys -- (SRTSPX) DRV:64bit: - [2011.03.24 22:11:32 | 000,064,048 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Teefer2.sys -- (Teefer2) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.03.05 02:00:00 | 000,166,016 | ---- | M] (Ricoh co.,Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\5U877.sys -- (5U877) DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2011.02.16 19:23:46 | 000,074,240 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb) DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone) DRV:64bit: - [2010.12.10 02:00:00 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2010.12.10 02:00:00 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2010.12.02 02:00:00 | 000,101,416 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\l36wgps64.sys -- (l36wgps) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 11:57:43 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc) DRV:64bit: - [2010.11.05 02:00:00 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iastor) DRV:64bit: - [2010.10.31 02:00:00 | 000,419,912 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Mbm3DevMt.sys -- (Mbm3DevMt) DRV:64bit: - [2010.10.31 02:00:00 | 000,411,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Mbm3CBus.sys -- (Mbm3CBus) DRV:64bit: - [2010.10.19 02:00:00 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2010.10.19 02:00:00 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) DRV:64bit: - [2010.09.09 22:24:04 | 000,190,464 | R--- | M] (AT&T) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\agnfilt.sys -- (agnfilt) DRV:64bit: - [2010.09.07 21:09:34 | 000,015,472 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\smiifx64.sys -- (lenovo.smi) DRV:64bit: - [2010.09.01 15:33:12 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K3805-z_dc_enum.sys -- (vodafone_K3805-z_dc_enum) DRV:64bit: - [2010.08.24 02:00:00 | 000,091,648 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_jucdcacm.sys -- (huawei_cdcacm) DRV:64bit: - [2010.08.07 02:00:00 | 000,121,600 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard) DRV:64bit: - [2010.07.27 02:00:00 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV:64bit: - [2010.07.27 02:00:00 | 000,029,696 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_juextctrl.sys -- (huawei_ext_ctrl) DRV:64bit: - [2010.06.30 01:22:50 | 000,014,848 | ---- | M] (AT&T) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avpnnic.sys -- (avpnnic) DRV:64bit: - [2010.05.04 02:00:00 | 000,022,528 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwupgrade.sys -- (huawei_update) DRV:64bit: - [2010.03.20 02:00:00 | 000,013,952 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter) DRV:64bit: - [2010.03.03 02:00:00 | 000,030,248 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wwussf64.sys -- (ecnssndisfltr) DRV:64bit: - [2010.03.03 02:00:00 | 000,026,664 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wwuss64.sys -- (ecnssndis) DRV:64bit: - [2009.10.26 02:00:00 | 000,061,952 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimspe64.sys -- (rimspci) DRV:64bit: - [2009.09.28 02:00:00 | 000,055,808 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rixdpe64.sys -- (rixdpcie) DRV:64bit: - [2009.09.04 02:00:00 | 000,067,072 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk) DRV:64bit: - [2009.09.04 02:00:00 | 000,057,856 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp) DRV:64bit: - [2009.09.04 02:00:00 | 000,054,784 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM) DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM) DRV:64bit: - [2009.06.30 02:00:00 | 001,486,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV) DRV:64bit: - [2009.06.30 02:00:00 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf) DRV:64bit: - [2009.06.30 02:00:00 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL) DRV:64bit: - [2009.06.10 22:35:02 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\e1k60x64.sys -- (e1kexpress) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.11 02:00:00 | 000,118,016 | ---- | M] (Lenovo) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LenovoRd.sys -- (LenovoRd) DRV:64bit: - [2009.04.29 02:00:00 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio) DRV:64bit: - [2009.01.09 16:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort) DRV:64bit: - [2008.05.06 17:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM) DRV:64bit: - [2007.02.19 07:56:38 | 000,027,136 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\psadd.sys -- (psadd) DRV:64bit: - [2006.06.19 02:00:00 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk) DRV - [2013.05.24 10:00:00 | 002,098,776 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130603.023\ex64.sys -- (NAVEX15) DRV - [2013.05.24 10:00:00 | 000,126,040 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130603.023\eng64.sys -- (NAVENG) DRV - [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\AnyDVD.sys -- (AnyDVD) DRV - [2012.08.09 09:46:25 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl) DRV - [2012.08.09 09:46:25 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2011.03.24 22:11:34 | 000,482,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\srtspl64.sys -- (SRTSPL) DRV - [2011.03.24 22:11:34 | 000,449,072 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysWOW64\drivers\srtsp64.sys -- (SRTSP) DRV - [2011.03.24 22:11:34 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysWOW64\drivers\srtspx64.sys -- (SRTSPX) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2002.07.18 06:00:00 | 000,007,012 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\PMEMNT.SYS -- (PMEM) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C ED 65 D5 DD 17 CB 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = w3-501.ibm.com;<local> ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledAddons: ietab%40ip.cn:2.04.20110724.3ibm FF - prefs.js..extensions.enabledAddons: langpack-en-US%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: langpack-fr%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: langpack-ja%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: langpack-ko%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: langpack-zh-CN%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: langpack-zh-TW%40firefox.mozilla.org:17.0.5 FF - prefs.js..extensions.enabledAddons: IBM-cck%40firefox-extensions.ibm.com:2.1.11 FF - prefs.js..extensions.enabledAddons: bpaddtonab%40firefox-extensions.ibm.com:1.1.2 FF - prefs.js..extensions.enabledAddons: %7B25A1388B-6B18-46c3-BEBA-A81915D0DE8F%7D:1.7.8.5 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.6 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@IBM.com/Java60: C:\Program Files\IBM\Java60\jre\bin\new_plugin\npjp2.dll (IBM) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF - HKLM\Software\MozillaPlugins\@IBM.com/Java,version=1.6.0: C:\Program Files (x86)\IBM\Java60\jre\bin\new_plugin\npjp2.dll File not found FF - HKLM\Software\MozillaPlugins\@IBM.com/JavaPlugin: C:\Program Files (x86)\IBM\Java60\jre\bin\plugin2\npjp2.dll (IBM) FF - HKLM\Software\MozillaPlugins\@IBM.com/WDPlugin,version=1: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M] FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@rim.com/npappworld: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll () FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll () FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@IBM.com/WDPlugin,version=1: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\ [2012.02.20 15:27:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.04 18:24:53 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.04 18:24:53 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M] [2010.07.14 01:32:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Extensions [2013.06.04 09:09:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions [2013.06.04 09:09:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2013.06.04 09:09:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2013.06.04 09:08:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-en-US@firefox.mozilla.org [2013.06.04 09:08:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-fr@firefox.mozilla.org [2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-ja@firefox.mozilla.org [2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-zh-CN@firefox.mozilla.org [2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-zh-TW@firefox.mozilla.org [2013.06.04 20:30:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions [2013.06.04 18:36:51 | 000,000,000 | ---D | M] (IBM Add To Notes Address Book BluePages Plugin) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com [2013.06.04 18:36:48 | 000,000,000 | ---D | M] (IBM CCK) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com [2013.06.04 18:36:19 | 000,000,000 | ---D | M] (IE Tab + (IBM Edition)) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\ietab@ip.cn [2013.06.04 18:36:20 | 000,000,000 | ---D | M] ("English (US) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org [2013.06.04 18:36:21 | 000,000,000 | ---D | M] ("Français Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org [2013.06.04 18:36:22 | 000,000,000 | ---D | M] ("Japanese Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org [2013.06.04 18:36:23 | 000,000,000 | ---D | M] ("Korean (KR) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org [2013.06.04 18:36:24 | 000,000,000 | ---D | M] ("Chinese Simplified (zh-CN) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org [2013.06.04 18:36:26 | 000,000,000 | ---D | M] ("Traditional Chinese (zh-TW) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org [2013.06.04 18:36:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com\defaults [2013.06.04 18:36:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com\plugins [2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\chrome [2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\components [2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\defaults [2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\modules [2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\searchplugins [2013.06.04 18:36:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\extensions [2013.06.04 18:36:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\extensions [2013.06.04 18:36:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\extensions [2013.06.04 18:36:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\extensions [2013.06.04 18:36:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\extensions [2013.06.04 