Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 04.06.2013, 20:02   #1
mailmeback
 
Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Hallo,

ich hoffe Ihr könnte mir helfen. Wenn ja und dauerhaft ohne kompletten systemreset werde ich einen 2-3stelligen Betrag an Euch spenden da (verlorene) Zeit Geld ist. Nach dem ich alles was rund um Firefox möglich ist getan habe, fällt der Verdacht auf Malware. Faktenlage:

- Rechner W7, Firefox stürzt nach wenigen Minuten bis Stunden Betrieb ab
- Crash-Report verfügbar, Situation so seit mehreren Tagen ohne erinnerbaren Anlass
- sämtliche Fehlerbehebungsmassnahmen der Mozillapage wurden abgearbeitet:
- starten in save modus, refresh und ohne add-ons usw.
- kompletter deinstall, re-install und neustart clean ohne Altlasten

Kein Erfolg. FFox stürzt immer wieder ab. Betreibe Vollversion Symantec Endpoint Protection sowie Malwarebytes seit Jahren immer aktuell. Full-scans heute morgen ohne Erfolg.

Habe defogger gemacht. OTL hat aber nur OTL.txt ausgeworfen, keine Extra.txt. Gmer läuft nicht durch und wird unter Fehlermeldung beendet. Ich habe nach Neustart keine Prg. laufen, alles wie in eurer Anleitung und berühre den Rechner nicht. Nach 5-10 Minuten fullscan kommt die Fehlermeldung "Programm wird beendet". Habe es 3x probiert und vorher jegliches ausschaltbares Programm ausgeschaltet.

Die einzige Auffälligkeit für mich als Laie ist: im Task Manager ist der Firefox Prozess der einzige der keine "Description" ganz rechts im Task Manager hat. Dort ist blank, statt wie sonst eben "Firefox". Viell. hängt dies auch damit zusammen, dass im OTL.txt unten bei den Mozilla logs auch "no name found" steht ?

Danke für eine baldige Hilfe. Auch wie ich den GMER und das extra.txt produzieren kann für Euch.

Hier die Anhänge:

************************************
OTL logfile created on: 04.06.2013 19:01:46 - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\IBM_ADMIN\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy

7,89 Gb Total Physical Memory | 2,95 Gb Available Physical Memory | 37,46% Memory free
15,77 Gb Paging File | 12,29 Gb Available in Paging File | 77,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 298,09 Gb Total Space | 69,81 Gb Free Space | 23,42% Space Free | Partition Type: NTFS
Drive G: | 298,06 Gb Total Space | 176,83 Gb Free Space | 59,33% Space Free | Partition Type: NTFS

Computer Name: IBM-IF34NF70CTV | User Name: xxxxxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.06.04 18:56:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe
PRC - [2013.06.04 18:24:53 | 000,917,400 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013.04.04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013.01.15 19:46:09 | 000,184,528 | ---- | M] (IBM Corp.) -- c:\sdwork\issimsvc.exe
PRC - [2012.11.07 18:28:31 | 000,326,968 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\C4ebreg\isamtray.exe
PRC - [2012.11.07 18:27:16 | 000,511,288 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\C4ebreg\c4ebreg.exe
PRC - [2012.07.21 16:05:20 | 001,588,544 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe
PRC - [2012.07.21 16:05:14 | 003,935,944 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe
PRC - [2011.12.05 20:49:22 | 004,678,552 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
PRC - [2011.12.05 20:49:22 | 001,471,896 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe
PRC - [2011.12.01 04:05:00 | 000,064,576 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
PRC - [2011.11.17 02:36:22 | 001,231,472 | ---- | M] (ACD Systems) -- C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe
PRC - [2011.11.14 00:43:12 | 000,180,848 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-unity-helper.exe
PRC - [2011.11.14 00:43:10 | 004,118,128 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmplayer.exe
PRC - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe
PRC - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe
PRC - [2011.11.13 23:36:38 | 000,011,264 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vprintproxy.exe
PRC - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
PRC - [2011.09.16 09:31:34 | 000,189,832 | ---- | M] (IBM Corp) -- c:\notes\SUService.exe
PRC - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe
PRC - [2011.07.22 13:21:34 | 000,060,264 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
PRC - [2011.07.22 13:21:32 | 000,042,344 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
PRC - [2011.07.22 13:21:18 | 000,041,832 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe
PRC - [2011.05.27 02:43:12 | 000,328,040 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2011.05.19 12:00:40 | 002,062,680 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
PRC - [2011.04.19 17:12:22 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2011.04.19 17:12:18 | 000,408,576 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
PRC - [2011.04.14 20:24:26 | 000,410,984 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
PRC - [2011.04.14 20:22:42 | 000,361,832 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
PRC - [2011.04.14 20:22:36 | 000,193,896 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe
PRC - [2011.04.14 20:22:30 | 000,431,464 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe
PRC - [2011.04.14 20:22:28 | 000,263,528 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
PRC - [2011.04.14 20:22:26 | 000,124,264 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
PRC - [2011.04.07 23:41:32 | 000,138,680 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\ZOOM\TpScrex.exe
PRC - [2011.04.04 17:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\micmute.exe
PRC - [2011.03.29 20:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
PRC - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2011.03.24 22:11:32 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe
PRC - [2011.03.24 22:11:30 | 001,839,776 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe
PRC - [2011.03.24 22:11:30 | 000,050,544 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe
PRC - [2011.02.18 12:47:12 | 000,079,192 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2011.02.17 22:49:12 | 000,577,536 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
PRC - [2010.09.09 19:40:38 | 000,079,200 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe
PRC - [2010.09.09 19:40:24 | 000,476,000 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe
PRC - [2010.09.09 19:40:02 | 000,349,536 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe
PRC - [2010.04.07 21:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
PRC - [2010.04.01 21:50:44 | 000,043,960 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
PRC - [2009.06.18 16:19:30 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2009.04.27 14:37:18 | 000,025,256 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe
PRC - [2008.09.18 09:30:54 | 000,122,880 | ---- | M] () -- C:\Windows\wrtService.exe
PRC - [2006.11.22 11:11:24 | 000,082,864 | ---- | M] (Lexmark International Inc.) -- C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe
PRC - [2006.11.22 11:11:22 | 000,291,760 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe


========== Modules (No Company Name) ==========

MOD - [2013.06.04 18:24:53 | 002,401,688 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2013.05.27 08:09:32 | 002,297,856 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\3c2ed368e1f3889997dfb42a5ca77284\System.Core.ni.dll
MOD - [2013.05.27 08:09:18 | 000,181,248 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Common\087705bc24370a204f2c6255fc68ad0e\Vodafone.Common.ni.dll
MOD - [2013.05.27 08:09:17 | 000,673,280 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Data\d509111dd6accedf8942eb2b6b83fec6\Vodafone.Data.ni.dll
MOD - [2013.05.26 20:24:57 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5dabd015d753b028750e4853dde12178\System.Windows.Forms.ni.dll
MOD - [2013.05.26 20:24:49 | 003,347,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll
MOD - [2013.05.26 20:24:45 | 000,687,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\23673bbebe3c0ca7c894e614bb3ffd1a\System.Security.ni.dll
MOD - [2013.05.26 20:24:40 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013.02.18 12:00:50 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Manag#\6c4e587713b061a12ee470864ca4fb97\Vodafone.View.ManagedToolTip.ni.dll
MOD - [2013.02.18 12:00:49 | 000,876,544 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Shared\0e762a83572c331f3475b6c20722f4fb\Vodafone.View.Shared.ni.dll
MOD - [2013.02.18 12:00:45 | 000,606,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Secon#\32cf63de2f013751cd1874dc1fd9debf\Vodafone.View.SecondaryWindows.ni.dll
MOD - [2013.02.18 12:00:43 | 000,031,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\cc6f7fbebb0748b98dfce775d95005c6\Vodafone.DeviceAccess.Factory.ni.dll
MOD - [2013.02.18 12:00:42 | 000,499,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\fd8de9d227b25a729338f4fdca7571b0\Vodafone.DeviceAccess.Internals.ni.dll
MOD - [2013.02.18 12:00:40 | 000,674,304 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\b53a516b601a9dc1c183a48339e7a92e\Vodafone.ConnectionServices.ni.dll
MOD - [2013.02.18 12:00:37 | 000,050,176 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\c3058f2d5d8b4717e85d530f54463e0d\Vodafone.Contracts.Adapter.ni.dll
MOD - [2013.02.18 12:00:32 | 001,304,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\eb027595e692626525390ae831f4934e\Infragistics2.Win.UltraWinEditors.v9.2.ni.dll
MOD - [2013.02.18 12:00:29 | 003,348,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.M#\2a1a484a011c63a38d01cba92f641890\Infragistics2.Win.Misc.v9.2.ni.dll
MOD - [2013.02.18 12:00:22 | 011,053,056 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.v#\9c3e7a0a80452bab80237eafcc576389\Infragistics2.Win.v9.2.ni.dll
MOD - [2013.02.18 12:00:02 | 000,871,424 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Share#\8edb485e7273579bb217330f8ba7fb98\Infragistics2.Shared.v9.2.ni.dll
MOD - [2013.02.18 11:59:59 | 007,137,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\4c43791aeb4aede26a3bd89d86bc89b5\Infragistics2.Win.UltraWinToolbars.v9.2.ni.dll
MOD - [2013.02.18 11:59:46 | 000,037,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\74f8482ed000aed6d9057d4f2d5dc2f3\Vodafone.Contracts.Presenter.ni.dll
MOD - [2013.02.18 11:59:45 | 000,132,608 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\5f8ef1464fd770130f9715f485bf94bc\Vodafone.Contracts.Model.ni.dll
MOD - [2013.02.18 11:59:44 | 000,105,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\acb2ca5e34236615024edcdcc4fa6b2b\Vodafone.Contracts.View.ni.dll
MOD - [2013.02.18 11:59:43 | 000,094,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\9ec5cec32e8e823f78144fcb9a47fb64\Vodafone.Contracts.Common.ni.dll