18:36:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\extensions [2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions [2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions\langpack-zh-CN@firefox.mozilla.org [2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions\langpack-zh-TW@firefox.mozilla.org [2013.06.04 20:30:41 | 000,504,298 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}.xpi [2013.03.28 22:01:51 | 000,002,906 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\global\xpinstall\xpinstall.properties [2013.03.28 22:01:51 | 000,000,580 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.28 22:01:51 | 000,000,639 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstallConfirm.properties [2013.03.29 01:22:59 | 000,003,417 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\global\xpinstall\xpinstall.properties [2013.03.29 01:22:59 | 000,000,623 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.29 01:22:59 | 000,000,706 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\xpinstall\xpinstallConfirm.properties [2013.03.29 00:24:11 | 000,004,294 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\global\xpinstall\xpinstall.properties [2013.03.29 00:24:11 | 000,000,726 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.29 00:24:11 | 000,000,842 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\xpinstall\xpinstallConfirm.properties [2013.03.29 00:51:01 | 000,002,817 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\global\xpinstall\xpinstall.properties [2013.03.29 00:51:01 | 000,000,642 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.29 00:51:01 | 000,000,642 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\xpinstall\xpinstallConfirm.properties [2013.03.29 02:03:55 | 000,002,927 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\global\xpinstall\xpinstall.properties [2013.03.29 02:03:55 | 000,000,575 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.29 02:03:55 | 000,000,584 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\xpinstall\xpinstallConfirm.properties [2013.03.29 02:10:39 | 000,002,948 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\global\xpinstall\xpinstall.properties [2013.03.29 02:10:40 | 000,000,588 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\xpinstall\xpinstallConfirm.dtd [2013.03.29 02:10:40 | 000,000,541 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\xpinstall\xpinstallConfirm.properties [2013.06.04 18:24:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2013.06.04 18:24:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9} [2013.06.04 18:24:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions [2013.06.04 18:24:44 | 000,000,000 | ---D | M] (Quick Locale Switcher) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F} [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (IBM CCK) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (IE Tab + (IBM Edition)) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\ietab@ip.cn [2013.06.04 18:24:23 | 000,000,000 | ---D | M] ("English (US) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org [2013.06.04 18:24:24 | 000,000,000 | ---D | M] ("Français Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-fr@firefox.mozilla.org [2013.06.04 18:24:26 | 000,000,000 | ---D | M] ("Japanese Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ja@firefox.mozilla.org [2013.06.04 18:24:28 | 000,000,000 | ---D | M] ("Korean (KR) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ko@firefox.mozilla.org [2013.06.04 18:24:32 | 000,000,000 | ---D | M] ("Chinese Simplified (zh-CN) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-CN@firefox.mozilla.org [2013.06.04 18:24:39 | 000,000,000 | ---D | M] ("Traditional Chinese (zh-TW) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-TW@firefox.mozilla.org [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\chrome [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\components [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\defaults [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\modules [2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\searchplugins [2013.06.04 18:24:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\extensions [2013.06.04 18:24:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\extensions [2013.06.04 18:24:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\extensions [2013.06.04 18:24:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\extensions [2013.06.04 18:24:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\extensions [2013.06.04 18:24:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\extensions [2013.06.04 18:24:53 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2010.08.02 19:01:32 | 000,122,880 | ---- | M] (IBM ) -- C:\Program Files (x86)\mozilla firefox\plugins\npcpsweb.dll [2011.12.09 19:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2011.11.11 15:10:34 | 000,297,864 | ---- | M] (IBM ) -- C:\Program Files (x86)\mozilla firefox\plugins\npwdplugin821.dll [2013.03.28 23:50:17 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2013.03.28 23:50:17 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml O1 HOSTS File: ([2012.03.19 00:21:52 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\IBM\Java60\jre\bin\ssv.dll (IBM) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\IBM\Java60\jre\bin\jp2ssv.dll (IBM) O4:64bit: - HKLM..\Run: [AcWin7Hlpr] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe (Lenovo) O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe (Lexmark International Inc.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe (Lenovo Group Limited) O4:64bit: - HKLM..\Run: [LXCTCATS] C:\windows\SysNative\spool\DRIVERS\x64\3\LXCTtime.DLL (Lexmark International Inc.) O4:64bit: - HKLM..\Run: [lxctmon.exe] C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe () O4:64bit: - HKLM..\Run: [lxddamon] C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe () O4:64bit: - HKLM..\Run: [lxddmon.exe] C:\Program Files (x86)\Lexmark 2500 Series\lxddmon.exe () O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [ProxyCap] C:\Program Files\Proxy Labs\ProxyCap\pcapui.exe (Proxy Labs) O4:64bit: - HKLM..\Run: [TpShocks] C:\windows\SysNative\TpShocks.exe (Lenovo.) O4 - HKLM..\Run: [ACSW14DE] C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (ACD Systems) O4 - HKLM..\Run: [ACTray] C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe (Lenovo) O4 - HKLM..\Run: [ACWLIcon] C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe (Lenovo) O4 - HKLM..\Run: [ALTOOLS] AccessL.exe File not found O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [C4EBReg] C:\Program Files (x86)\C4ebreg\c4ebreg.exe (IBM Corp.) O4 - HKLM..\Run: [ccApp] C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation) O4 - HKLM..\Run: [Isamtray] C:\Program Files (x86)\C4ebreg\isamtray.exe (IBM Corp.) O4 - HKLM..\Run: [Lexmark 5400 Series] C:\Program Files (x86)\Lexmark 5400 Series\fm3032.exe () O4 - HKLM..\Run: [lxddamon] C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddamon.exe () O4 - HKLM..\Run: [lxddmon.exe] C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddmon.exe () O4 - HKLM..\Run: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone) O4 - HKLM..\Run: [PWMTRV] C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL (Lenovo Group Limited) O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited) O4 - HKLM..\Run: [stgclean] c:\sdwork\w32maing.exe (IBM Corp.) O4 - HKCU..\Run: [NetSP - restore settings on power failure] C:\Program Files (x86)\AT&T Network Client\NetSP.exe (AT&T) O4 - HKCU..\Run: [SymphonyPreLoad] "C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.standard.launcher.win32.x86_3.0.1.20120110-2000\IBM Lotus Symphony" -nogui -nosplash File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 3 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Activities present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Safety present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm File not found O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found O8:64bit: - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm () O8:64bit: - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: Free YouTube Download - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm File not found O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra Button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm () O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\windows\SysNative\pcapwsp.dll (Proxy Labs) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - ppcapwsp.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - ppcapwsp.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - ppcapwsp.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - ppcapwsp.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - ppcapwsp.dll File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\windows\SysWow64\pcapwsp.dll (Proxy Labs) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - pcapwsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - pcapwsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - pcapwsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - pcapwsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - pcapwsp.dll File not found O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: ibm.com ([]* in Local intranet) O15 - HKCU\..Trusted Domains: ibm.com ([w3-03] http in Local intranet) O15 - HKCU\..Trusted Domains: ibm.com ([w3-03] https in Trusted sites) O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {1ACECAFE-0016-0000-0000-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp:// (Java Plug-in 1.6.0) O16 - DPF: {8B8A0588-356B-431E-A4C3-A56553266DAA} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Smartscript.cab (Siebel SmartScript) O16 - DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Desktop_Integration.cab (Siebel Desktop Integration) O16 - DPF: {A6F9E1F5-780D-42F6-9644-3FC630A7AB39} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_HI_Client.cab (Siebel High Interactivity Framework) O16 - DPF: {AD4EA0DC-8CC7-4F7B-B730-267823DCE9B7} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_OutBound_mail.cab (Siebel Email Support for Microsoft Outlook and Lotus Notes) O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0169DF91-D033-43F4-A7DA-F04CD0C87DA4}: DhcpNameServer = 9.0.136.50 9.0.138.50 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: DhcpNameServer = 139.7.30.125 139.7.30.126 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: NameServer = 127.0.0.1,139.7.30.125,139.7.30.126 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: Domain = ibm.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: NameServer = 9.64.163.21,9.64.162.21 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D695B2A3-769C-439D-AB2D-A34914269145}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\gopher - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml - No CLSID value found O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~1\GO36F4~1.DLL) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.06.04 21:33:12 | 000,000,000 | ---D | C] -- C:\windows\ERUNT [2013.06.04 21:33:04 | 000,000,000 | ---D | C] -- C:\JRT [2013.06.04 21:28:10 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\IBM_ADMIN\Desktop\JRT.exe [2013.06.04 18:56:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe [2013.06.04 18:35:32 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Desktop\Old Firefox Data-1 [2013.06.04 18:24:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013.06.04 16:02:08 | 000,000,000 | ---D | C] -- C:\swd [2013.06.04 15:59:53 | 000,000,000 | ---D | C] -- C:\sdwork [2013.06.04 12:40:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2013.06.04 09:07:19 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Desktop\Old Firefox Data [2013.06.03 19:09:00 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Documents\S [2013.05.28 16:20:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Workstation Security Tool [2013.05.28 15:41:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\C4ebreg [2013.05.28 14:31:36 | 000,158,016 | ---- | C] (IBM) -- C:\windows\SysWow64\javaws.exe [2013.05.28 14:31:35 | 000,149,824 | ---- | C] (IBM) -- C:\windows\SysWow64\javaw.exe [2013.05.28 14:31:35 | 000,149,824 | ---- | C] (IBM) -- C:\windows\SysWow64\java.exe [2013.05.28 14:31:33 | 000,084,288 | ---- | C] (IBM) -- C:\windows\SysWow64\javacplIBM60.cpl [2013.05.28 14:09:42 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2013.05.26 20:20:20 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\dxgmms1.sys [2013.05.26 20:20:19 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\cdd.dll [2013.05.26 20:19:01 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\authui.dll [2013.05.26 20:19:01 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\shdocvw.dll [2013.05.26 20:18:58 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\consent.exe [2013.05.26 20:18:57 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\authui.dll [2013.05.26 20:18:44 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\wwanprotdim.dll [2013.05.26 20:18:04 | 000,735,232 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\msfeeds.dll [2013.05.26 20:17:57 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mshtmled.dll [2013.05.26 20:17:56 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ieui.dll [2013.05.26 20:17:55 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ieui.dll [2013.05.26 20:17:55 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\url.dll [2013.05.26 20:17:55 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\url.dll [2013.05.26 20:17:55 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mshtmled.dll [2013.05.26 18:01:24 | 038,944,576 | ---- | C] (Atomix Productions) -- C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe [2013.05.19 13:04:48 | 000,142,424 | ---- | C] (SlySoft, Inc.) -- C:\windows\SysWow64\drivers\AnyDVD.sys [2013.05.19 13:04:48 | 000,142,424 | ---- | C] (SlySoft, Inc.) -- C:\windows\SysNative\drivers\AnyDVD.sys [2013.05.19 12:54:27 | 000,097,176 | ---- | C] (Elaborate Bytes AG) -- C:\windows\SysWow64\ElbyCDIO.dll [2012.07.12 10:28:44 | 002,174,976 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Program Files (x86)\Common Files\atimpenc.dll [8 C:\Users\IBM_ADMIN\Documents\*.tmp files -> C:\Users\IBM_ADMIN\Documents\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.06.04 21:32:00 | 000,016,528 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.04 21:32:00 | 000,016,528 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.04 21:29:40 | 000,783,562 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI [2013.06.04 21:29:40 | 000,663,252 | ---- | M] () -- C:\windows\SysNative\perfh009.dat [2013.06.04 21:29:40 | 000,122,674 | ---- | M] () -- C:\windows\SysNative\perfc009.dat [2013.06.04 21:27:49 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\IBM_ADMIN\Desktop\JRT.exe [2013.06.04 21:23:33 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2013.06.04 21:23:10 | 2055,655,423 | -HS- | M] () -- C:\hiberfil.sys [2013.06.04 21:19:13 | 000,632,031 | ---- | M] () -- C:\Users\IBM_ADMIN\Desktop\adwcleaner.exe [2013.06.04 20:23:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2013.06.04 19:33:19 | 000,377,856 | ---- | M] () -- C:\Users\IBM_ADMIN\Desktop\gmer_2.1.19163.exe [2013.06.04 18:58:15 | 000,000,000 | ---- | M] () -- C:\Users\IBM_ADMIN\defogger_reenable [2013.06.04 18:56:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe [2013.06.04 18:56:34 | 000,050,477 | ---- | M] () -- C:\Users\IBM_ADMIN\Desktop\Defogger.exe [2013.06.04 18:36:50 | 000,001,151 | ---- | M] () -- C:\Users\IBM_ADMIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2013.06.04 16:01:15 | 000,000,134 | ---- | M] () -- C:\windows\issiunin.bat [2013.06.04 16:01:13 | 000,000,590 | ---- | M] () -- C:\Users\Public\Desktop\ISSI EZUpdate.lnk [2013.06.04 16:01:02 | 000,000,112 | ---- | M] () -- C:\Users\Public\Desktop\IBM Standard Software Installer.url [2013.06.04 12:40:39 | 000,001,151 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.06.03 15:48:42 | 000,316,215 | ---- | M] () -- C:\Users\IBM_ADMIN\Documents\ANGEBOT 13000238.pdf [2013.05.28 15:22:52 | 000,373,888 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT [2013.05.28 13:43:50 | 000,002,116 | ---- | M] () -- C:\Users\Public\Desktop\IBM Lotus Symphony.lnk [2013.05.28 08:45:11 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerApp.exe [2013.05.28 08:45:11 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerCPLApp.cpl [2013.05.27 17:10:40 | 000,000,160 | ---- | M] () -- C:\Users\IBM_ADMIN\AppData\Roaming\default.rss [2013.05.26 18:01:54 | 038,944,576 | ---- | M] (Atomix Productions) -- C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) -- C:\windows\SysWow64\drivers\AnyDVD.sys [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) -- C:\windows\SysNative\drivers\AnyDVD.sys [2013.05.19 12:54:27 | 000,097,176 | ---- | M] (Elaborate Bytes AG) -- C:\windows\SysWow64\ElbyCDIO.dll [8 C:\Users\IBM_ADMIN\Documents\*.tmp files -> C:\Users\IBM_ADMIN\Documents\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.06.04 21:19:38 | 000,632,031 | ---- | C] () -- C:\Users\IBM_ADMIN\Desktop\adwcleaner.exe [2013.06.04 19:33:19 | 000,377,856 | ---- | C] () -- C:\Users\IBM_ADMIN\Desktop\gmer_2.1.19163.exe [2013.06.04 18:58:15 | 000,000,000 | ---- | C] () -- C:\Users\IBM_ADMIN\defogger_reenable [2013.06.04 18:56:34 | 000,050,477 | ---- | C] () -- C:\Users\IBM_ADMIN\Desktop\Defogger.exe [2013.06.04 16:03:55 | 000,001,151 | ---- | C] () -- C:\Users\IBM_ADMIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2013.06.04 12:40:39 | 000,001,163 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2013.06.04 12:40:39 | 000,001,151 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.06.03 15:48:41 | 000,316,215 | ---- | C] () -- C:\Users\IBM_ADMIN\Documents\ANGEBOT 13000238.pdf [2013.05.31 15:08:46 | 000,002,601 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ProxyCap.lnk [2013.05.28 08:45:11 | 000,000,830 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2013.05.01 17:08:02 | 000,331,776 | ---- | C] ( ) -- C:\windows\SysWow64\sbcrreag.dll [2012.12.27 13:35:03 | 000,000,000 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\downloads.m3u [2012.12.04 22:39:57 | 000,413,696 | ---- | C] ( ) -- C:\windows\SysWow64\lxddinpa.dll [2012.12.04 22:39:57 | 000,397,312 | ---- | C] ( ) -- C:\windows\SysWow64\lxddiesc.dll [2012.12.04 22:39:57 | 000,385,024 | ---- | C] () -- C:\windows\SysWow64\lxddcomx.dll [2012.12.04 22:39:57 | 000,286,720 | ---- | C] () -- C:\windows\SysWow64\LXDDinst.dll [2012.12.04 22:39:56 | 001,232,896 | ---- | C] ( ) -- C:\windows\SysWow64\lxddserv.dll [2012.12.04 22:39:56 | 000,999,424 | ---- | C] ( ) -- C:\windows\SysWow64\lxddusb1.dll [2012.12.04 22:39:56 | 000,643,072 | ---- | C] ( ) -- C:\windows\SysWow64\lxddpmui.dll [2012.12.04 22:39:56 | 000,163,840 | ---- | C] ( ) -- C:\windows\SysWow64\lxddprox.dll [2012.12.04 22:39:55 | 000,700,416 | ---- | C] ( ) -- C:\windows\SysWow64\lxddhbn3.dll [2012.12.04 22:39:55 | 000,684,032 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcomc.dll [2012.12.04 22:39:55 | 000,585,728 | ---- | C] ( ) -- C:\windows\SysWow64\lxddlmpm.dll [2012.12.04 22:39:55 | 000,537,520 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcoms.exe [2012.12.04 22:39:55 | 000,425,984 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcomm.dll [2012.12.04 22:39:55 | 000,394,160 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcfg.exe [2012.12.04 22:39:55 | 000,385,968 | ---- | C] ( ) -- C:\windows\SysWow64\lxddih.exe [2012.12.04 22:39:55 | 000,181,168 | ---- | C] ( ) -- C:\windows\SysWow64\lxddppls.exe [2012.12.04 22:39:55 | 000,094,208 | ---- | C] ( ) -- C:\windows\SysWow64\lxddpplc.dll [2012.11.20 15:57:53 | 000,059,487 | ---- | C] () -- C:\Users\IBM_ADMIN\install.xml [2012.10.17 18:37:16 | 000,000,600 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\PUTTY.RND [2012.10.09 15:35:25 | 000,000,600 | ---- | C] () -- C:\Users\IBM_ADMIN\PUTTY.RND [2012.07.21 16:07:34 | 000,000,280 | ---- | C] () -- C:\windows\SysWow64\PGPsdk.dll.sig [2012.06.01 13:36:53 | 000,001,057 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\vso_ts_preview.xml [2012.04.05 10:20:35 | 000,007,600 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\Resmon.ResmonCfg [2012.03.20 16:11:35 | 000,000,632 | RHS- | C] () -- C:\Users\IBM_ADMIN\ntuser.pol [2012.03.18 21:24:10 | 000,000,460 | ---- | C] () -- C:\windows\win_bak.ini [2012.03.01 14:22:44 | 000,000,160 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\default.rss [2012.02.21 14:50:01 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib [2012.02.20 17:06:15 | 000,005,120 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.02.20 12:08:51 | 000,122,880 | ---- | C] () -- C:\windows\wrtService.exe [2012.02.20 12:08:51 | 000,000,156 | ---- | C] () -- C:\windows\SysWow64\wrtservice.ini [2012.02.18 20:15:49 | 000,274,432 | ---- | C] () -- C:\windows\SysWow64\LXCTinst.dll [2012.02.18 20:15:48 | 000,413,696 | ---- | C] ( ) -- C:\windows\SysWow64\lxctinpa.dll [2012.02.18 20:15:48 | 000,397,312 | ---- | C] ( ) -- C:\windows\SysWow64\lxctiesc.dll [2012.02.18 20:15:46 | 000,643,072 | ---- | C] ( ) -- C:\windows\SysWow64\lxctpmui.dll [2012.02.18 20:15:44 | 000,991,232 | ---- | C] ( ) -- C:\windows\SysWow64\lxctusb1.dll [2012.02.18 20:15:43 | 001,224,704 | ---- | C] ( ) -- C:\windows\SysWow64\lxctserv.dll [2012.02.18 20:15:42 | 000,163,840 | ---- | C] ( ) -- C:\windows\SysWow64\lxctprox.dll [2012.02.18 20:15:41 | 000,585,728 | ---- | C] ( ) -- C:\windows\SysWow64\lxctlmpm.dll [2012.02.18 20:15:41 | 000,181,168 | ---- | C] ( ) -- C:\windows\SysWow64\lxctppls.exe [2012.02.18 20:15:41 | 000,094,208 | ---- | C] ( ) -- C:\windows\SysWow64\lxctpplc.dll [2012.02.18 20:15:40 | 000,696,320 | ---- | C] ( ) -- C:\windows\SysWow64\lxcthbn3.dll [2012.02.18 20:15:40 | 000,385,968 | ---- | C] ( ) -- C:\windows\SysWow64\lxctih.exe [2012.02.18 20:15:39 | 000,537,520 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcoms.exe [2012.02.18 20:15:39 | 000,421,888 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcomm.dll [2012.02.18 20:15:38 | 000,684,032 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcomc.dll [2012.02.18 20:15:37 | 000,381,872 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcfg.exe [2012.02.18 14:08:24 | 000,004,767 | ---- | C] () -- C:\windows\Irremote.ini [2012.02.18 10:27:46 | 000,204,800 | ---- | C] () -- C:\windows\SysWow64\IVIresizeW7.dll [2012.02.18 10:27:46 | 000,200,704 | ---- | C] () -- C:\windows\SysWow64\IVIresizeA6.dll [2012.02.18 10:27:46 | 000,192,512 | ---- | C] () -- C:\windows\SysWow64\IVIresizeP6.dll [2012.02.18 10:27:46 | 000,192,512 | ---- | C] () -- C:\windows\SysWow64\IVIresizeM6.dll [2012.02.18 10:27:46 | 000,188,416 | ---- | C] () -- C:\windows\SysWow64\IVIresizePX.dll [2012.02.18 10:27:46 | 000,020,480 | ---- | C] () -- C:\windows\SysWow64\IVIresize.dll [2012.02.18 10:25:57 | 000,831,600 | ---- | C] () -- C:\windows\SysWow64\Ctaa1.dat [2012.02.18 10:25:52 | 000,122,880 | ---- | C] () -- C:\windows\SysWow64\cddvdint.dll [2012.02.15 17:47:03 | 000,000,376 | ---- | C] () -- C:\windows\ODBC.INI [2012.02.15 16:21:38 | 000,216,000 | ---- | C] () -- C:\windows\SysWow64\igfcg600m.bin [2012.02.15 16:21:37 | 000,056,832 | ---- | C] () -- C:\windows\SysWow64\igdde32.dll [2012.02.15 16:21:35 | 013,903,360 | ---- | C] () -- C:\windows\SysWow64\ig4icd32.dll [2012.02.15 16:20:56 | 000,777,778 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI [2011.12.09 22:41:04 | 000,000,033 | ---- | C] () -- C:\windows\Uninst.ini [2011.12.09 22:35:14 | 000,039,424 | ---- | C] () -- C:\windows\SysWow64\pdresrc.dll [2011.12.09 22:35:07 | 000,786,432 | ---- | C] () -- C:\windows\SysWow64\pdclntif.dll [2011.12.09 22:35:07 | 000,270,336 | ---- | C] () -- C:\windows\SysWow64\pdprDlg.dll [2011.12.09 22:35:07 | 000,208,896 | ---- | C] () -- C:\windows\SysWow64\selpms.dll [2011.12.09 22:35:07 | 000,106,496 | ---- | C] () -- C:\windows\SysWow64\IBMMenu.dll [2011.12.09 22:35:07 | 000,086,016 | ---- | C] () -- C:\windows\SysWow64\selpmcui.dll [2011.12.09 14:24:23 | 000,066,856 | ---- | C] () -- C:\windows\SysWow64\SynTPEnhPS.dll [2011.12.09 14:23:48 | 000,963,116 | ---- | C] () -- C:\windows\SysWow64\igkrng600.bin [2011.12.09 14:23:46 | 000,145,804 | ---- | C] () -- C:\windows\SysWow64\igcompkrng600.bin [2011.04.18 16:39:56 | 000,226,364 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4 [2010.07.03 01:50:13 | 000,000,566 | RHS- | C] () -- C:\ProgramData\ntuser.pol ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== Alternate Data Streams ========== @Alternate Data Stream - 76 bytes -> C:\Users\IBM_ADMIN\Documents\Liste 2.doc:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\IBM_ADMIN\Documents\checkliste travel.xls:Roxio EMC Stream < End of report > Hallo, siehe bitte meine letzte Antwort mit den logs. Bitte weiterhin um support. Nach den bisherigen Aktionen stürzt FFox erneut wieder ab nach Neustart heute morgen. Bitte auch um Info ob und wann ich Defogger wieder re-enablen soll. Danke Geändert von schrauber (05.06.2013 um 14:52 Uhr) |
|
05.06.2013, 08:04
| #4 |
| /// the machine /// TB-Ausbilder | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Hi, Defogger erst ganz am Schluss wieder aktivieren. Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers Systemscan mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32bit oder FRST 64bit (Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.06.2013, 08:08
| #5 |
| | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? |
|
05.06.2013, 08:16
| #6 |
| | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? bekomme beim Start von rootkit folg. Meldung im Anhang, was tun ? |
|
05.06.2013, 08:22
| #7 |
| /// the machine /// TB-Ausbilder | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Klick Yes 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.06.2013, 08:37
| #8 |
| | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Hallo, hier bitte alles wie gefordert, Rootkit kam mit folg. Meldungen: "Scan finished, no malware found!" "The system volume seems inaccessable or encrypted. Scan can not continue" (habe PGP Encription laufen ?) Bitte um rasche Hilfe. Danke !!! P.S. habe noch meinen Namen in den logs von 21:56 gestern abend gefunden, wie kann ich das editieren? ******************** Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.06.0.1003
www.malwarebytes.org
Database version: v2013.06.05.02
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
xxxxxx :: IBM-IF34NF70CTV [administrator]
05.06.2013 09:19:33
mbar-log-2013-06-05 (09-19-33).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: Deep Anti-Rootkit Scan | PUP
Objects scanned: 0
Time elapsed: 10 second(s) [aborted]
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-06-2013 Ran by xxxxxx at 2013-06-05 09:24:42 Run: Running from C:\Users\IBM_ADMIN\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= "Nero SoundTrax Help (Version: 4.4.32.0) 7-Zip 9.20 ABBYY FineReader 6.0 Sprint (Version: 6.00.1784.41616) ACDSee 14 (Version: 14.2.156) ACDSee Photo Manager 12 (Version: 12.0.344) Adobe AIR (Version: 3.3.0.3650) Adobe Flash Player 11 ActiveX (Version: 11.7.700.202) Adobe Flash Player 11 Plugin (Version: 11.7.700.202) Adobe Reader X (10.1.7) (Version: 10.1.7) Advertising Center (Version: 0.0.0.2) Amazon Kindle AnyDVD (Version: 7.2.0.0) Apple Application Support (Version: 2.3) Apple Software Update (Version: 2.1.3.127) AT&T Network Client – IBM (Version: 8.2.0.3003) BlackBerry App World Browser Plugin (Version: 3.1.4.38) BlackBerry Desktop Software 6.1 (Version: 6.1.0.35) calibre (Version: 0.9.17) CCleaner (Version: 3.16) Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000) Conexant 20672 SmartAudio HD (Version: 8.32.23.2) ConvertXtoDVD 4.1.19.365 (Version: 4.1.19.365) Creative DVD Audio Plugin for Audigy Series CVE-2012-4792 DolbyFiles (Version: 2.0) DVD Shrink 3.2 FaxRedist (Version: 1.0.0) Free M4a to MP3 Converter 7.0 Free Studio version 5.9.0.1212 (Version: 5.9.0.1212) GMX SMS-Manager (Version: 2.6.3) Google Desktop (Version: 5.9.0906.04286) IBM 32-bit Runtime Environment for Java v6 (Version: 6) IBM 64-bit Runtime Environment for Java v6 (Version: 6) IBM Ayúdame Utility (Version: 1.5.3.0046) IBM Gateway Migration Plugin 1.0.0 (Version: 1.0.0.201108081212) IBM Lotus Sametime Advanced Embedded 8.5.1 (Version: 8.5.1.20110610-1701) IBM Lotus Sametime Connect 8.5.1 (Version: 8.51.10219) IBM Lotus Symphony (Version: 3.01.12011) IBM My Help (Version: 1.7.8) IBM SSH Tunnel IBM Standard Asset Manager IBM Standard Software Installer IBM Tivoli Remote Control Ayúdame Premium Edition - Target (Version: 8.2.0.0104) IBM Tivoli Storage Manager Client (Version: 05.05.0212) ImagXpress (Version: 7.0.74.0) InfoPrint Select (Version: 4.3.0) Intel PROSet Wireless Intel(R) Control Center (Version: 1.2.1.1007) Intel(R) Network Connections Drivers (Version: 16.4) Intel(R) Processor Graphics (Version: 8.15.10.2538) Intel(R) PROSet/Wireless WiFi-Software (Version: 14.2.0000) InterVideo WinDVD 7 (Version: 7.0-B27.49) Java Auto Updater (Version: 2.0.7.1) Java(TM) 6 Update 31 (64-bit) (Version: 6.0.310) Java(TM) 6 Update 31 (Version: 6.0.310) Jawbone Updater (Version: 0.1) JDownloader 0.9 (Version: 0.9) Lenovo Auto Scroll Utility (Version: 1.00) Lenovo Patch Utility (Version: 1.00.0000) Lenovo Patch Utility 64 bit (Version: 1.20.0001) Lenovo Power Management Driver (Version: 1.66.00.22) Lenovo System Interface Driver (Version: 1.05) Lexmark 2500 Series Lexmark 5400 Series LiveUpdate 3.3 (Symantec Corporation) (Version: 3.3.0.99) Lotus Notes 8.5.1 (Version: 8.51.9271) Lotus Notes 8.5.3 (Version: 8.53.11258) LotusLive Meetings for IBM LotusLive Meetings for IBM (Version: 8.2.1) Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300) Menu Templates - Pack 1 (Version: 9.4.6.0) Menu Templates - Pack 2 (Version: 9.4.6.0) Menu Templates - Pack 3 (Version: 9.4.6.0) Menu Templates - Starter Kit (Version: 9.4.6.0) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft Office 2003 Proofing Tools (Version: 11.0.8173.0) Microsoft Office Excel Viewer 2003 (Version: 11.0.8173.0) Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6612.1000) Microsoft Office Standard Edition 2003 (Version: 11.0.8173.0) Microsoft Office Word Viewer 2003 (Version: 11.0.8173.0) Microsoft Silverlight (Version: 5.1.20125.0) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) MIView Movie Templates - Pack 1 (Version: 9.4.6.0) Movie Templates - Starter Kit (Version: 9.4.6.0) Mozilla Firefox 17.0.6 (x86 en-US) (Version: 17.0.6) Mozilla Maintenance Service (Version: 17.0.6) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) Nero 9 Nero Burning ROM Help (Version: 9.4.17.100) Nero BurnRights (Version: 3.4.11.100) Nero BurnRights Help (Version: 3.4.4.100) Nero ControlCenter (Version: 9.0.0.1) Nero CoverDesigner (Version: 4.4.9.100) Nero CoverDesigner Help (Version: 4.4.9.100) Nero Disc Copy Gadget (Version: 2.4.22.0) Nero Disc Copy Gadget Help (Version: 2.4.22.0) Nero DiscSpeed (Version: 5.4.12.100) Nero DiscSpeed Help (Version: 5.4.4.100) Nero DriveSpeed (Version: 4.4.11.100) Nero DriveSpeed Help (Version: 4.4.4.100) Nero Express Help (Version: 9.4.17.100) Nero InfoTool (Version: 6.4.11.100) Nero InfoTool Help (Version: 6.4.4.100) Nero Installer (Version: 4.4.9.0) Nero Live (Version: 1.4.48.0) Nero Live Help (Version: 1.4.48.0) Nero PhotoSnap (Version: 1.53.2.0) Nero PhotoSnap Help (Version: 1.53.2.0) Nero Recode (Version: 4.4.31.0) Nero Recode Help (Version: 4.4.31.0) Nero Rescue Agent (Version: 2.4.12.100) Nero RescueAgent Help (Version: 2.4.4.100) Nero ShowTime (Version: 5.4.0.100) Nero ShowTime (Version: 5.4.14.100) Nero StartSmart (Version: 9.4.12.100) Nero StartSmart Help (Version: 9.4.12.100) Nero Vision (Version: 6.4.10.205) Nero Vision Help (Version: 6.4.8.100) Nero WaveEditor (Version: 5.4.32.0) NeroBurningROM (Version: 9.4.17.100) NeroExpress (Version: 9.4.17.100) NeroLiveGadget (Version: 1.2.16.100) NeroLiveGadget Help (Version: 1.2.16.100) neroxml (Version: 1.0.0) On Screen Display (Version: 6.42.00) OpenSSH_3.7.1p2 Paint Shop Pro 7 (Version: 7.0.0.0000) PDFCreator (Version: 1.2.3) PGP Desktop (Version: 10.2.1.4869) Phase 5 HTML-Editor (Version: 5.6.2.3) ProxyCap (Version: 5.2.50) QuickTime (Version: 7.73.80.64) RICOH_Media_Driver_v2.14.18.01 (Version: 2.14.18.01) SoundTrax (Version: 4.4.32.0) SpeedFan (remove only) Symantec Endpoint Protection (Version: 11.0.6200.754) Synaptics Pointing Device Driver (Version: 15.2.19.0) System Update (Version: 4.01.0015) ThinkPad Bluetooth with Enhanced Data Rate Software (Version: 6.4.0.2900) ThinkPad Energie-Manager (Version: 3.65) ThinkPad FullScreen Magnifier (Version: 2.30) ThinkPad Modem Adapter (Version: 7.80.5.0) ThinkPad UltraNav Utility (Version: 2.13.0) ThinkVantage Access Connections (Version: 5.83) ThinkVantage Active Protection System (Version: 1.75) ThinkVantage Communications Utility (Version: 2.08) Tivoli Endpoint Manager Client (Version: 8.2.1093.0) tools-linux (Version: 8.8.1.528992) tools-windows (Version: 8.8.1.528992) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1) VirtualCloneDrive VmciSockets (Version: 9.1.54.1) VMware Player (Version: 4.0.1.27038) Vodafone Mobile Broadband (Version: 10.2.103.31248) Vuze (Version: 4.7) Winamp (Version: 5.623 ) Winamp Erkennungs-Plug-in (Version: 1.0.0.1) Windows Media Player Firefox Plugin (Version: 1.0.0.8) WinRAR 4.10 (64-Bit) (Version: 4.10.0) WinZip 15.0 (Version: 15.0.9411) Workstation Security Tool 2.5 Xilisoft MKV Converter (Version: 7.5.0.20120822) ==================== Restore Points ========================= 03-06-2013 10:23:02 Scheduled Checkpoint ==================== Faulty Device Manager Devices ============= Name: AGN Virtual Network Adapter Description: AGN Virtual Network Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: AT&T Service: avpnnic Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== System errors: ============= Error: (06/05/2013 08:17:18 AM) (Source: Service Control Manager) (User: ) Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Spooler service. Error: (06/05/2013 08:16:29 AM) (Source: Service Control Manager) (User: ) Description: The PMEM service failed to start due to the following error: %%1275 Error: (06/05/2013 08:16:29 AM) (Source: Application Popup) (User: ) Description: \??\C:\Windows\SysWow64\drivers\PMEMNT.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. Error: (06/05/2013 08:16:26 AM) (Source: Service Control Manager) (User: ) Description: The lxddCATSCustConnectService service failed to start due to the following error: %%1053 Error: (06/05/2013 08:16:26 AM) (Source: Service Control Manager) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the lxddCATSCustConnectService service to connect. Error: (06/05/2013 00:44:39 AM) (Source: DCOM) (User: ) Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (06/04/2013 11:45:01 PM) (Source: DCOM) (User: ) Description: {995C996E-D918-4A8C-A302-45719A6F4EA7} Microsoft Office Sessions: ========================= ==================== Memory info =========================== Percentage of memory in use: 71% Total physical RAM: 8075.23 MB Available physical RAM: 2276.26 MB Total Pagefile: 16148.65 MB Available Pagefile: 10086.23 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:298.09 GB) (Free:67.44 GB) NTFS (Disk=0 Partition=1) ==>[Drive with boot components (obtained from BCD)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 298 GB) (Disk ID: 7A7FF5FC) Partition 1: (Active) - (Size=298 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-06-2013
Ran by xxxxxx (administrator) on 05-06-2013 09:24:10
Running from C:\Users\IBM_ADMIN\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Lenovo.) C:\windows\system32\ibmpmsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe
(Symantec Corporation) C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SmcGui.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(IBM Corp.) C:\Program Files (x86)\C4ebreg\c4ebreg.exe
(IBM Corp.) c:\sdwork\issimsvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
(Lenovo Group Limited) C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
(IBM Corp) c:\notes\SUService.exe
(IBM) c:\notes\nsd.exe
( ) C:\windows\system32\lxctcoms.exe
( ) C:\windows\system32\lxddcoms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(IBM Corp) c:\notes\ntmulti.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(AT&T) C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe
(AT&T) C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe
(AT&T) C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe
(Proxy Labs) C:\Program Files\Proxy Labs\ProxyCap\pcapsvc.exe
(Symantec Corporation) C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe
(Microsoft Corporation) C:\windows\system32\UI0Detect.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe
(VMware, Inc.) C:\windows\SysWOW64\vmnat.exe
() C:\windows\wrtService.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
(VMware, Inc.) C:\windows\SysWOW64\vmnetdhcp.exe
(Intel Corporation) C:\windows\system32\igfxext.exe
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
() C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe
(Lexmark International Inc.) C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe
(Proxy Labs) C:\Program Files\Proxy Labs\ProxyCap\pcapui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Symantec Corporation) C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe
(Google) C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(IBM) C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\symphony.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Lenovo Group Limited) C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
(ACD Systems) C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe
(Symantec Corporation) C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(IBM Corp.) C:\Program Files (x86)\C4ebreg\isamtray.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe
(Symantec Corporation) C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPcbt64.exe
(IBM Corp.) C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
(IBM Corp.) C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe
(IBM) C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.brand.win32_3.0.1.20120110-2000\program\soffice.bin
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\System Update\SUService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE
(IBM Corp) C:\notes\NLNOTES.EXE
(IBM) C:\notes\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\notes2.exe
(IBM Corporation) C:\Program Files\Tivoli\TSM\baclient\dsmc.exe
(IBM Corp) C:\notes\ntaskldr.EXE
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmplayer.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-unity-helper.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\x64\vmware-vmx.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vprintproxy.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\windows\splwow64.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_7_700_202_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\windows\system32\prevhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\prevhost.exe
(Jasc Software, Inc.) C:\Program Files (x86)\Jasc Software Inc\Paint Shop Pro 7\Psp.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [TpShocks] TpShocks.exe [380776 2011-03-29] (Lenovo.)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2731304 2011-03-25] (Synaptics Incorporated)
HKLM\...\Run: [AcWin7Hlpr] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [31592 2011-04-14] (Lenovo)
HKLM\...\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [42344 2011-07-22] (Lenovo Group Limited)
HKLM\...\Run: [lxctmon.exe] "C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe" [291760 2006-11-22] ()
HKLM\...\Run: [EzPrint] "C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe" [82864 2006-11-22] (Lexmark International Inc.)
HKLM\...\Run: [LXCTCATS] rundll32 C:\windows\system32\spool\DRIVERS\x64\3\LXCTtime.dll,RunDLLEntry [31744 2006-11-21] (Lexmark International Inc.)
HKLM\...\Run: [ProxyCap] C:\PROGRA~1\PROXYL~1\ProxyCap\pcapui.exe [2597888 2013-05-01] (Proxy Labs)
HKLM\...\Run: [lxddmon.exe] "C:\Program Files (x86)\Lexmark 2500 Series\lxddmon.exe" [291496 2009-04-27] ()
HKLM\...\Run: [lxddamon] "C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe" [25256 2009-04-27] ()
HKCU\...\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [NetSP - restore settings on power failure] "C:\Program Files (x86)\AT&T Network Client\NetSP.exe" -show [53600 2010-09-09] (AT&T)
HKCU\...\Run: [SymphonyPreLoad] "C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.standard.launcher.win32.x86_3.0.1.20120110-2000\IBM Lotus Symphony" -nogui -nosplash [x]
HKLM-x32\...\Run: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe" [115560 2011-03-24] (Symantec Corporation)
HKLM-x32\...\Run: [ALTOOLS] AccessL.exe [x]
HKLM-x32\...\Run: [ACWLIcon] C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe [193896 2011-04-14] (Lenovo)
HKLM-x32\...\Run: [ACTray] C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe [431464 2011-04-14] (Lenovo)
HKLM-x32\...\Run: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor [1631808 2011-12-01] (Lenovo Group Limited)
HKLM-x32\...\Run: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup [30192 2012-02-17] (Google)
HKLM-x32\...\Run: [Lexmark 5400 Series] "C:\Program Files (x86)\Lexmark 5400 Series\fm3032.exe" /s [304048 2006-11-22] ()
HKLM-x32\...\Run: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe /silent [408576 2011-04-19] (Vodafone)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [79192 2011-02-18] (Research In Motion Limited)
HKLM-x32\...\Run: [lxddmon.exe] "C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddmon.exe" [291496 2009-04-27] ()
HKLM-x32\...\Run: [lxddamon] "C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddamon.exe" [25256 2009-04-27] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [ACSW14DE] "C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe" /pid ACSW14DE [1231472 2011-11-17] (ACD Systems)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [stgclean] c:\sdwork\w32maing.exe /cleanup [292352 2013-01-15] (IBM Corp.)
HKLM-x32\...\Run: [C4EBReg] "C:\Program Files (x86)\C4ebreg\c4ebreg.exe" /q [511288 2012-11-07] (IBM Corp.)