MOD - [2013.02.18 11:59:39 | 000,342,016 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.CommonDial#\30b0a9cd1f814f94fa0de09349a7e4d7\Vodafone.CommonDialogs.ni.dll
MOD - [2013.02.18 11:59:37 | 000,947,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Applicatio#\6a874bbee313ab4f3ab630a2e6855d58\Vodafone.ApplicationHost.Impl.ni.dll
MOD - [2013.02.18 11:59:34 | 000,326,656 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DataAccess#\d9173324d53199cabf7f663060356804\Vodafone.DataAccessor.ni.dll
MOD - [2013.02.18 11:59:16 | 000,158,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Contr#\0a6abb05d1f030b0aca6c78857f130ae\Vodafone.Base.Contracts.ni.dll
MOD - [2013.02.18 11:59:13 | 001,368,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Platform\7ee6c9cdec2c6eee428213bb5646b97c\Vodafone.Platform.ni.dll
MOD - [2013.02.18 11:59:09 | 000,283,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\MobileBroadband\e6c36364416e40614eac2b777471961d\MobileBroadband.ni.exe
MOD - [2013.02.17 17:50:08 | 000,212,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\7ff638de44686eab4afaa8b3c8a9cfca\System.ServiceProcess.ni.dll
MOD - [2013.01.16 14:13:48 | 001,065,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\d602f7a5bbd392dddbc07c2f5f083a11\System.Management.ni.dll
MOD - [2013.01.16 14:13:43 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d908c91e24616e6b8d38c9da61038b25\Accessibility.ni.dll
MOD - [2013.01.16 14:13:32 | 005,459,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\fa022967bdd1030211f9cadcab797520\System.Xml.ni.dll
MOD - [2013.01.16 14:13:27 | 007,989,760 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.16 14:13:08 | 000,774,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\83265111769de5cd294df17e6d762958\System.Runtime.Remoting.ni.dll
MOD - [2013.01.16 14:13:07 | 000,627,712 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\7e584aeb8aa941f7f9bce2a31ea750f0\System.Transactions.ni.dll
MOD - [2013.01.16 14:13:06 | 006,638,592 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\81f61d2c8af0d34385679aa2465c609a\System.Data.ni.dll
MOD - [2013.01.16 14:12:40 | 012,678,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\09594e500a32cd9a1e4ddf33b45b4e44\PresentationCore.ni.dll
MOD - [2013.01.16 10:25:55 | 000,080,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsProfile#\037db27d8cacfabe7ed7b999e14552c4\Vodafone.SmsProfileManager.ni.dll
MOD - [2013.01.16 10:25:55 | 000,031,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.OutlookCon#\8c256f277b654a2421f817711d72a72f\Vodafone.OutlookConnector.ni.dll
MOD - [2013.01.16 10:25:45 | 000,321,536 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Win32\4fc713e9bd132a9c0e0b177b9eceddf3\Vodafone.Base.Win32.ni.dll
MOD - [2013.01.16 10:25:45 | 000,197,120 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsContact#\2e27dae10259458ed19ab28802d6d435\Vodafone.SmsContactManager.ni.dll
MOD - [2013.01.15 22:16:27 | 000,252,928 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.FNCClient11#\fd734656ee66b5253483a686d6d679d8\Interop.FNCClient11Lib.ni.dll
MOD - [2013.01.15 22:16:26 | 000,219,648 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Conn#\9365c6b816ac5d118accc3e870ec8759\Vodafone.Model.Connection.ni.dll
MOD - [2013.01.15 22:16:26 | 000,033,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.UpdateMana#\ec56e9bcdd353278994778ebfa8f5aab\Vodafone.UpdateManager.ni.dll
MOD - [2013.01.15 22:16:23 | 000,082,432 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Remot#\552e346f1bc27fa324a710072104ab0f\Vodafone.Core.Remoting.ni.dll
MOD - [2013.01.15 22:16:23 | 000,054,784 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.TrafficOpt#\f6bb1fbd008e4be503a15a0633fa694b\Vodafone.TrafficOptimiser.ni.dll