HKLM-x32\...\Run: [Isamtray] "C:\Program Files (x86)\C4ebreg\isamtray.exe" [326968 2012-11-07] (IBM Corp.)
HKU\Standard User\...\Policies\system: [LogonHoursAction] 2
HKU\Standard User\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Lsa: [Notification Packages] scecli ACGina PGPpwflt
Startup: C:\ProgramData\Start Menu\Programs\Startup\AT&T Global Network Client Monitor.lnk
ShortcutTarget: AT&T Global Network Client Monitor.lnk -> C:\windows\Installer\{007AAB7C-E893-48BD-9DA2-7F417CA16322}\NetGM1_89563E53ECF44E868145468A128BDC83.exe (Acresso Software Inc.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\PGP Tray.lnk
ShortcutTarget: PGP Tray.lnk -> C:\windows\Installer\{806D3984-9484-470A-BC63-3B7F65488B58}\Icon6560581611.exe ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\TSM SCHEDULE.BAT.lnk
ShortcutTarget: TSM SCHEDULE.BAT.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\IBM\Java60\jre\bin\ssv.dll (IBM)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\IBM\Java60\jre\bin\jp2ssv.dll (IBM)
PDF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
PDF: HKLM-x32 {1ACECAFE-0016-0000-0000-ABCDEFFEDCBA} hxxp://
PDF: HKLM-x32 {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://
PDF: HKLM-x32 {8B8A0588-356B-431E-A4C3-A56553266DAA} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Smartscript.cab
PDF: HKLM-x32 {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Desktop_Integration.cab
PDF: HKLM-x32 {A6F9E1F5-780D-42F6-9644-3FC630A7AB39} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_HI_Client.cab
PDF: HKLM-x32 {AD4EA0DC-8CC7-4F7B-B730-267823DCE9B7} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_OutBound_mail.cab
PDF: HKLM-x32 {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://
PDF: HKLM-x32 {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
Handler: msdaipp - No CLSID Value -
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\windows\syswow64\urlmon.dll (Microsoft Corporation)
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler-x32: msdaipp - No CLSID Value -
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Winsock: Catalog5 08 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9 01 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9 02 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9 03 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9 04 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9 15 %SystemRoot%\system32\vsocklib.dll [63088] (VMware, Inc.)
Winsock: Catalog9 16 %SystemRoot%\system32\vsocklib.dll [63088] (VMware, Inc.)
Winsock: Catalog9 18 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog5-x64 08 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9-x64 01 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9-x64 02 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9-x64 03 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9-x64 04 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9-x64 15 %SystemRoot%\system32\vsocklib.dll [67184] (VMware, Inc.)
Winsock: Catalog9-x64 16 %SystemRoot%\system32\vsocklib.dll [67184] (VMware, Inc.)
Winsock: Catalog9-x64 18 pcapwsp.dll File Not found (Proxy Labs)
Tcpip\..\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: [NameServer]127.0.0.1,139.7.30.125,139.7.30.126
Tcpip\..\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: [NameServer]9.64.163.21,9.64.162.21
FireFox:
========
FF ProfilePath: C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @IBM.com/Java60 - C:\Program Files\IBM\Java60\jre\bin\new_plugin\npjp2.dll (IBM)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @IBM.com/Java,version=1.6.0 - C:\Program Files (x86)\IBM\Java60\jre\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @IBM.com/JavaPlugin - C:\Program Files (x86)\IBM\Java60\jre\bin\plugin2\npjp2.dll (IBM)
FF Plugin-x32: @IBM.com/WDPlugin,version=1 - C:\Program Files (x86)\Mozilla Firefox\plugins ()
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @rim.com/npappworld - C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll ()
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\langpack-en-US@firefox.mozilla.org
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\langpack-fr@firefox.mozilla.org
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\langpack-ja@firefox.mozilla.org
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\langpack-zh-CN@firefox.mozilla.org
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\langpack-zh-TW@firefox.mozilla.org
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
==================== Services (Whitelisted) =================
R2 BESClient; C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe [4678552 2011-12-05] (IBM Corp.)
R2 ccEvtMgr; C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe [108392 2011-03-24] (Symantec Corporation)
R2 ccSetMgr; C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe [108392 2011-03-24] (Symantec Corporation)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [478056 2011-12-01] (Lenovo.)
S3 GoogleDesktopManager-060409-093314; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2012-02-17] (Google)
R2 ISAMSvc; C:\Program Files (x86)\C4ebreg\c4ebreg.exe [511288 2012-11-07] (IBM Corp.)
R2 ISSIMon; c:\sdwork\issimsvc.exe [184528 2013-01-15] (IBM Corp.)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [93032 2010-04-07] (Lenovo Group Limited)
S3 LiveUpdate; C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE [3093880 2010-09-07] (Symantec Corporation)
R2 LNSUSvc; c:\notes\SUService.exe [189832 2011-09-16] (IBM Corp)
R2 Lotus Notes Diagnostics; c:\notes\notes.ini [10965 2013-06-05] ()
R2 lxct_device; C:\windows\system32\lxctcoms.exe [566192 2006-11-22] ( )
R2 lxdd_device; C:\windows\system32\lxddcoms.exe [567216 2007-05-25] ( )
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 Multi-user Cleanup Service; c:\notes\ntmulti.exe [71048 2011-09-16] (IBM Corp)
R2 netcfgsvr; C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe [476000 2010-09-09] (AT&T)
R2 NetClientSvc; C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe [349536 2010-09-09] (AT&T)
R2 NetLogSvc; C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe [79200 2010-09-09] (AT&T)
R2 pcapsvc; C:\Program Files\Proxy Labs\ProxyCap\pcapsvc.exe [2280960 2013-05-01] (Proxy Labs)
R2 PGP RDD Service; C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe [1588544 2012-07-21] (Symantec Corporation)
R2 SmcService; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe [3249768 2011-03-24] (Symantec Corporation)
S4 SNAC; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE [428912 2011-03-24] (Symantec Corporation)
R2 Symantec AntiVirus; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe [1839776 2011-03-24] (Symantec Corporation)
S3 TRCTARGET; C:\Program Files (x86)\IBM\Tivoli\Remote Control\Target\trc_base.exe [745472 2012-02-09] (IBM Corporation)
R2 WRTService; C:\windows\wrtService.exe [122880 2008-09-18] ()
==================== Drivers (Whitelisted) ====================
R1 agnfilt; C:\Windows\System32\DRIVERS\agnfilt.sys [190464 2010-09-09] (AT&T)
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [142424 2013-05-19] (SlySoft, Inc.)
S3 avpnnic; C:\Windows\System32\DRIVERS\avpnnic.sys [14848 2010-06-30] (AT&T)
R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2012-02-20] (Bytemobile, Inc.)
S3 e1kexpress; C:\Windows\System32\DRIVERS\e1k60x64.sys [220672 2009-06-10] (Intel Corporation)
S3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [26664 2010-03-03] (Ericsson AB)
S3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [30248 2010-03-03] (Ericsson AB)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-08-09] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-08-09] (Symantec Corporation)
S3 GT72NDISIPXP; C:\Windows\System32\DRIVERS\Gt51Ip.sys [130048 2011-04-18] (Option N.V.)
S3 GT72UBUS; C:\Windows\System32\DRIVERS\gt72ubus.sys [86528 2011-04-18] (Option N.V.)
S3 GTPTSER; C:\Windows\System32\DRIVERS\gtptser.sys [10496 2011-04-18] (Option N.V.)
S3 huawei_update; C:\Windows\system32\drivers\ew_hwupgrade.sys [22528 2010-05-04] (Huawei Technologies Co., Ltd.)
S3 l36wgps; C:\Windows\system32\drivers\l36wgps64.sys [101416 2010-12-02] (Ericsson AB)
R3 LenovoRd; C:\Windows\System32\Drivers\LenovoRd.sys [118016 2009-05-11] (Lenovo)
R3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [52320 2012-09-27] (hxxp://libusb-win32.sourceforge.net)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 Mbm3CBus; C:\Windows\system32\drivers\Mbm3CBus.sys [411208 2010-10-31] (MCCI Corporation)
S3 Mbm3DevMt; C:\Windows\system32\drivers\Mbm3DevMt.sys [419912 2010-10-31] (MCCI Corporation)
R3 NAVENG; C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20130603.023\ENG64.SYS [126040 2013-05-24] (Symantec Corporation)
R3 NAVEX15; C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20130603.023\EX64.SYS [2098776 2013-05-24] (Symantec Corporation)
R0 Pgpwdefs; C:\Windows\System32\DRIVERS\Pgpwdefs.sys [15848 2012-07-21] (Symantec Corporation)
S2 PMEM; C:\Windows\SysWow64\drivers\PMEMNT.SYS [7012 2002-07-18] (Microsoft Corporation)
R3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [74240 2011-02-16] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 speedfan; C:\Windows\SysWow64\speedfan.sys [14104 2007-02-07] (Windows (R) Server 2003 DDK provider)
R1 SRTSP; C:\Windows\SysWow64\Drivers\SRTSP64.SYS [449072 2011-03-24] (Symantec Corporation)
S3 SRTSPL; C:\Windows\SysWow64\Drivers\SRTSPL64.SYS [482352 2011-03-24] (Symantec Corporation)
R1 SRTSPX; C:\Windows\SysWow64\Drivers\SRTSPX64.SYS [32304 2011-03-24] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [173616 2011-03-28] (Symantec Corporation)
R1 tcpipBM; C:\windows\system32\drivers\tcpipBM.sys [39552 2012-02-20] (Bytemobile, Inc.)
R3 Teefer2; C:\Windows\System32\DRIVERS\teefer2.sys [64048 2011-03-24] (Symantec Corporation)
R1 WPS; C:\Windows\system32\drivers\wpsdrvnt.sys [53808 2011-03-24] (Symantec Corporation)
R3 WpsHelper; C:\Windows\system32\drivers\WpsHelper.sys [233120 2012-09-30] (Symantec Corporation)
R1 ElbyCDIO; System32\Drivers\ElbyCDIO.sys [x]
R1 PGPsdkDriver; System32\Drivers\PGPsdk.sys [x]
R1 TPPWRIF; System32\drivers\Tppwr64v.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-05 09:24 - 2013-06-05 09:24 - 00000000 ____D C:\FRST
2013-06-05 09:22 - 2013-06-05 09:22 - 01916712 ____A (Farbar) C:\Users\IBM_ADMIN\Desktop\FRST64.exe
2013-06-05 09:19 - 2013-06-05 09:19 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-06-05 09:09 - 2013-06-05 09:21 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\mbar
2013-06-05 09:09 - 2013-06-05 09:09 - 13169742 ____A C:\Users\IBM_ADMIN\Desktop\mbar-1.06.0.1003.zip
2013-06-05 08:21 - 2013-06-05 08:21 - 00000000 ____D C:\Users\IBM_ADMIN\AppData\Roaming\smkits
2013-06-04 21:36 - 2013-06-04 21:36 - 00000687 ____A C:\Users\IBM_ADMIN\Desktop\JRT.txt
2013-06-04 21:33 - 2013-06-04 21:33 - 00000000 ____D C:\Windows\ERUNT
2013-06-04 21:33 - 2013-06-04 21:33 - 00000000 ____D C:\JRT
2013-06-04 21:28 - 2013-06-04 21:27 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\IBM_ADMIN\Desktop\JRT.exe
2013-06-04 21:27 - 2013-06-04 21:27 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\IBM_ADMIN\Downloads\JRT.exe
2013-06-04 21:21 - 2013-06-04 21:21 - 00004764 ____A C:\AdwCleaner[S1].txt
2013-06-04 21:19 - 2013-06-04 21:19 - 00632031 ____A C:\Users\IBM_ADMIN\Downloads\adwcleaner.exe
2013-06-04 21:19 - 2013-06-04 21:19 - 00632031 ____A C:\Users\IBM_ADMIN\Desktop\adwcleaner.exe
2013-06-04 20:13 - 2013-06-05 08:16 - 00000224 ____A C:\Windows\setupact.log
2013-06-04 20:13 - 2013-06-04 20:13 - 00002912 ____A C:\Windows\PFRO.log
2013-06-04 20:13 - 2013-06-04 20:13 - 00000000 ____A C:\Windows\setuperr.log
2013-06-04 19:33 - 2013-06-04 19:33 - 00377856 ____A C:\Users\IBM_ADMIN\Desktop\gmer_2.1.19163.exe
2013-06-04 19:18 - 2013-06-04 21:50 - 00221256 ____A C:\Users\IBM_ADMIN\Desktop\OTL.Txt
2013-06-04 18:58 - 2013-06-04 20:24 - 00000488 ____A C:\Users\IBM_ADMIN\Desktop\defogger_disable.log
2013-06-04 18:58 - 2013-06-04 18:58 - 00000000 ____A C:\Users\IBM_ADMIN\defogger_reenable
2013-06-04 18:56 - 2013-06-04 18:56 - 00602112 ____A (OldTimer Tools) C:\Users\IBM_ADMIN\Desktop\OTL.exe
2013-06-04 18:56 - 2013-06-04 18:56 - 00050477 ____A C:\Users\IBM_ADMIN\Desktop\Defogger.exe
2013-06-04 18:35 - 2013-06-04 18:36 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\Old Firefox Data-1
2013-06-04 18:24 - 2013-06-04 18:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-04 16:02 - 2013-06-04 16:02 - 00000000 ____D C:\swd
2013-06-04 15:59 - 2013-06-04 16:03 - 00000000 ____D C:\sdwork
2013-06-04 15:58 - 2013-06-04 15:58 - 01687248 ____A (IBM Corp.) C:\Users\IBM_ADMIN\Downloads\ospw32(1).exe
2013-06-04 15:56 - 2013-06-04 15:56 - 01687248 ____A (IBM Corp.) C:\Users\IBM_ADMIN\Downloads\ospw32.exe
2013-06-04 12:40 - 2013-06-04 20:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-04 12:40 - 2013-06-04 12:40 - 00001151 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-04 09:07 - 2013-06-04 09:08 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\Old Firefox Data
2013-06-03 19:09 - 2013-06-05 08:20 - 00000000 ___AD C:\Users\IBM_ADMIN\Documents\S
2013-06-02 12:42 - 2013-06-02 12:42 - 00414016 ____A C:\ProgramData\SPL1631.tmp
2013-05-28 15:41 - 2013-06-04 14:23 - 00000000 ____D C:\Program Files (x86)\C4ebreg
2013-05-28 14:31 - 2013-03-04 07:49 - 00158016 ____A (IBM) C:\Windows\SysWOW64\javaws.exe
2013-05-28 14:31 - 2013-03-04 07:49 - 00149824 ____A (IBM) C:\Windows\SysWOW64\javaw.exe
2013-05-28 14:31 - 2013-03-04 07:49 - 00084288 ____A (IBM) C:\Windows\SysWOW64\javacplIBM60.cpl
2013-05-28 14:31 - 2013-03-04 07:48 - 00149824 ____A (IBM) C:\Windows\SysWOW64\java.exe
2013-05-28 08:45 - 2013-06-05 09:23 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-05-26 20:20 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-26 20:20 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-26 20:20 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-26 20:19 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-26 20:19 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-26 20:19 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-26 20:18 - 2013-05-06 15:39 - 09060352 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-26 20:18 - 2013-05-06 15:04 - 06033408 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-26 20:18 - 2013-04-10 07:51 - 01492992 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-26 20:18 - 2013-04-10 07:51 - 01188864 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-26 20:18 - 2013-04-10 07:47 - 00735232 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-26 20:18 - 2013-04-10 07:46 - 12294656 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-26 20:18 - 2013-04-10 07:46 - 02458112 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-26 20:18 - 2013-04-10 07:08 - 00981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-26 20:18 - 2013-04-10 07:07 - 01231872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-26 20:18 - 2013-04-10 07:03 - 00627712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-26 20:18 - 2013-04-10 07:02 - 11020800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-26 20:18 - 2013-04-10 07:02 - 02078208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-26 20:18 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-26 20:18 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-26 20:18 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-26 20:18 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-26 20:18 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-05-26 20:18 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-05-26 20:18 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-05-26 20:18 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-05-26 20:17 - 2013-04-10 07:51 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-26 20:17 - 2013-04-10 07:47 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-26 20:17 - 2013-04-10 07:46 - 00247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-26 20:17 - 2013-04-10 07:46 - 00064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-26 20:17 - 2013-04-10 07:07 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-26 20:17 - 2013-04-10 07:03 - 00067584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-26 20:17 - 2013-04-10 07:03 - 00048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-26 20:17 - 2013-04-10 07:02 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-26 18:01 - 2013-05-26 18:01 - 38944576 ____A (Atomix Productions) C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe
2013-05-19 13:04 - 2013-05-19 13:04 - 00142424 ____A (SlySoft, Inc.) C:\Windows\SysWOW64\Drivers\AnyDVD.sys
2013-05-19 13:04 - 2013-05-19 13:04 - 00142424 ____A (SlySoft, Inc.) C:\Windows\System32\Drivers\AnyDVD.sys
2013-05-19 12:54 - 2013-05-19 12:54 - 00097176 ____A (Elaborate Bytes AG) C:\Windows\SysWOW64\ElbyCDIO.dll
2013-05-06 15:00 - 2013-05-06 15:00 - 00414016 ____A C:\ProgramData\SPL10DE.tmp
==================== One Month Modified Files and Folders =======
2013-06-05 09:24 - 2013-06-05 09:24 - 00000000 ____D C:\FRST
2013-06-05 09:23 - 2013-05-28 08:45 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-05 09:22 - 2013-06-05 09:22 - 01916712 ____A (Farbar) C:\Users\IBM_ADMIN\Desktop\FRST64.exe
2013-06-05 09:21 - 2013-06-05 09:09 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\mbar
2013-06-05 09:21 - 2012-02-16 09:57 - 00000000 ____D C:\ProgramData\VMware
2013-06-05 09:19 - 2013-06-05 09:19 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-06-05 09:09 - 2013-06-05 09:09 - 13169742 ____A C:\Users\IBM_ADMIN\Desktop\mbar-1.06.0.1003.zip
2013-06-05 09:03 - 2009-07-14 07:13 - 00783562 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-05 08:54 - 2012-02-22 15:38 - 02917376 ____A C:\Users\IBM_ADMIN\Documents\Liste.xls
2013-06-05 08:30 - 2012-02-16 16:24 - 00000000 ____D C:\Users\IBM_ADMIN\AppData\Roaming\VMware
2013-06-05 08:30 - 2012-02-16 16:24 - 00000000 ____D C:\Users\IBM_ADMIN\AppData\Local\VMware
2013-06-05 08:26 - 2012-02-22 16:35 - 00000000 ____D C:\adsm.sys
2013-06-05 08:24 - 2009-07-14 06:45 - 00016528 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-05 08:24 - 2009-07-14 06:45 - 00016528 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-05 08:21 - 2013-06-05 08:21 - 00000000 ____D C:\Users\IBM_ADMIN\AppData\Roaming\smkits
2013-06-05 08:20 - 2013-06-03 19:09 - 00000000 ___AD C:\Users\IBM_ADMIN\Documents\S
2013-06-05 08:20 - 2012-10-17 17:44 - 01855072 ____A C:\Windows\WindowsUpdate.log
2013-06-05 08:17 - 2012-03-06 15:33 - 00074776 ____A C:\Users\IBM_ADMIN\seditor.launcher.log
2013-06-05 08:16 - 2013-06-04 20:13 - 00000224 ____A C:\Windows\setupact.log
2013-06-05 08:16 - 2012-11-20 15:59 - 00018194 ____A C:\SUService.log
2013-06-05 08:16 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-04 21:50 - 2013-06-04 19:18 - 00221256 ____A C:\Users\IBM_ADMIN\Desktop\OTL.Txt
2013-06-04 21:36 - 2013-06-04 21:36 - 00000687 ____A C:\Users\IBM_ADMIN\Desktop\JRT.txt
2013-06-04 21:33 - 2013-06-04 21:33 - 00000000 ____D C:\Windows\ERUNT
2013-06-04 21:33 - 2013-06-04 21:33 - 00000000 ____D C:\JRT
2013-06-04 21:27 - 2013-06-04 21:28 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\IBM_ADMIN\Desktop\JRT.exe
2013-06-04 21:27 - 2013-06-04 21:27 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\IBM_ADMIN\Downloads\JRT.exe
2013-06-04 21:21 - 2013-06-04 21:21 - 00004764 ____A C:\AdwCleaner[S1].txt
2013-06-04 21:19 - 2013-06-04 21:19 - 00632031 ____A C:\Users\IBM_ADMIN\Downloads\adwcleaner.exe
2013-06-04 21:19 - 2013-06-04 21:19 - 00632031 ____A C:\Users\IBM_ADMIN\Desktop\adwcleaner.exe
2013-06-04 20:24 - 2013-06-04 18:58 - 00000488 ____A C:\Users\IBM_ADMIN\Desktop\defogger_disable.log
2013-06-04 20:13 - 2013-06-04 20:13 - 00002912 ____A C:\Windows\PFRO.log
2013-06-04 20:13 - 2013-06-04 20:13 - 00000000 ____A C:\Windows\setuperr.log
2013-06-04 20:13 - 2013-06-04 12:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-04 19:33 - 2013-06-04 19:33 - 00377856 ____A C:\Users\IBM_ADMIN\Desktop\gmer_2.1.19163.exe
2013-06-04 18:58 - 2013-06-04 18:58 - 00000000 ____A C:\Users\IBM_ADMIN\defogger_reenable
2013-06-04 18:58 - 2010-06-29 06:27 - 00000000 ____D C:\users\IBM_ADMIN
2013-06-04 18:56 - 2013-06-04 18:56 - 00602112 ____A (OldTimer Tools) C:\Users\IBM_ADMIN\Desktop\OTL.exe
2013-06-04 18:56 - 2013-06-04 18:56 - 00050477 ____A C:\Users\IBM_ADMIN\Desktop\Defogger.exe
2013-06-04 18:36 - 2013-06-04 18:35 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\Old Firefox Data-1
2013-06-04 18:24 - 2013-06-04 18:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-04 16:03 - 2013-06-04 15:59 - 00000000 ____D C:\sdwork
2013-06-04 16:02 - 2013-06-04 16:02 - 00000000 ____D C:\swd
2013-06-04 16:01 - 2011-07-18 10:01 - 00000590 ____A C:\Users\Public\Desktop\ISSI EZUpdate.lnk
2013-06-04 16:01 - 2011-07-18 10:01 - 00000112 ____A C:\Users\Public\Desktop\IBM Standard Software Installer.url
2013-06-04 16:01 - 2010-11-12 03:40 - 00000134 ____A C:\Windows\issiunin.bat
2013-06-04 15:58 - 2013-06-04 15:58 - 01687248 ____A (IBM Corp.) C:\Users\IBM_ADMIN\Downloads\ospw32(1).exe
2013-06-04 15:56 - 2013-06-04 15:56 - 01687248 ____A (IBM Corp.) C:\Users\IBM_ADMIN\Downloads\ospw32.exe
2013-06-04 15:44 - 2010-11-12 03:35 - 00000000 ____D C:\sdwork old
2013-06-04 14:23 - 2013-05-28 15:41 - 00000000 ____D C:\Program Files (x86)\C4ebreg
2013-06-04 14:11 - 2010-11-12 03:08 - 00000000 ____D C:\Program Files (x86)\WST
2013-06-04 13:47 - 2011-12-09 20:45 - 00000000 ____D C:\swd old
2013-06-04 12:40 - 2013-06-04 12:40 - 00001151 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-04 09:08 - 2013-06-04 09:07 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\Old Firefox Data
2013-06-02 12:42 - 2013-06-02 12:42 - 00414016 ____A C:\ProgramData\SPL1631.tmp
2013-05-31 19:34 - 2012-02-22 15:38 - 00033792 ____A C:\Users\IBM_ADMIN\Documents\checkliste travel.xls
2013-05-31 16:10 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-05-31 15:42 - 2012-02-22 15:38 - 00044032 ____A C:\Users\IBM_ADMIN\Documents\GT CM Outlook Plan 2013.xls
2013-05-31 15:20 - 2012-02-18 17:27 - 00000000 ____D C:\Users\IBM_ADMIN\AppData\Roaming\Winamp
2013-05-31 01:41 - 2012-12-13 15:16 - 00000000 ____D C:\linuxshared
2013-05-28 15:41 - 2010-07-14 01:12 - 00000000 ____D C:\ProgramData\IGS
2013-05-28 15:22 - 2009-07-14 06:45 - 00373888 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-28 14:31 - 2010-07-01 01:55 - 00098208 ____A C:\Users\IBM_ADMIN\AppData\Local\GDIPFONTCACHEV1.DAT
2013-05-28 14:30 - 2010-07-14 01:55 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-05-28 14:27 - 2010-07-14 01:58 - 00000000 ____D C:\Program Files (x86)\IBM
2013-05-28 13:43 - 2012-11-16 13:33 - 00002116 ____A C:\Users\Public\Desktop\IBM Lotus Symphony.lnk
2013-05-28 08:45 - 2012-04-05 10:28 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-05-28 08:45 - 2011-12-09 22:34 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-27 17:10 - 2012-03-01 14:22 - 00000160 ____A C:\Users\IBM_ADMIN\AppData\Roaming\default.rss
2013-05-27 11:17 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-05-26 20:31 - 2010-06-29 20:41 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-26 20:07 - 2012-02-18 20:26 - 00000000 ____D C:\Program Files\Lx_cats
2013-05-26 18:01 - 2013-05-26 18:01 - 38944576 ____A (Atomix Productions) C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe
2013-05-26 15:03 - 2012-02-20 13:55 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-05-19 13:04 - 2013-05-19 13:04 - 00142424 ____A (SlySoft, Inc.) C:\Windows\SysWOW64\Drivers\AnyDVD.sys
2013-05-19 13:04 - 2013-05-19 13:04 - 00142424 ____A (SlySoft, Inc.) C:\Windows\System32\Drivers\AnyDVD.sys
2013-05-19 12:54 - 2013-05-19 12:54 - 00097176 ____A (Elaborate Bytes AG) C:\Windows\SysWOW64\ElbyCDIO.dll
2013-05-07 22:51 - 2013-02-23 09:48 - 01247839 ____A C:\lxct.log
2013-05-06 15:39 - 2013-05-26 20:18 - 09060352 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-06 15:04 - 2013-05-26 20:18 - 06033408 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-06 15:00 - 2013-05-06 15:00 - 00414016 ____A C:\ProgramData\SPL10DE.tmp
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
Last Boot: 2013-06-03 12:16
==================== End Of Log ============================
|
|
05.06.2013, 10:05
| #9 |
| /// the machine /// TB-Ausbilder | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Wo genau steht der Name? Ist das ein Firmenrechner? Hast du die Proxys und IP's eingetragen? Firefox hast Du nach AdwCleaner schon wieder versucht? Auch im Safe Mode?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.06.2013, 11:04
| #10 |
| | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Name ist Rainer usw., steht in AdwareCleaner header und junkware log oben. Ist Firmenrechner, habe keine Proxys IPs eingetragen. Habe noch Java cleanup gemacht mit support hier und auch im safe mode stürzte der Ffox genau bei aufrufen dieses Link aus der mail wieder ab... pls. help (wenn malware/virus-relevant), danke |
|
05.06.2013, 12:39
| #11 |
| /// the machine /// TB-Ausbilder | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Firmenrechner: dürfen hier nicht behandelt werden, wenn es um eine Firma mit eigenen IT-Leuten oder Abteilung geht. Wenn Das ne kleine oder eigene Firma ist kein Problem. Ich muss es nur wissen, nicht dass ich hier irgendwelche Proxy-Einstellungen kille die (ohne dein Wissen) wichtig sind.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.06.2013, 12:55
| #12 |
| | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Hallo, korrekt. Ist größere Firma mit eig. IT-Abteilung. Gibt sicher Proxy-Einstellungen die relevant sind und nicht gekillt werden dürfen. Habe jetzt auch einen klaren Verdächtigen der auch bei einem Kollegen zum gleichen Problem geführt. ProxyCap für ein tunneling, macht statische IPs die sich wohl mit den dynamischen IPs hier nicht vertragen. Ich teste das gerade und wenn das sich bestätigt, dann melde ich mich zum erfolgreichen zumachen des threats wenn nötig ? Kann ich den defogger wieder anschalten jetzt ? War denn bei den Aktionen mit Dir bislang überhaupt irgendetwas auffälliges dabei ? Kannst Du noch bitte den Namen, siehe letzte Nachricht, deleted, kann das ja von hier nicht ? Danke |
|
05.06.2013, 14:53
| #13 |
| /// the machine /// TB-Ausbilder | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Defogger kann wieder an, war bissl Adware drauf, aber nichts schlimmes. Namen ist editiert .
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.06.2013, 15:36
| #14 |
| | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? danke ! dann können wir das hier schließen erstmal, Test bislang 100% positiv. Lob ist raus, Spende kommt. Gruss R |
|
05.06.2013, 16:28
| #15 |
| /// the machine /// TB-Ausbilder | Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? Alles klar, danke Dann entfernen wir noch unsre tools: Die Reihenfolge ist hier entscheidend.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? |
| antivirus, avp, bho, browser, checkliste, converter, diagnostics, email, error, firefox, firefox abstürze malware ?, flash player, format, geld, google, home, hängt, intranet, logfile, malware, mp3, outbound, plug-in, programm, prozess, pwmtr64v.dll, refresh, registry, remote control, sierra, software, starten, symantec, usb, window 7, windows, wrapper |
Linear-Darstellung