MOD - [2013.01.15 22:16:23 | 000,024,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.CoreI#\06cf2695acff680bd5008e4bd1cb5375\Vodafone.Core.CoreInstanceProvider.ni.dll
MOD - [2013.01.15 22:16:22 | 000,119,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\d65e3892ff3bfd90b6b37f7ef0c8761c\Interop.Shell32.ni.dll
MOD - [2013.01.15 22:16:22 | 000,106,496 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LanWlanMan#\c1a004ae9c01857bccbdaa343e885422\Vodafone.LanWlanManager.ni.dll
MOD - [2013.01.15 22:16:22 | 000,072,704 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Vpn\1f2f44b9c1e6f8d028b5005fc7658972\Vodafone.Vpn.ni.dll
MOD - [2013.01.15 22:16:21 | 000,393,728 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MbbManagem#\64bd72f4e684ee7fd460fe4c65f2bc0d\Vodafone.MbbManagement.ni.dll
MOD - [2013.01.15 22:16:21 | 000,081,408 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.MbnApi\f450d8d019b097372ed1dea56de0e5a2\Interop.MbnApi.ni.dll
MOD - [2013.01.15 22:16:21 | 000,039,936 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\e3be5dd41dd4f191b99353a091afbb2f\Vodafone.DeviceAccess.Interfaces.ni.dll
MOD - [2013.01.15 22:16:20 | 000,733,696 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.WwanWrapper\657dd7faab285319de359b2fa0706558\Vodafone.WwanWrapper.ni.dll
MOD - [2013.01.15 22:16:19 | 000,020,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Inter#\f70562c22e9a0d5d45171b13d6c56b7f\Vodafone.Core.Interfaces.ni.dll
MOD - [2013.01.15 22:16:18 | 000,942,080 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.BusinessLo#\02c5bea3c3542435991367afd45d0ae9\Vodafone.BusinessLogic.ni.dll
MOD - [2013.01.15 22:16:17 | 002,110,976 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Spring.Core\b559dd7a2b0f458d9e89412c4728b824\Spring.Core.ni.dll
MOD - [2013.01.15 22:16:17 | 000,047,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Common.Logging\e1f5430a5664ac36d30136ffe1339bc2\Common.Logging.ni.dll
MOD - [2013.01.15 22:16:15 | 000,042,496 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.InstancePr#\eb9e8b0000726b973085e44c1e8e3ec8\Vodafone.InstanceProvider.Impl.ni.dll
MOD - [2013.01.15 22:15:59 | 000,098,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Contr#\4648622b8786e9df320724f55d507421\Vodafone.Core.Contracts.ni.dll
MOD - [2013.01.15 22:15:59 | 000,026,112 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\e5f971684a0cfdbade27c8a77b94c1dc\Vodafone.DeviceAccess.Contracts.ni.dll
MOD - [2013.01.15 22:15:58 | 000,089,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Inter#\cce3a30a9dc0d6b0d0817ac8c539cb1c\Vodafone.Base.Internals.ni.dll
MOD - [2013.01.15 22:15:58 | 000,017,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Facto#\5ea47d1f504e95a19ea37b2d56bb32bd\Vodafone.Base.Factory.ni.dll
MOD - [2013.01.15 22:15:57 | 000,153,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\014e1457c2135de51d117bb23bde328c\Vodafone.ConnectionManagement.ni.dll
MOD - [2013.01.15 22:15:55 | 000,350,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.ReportingM#\8e36bfb3548a969d0431c4c7f6d273e9\Vodafone.ReportingManager.ni.dll
MOD - [2013.01.15 22:15:53 | 000,055,296 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SettingsMa#\378a6b2759e2c491e34cc6cfef7a46d6\Vodafone.SettingsManager.ni.dll
MOD - [2013.01.15 22:15:52 | 000,074,240 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.NtServiceM#\7bebcfbb3c250b011b8b5e70a3e15cba\Vodafone.NtServiceMessaging.ni.dll
MOD - [2013.01.15 22:15:51 | 002,003,456 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\MobileBroadbandReso#\36c482b2fb56d28a66adf894213b43df\MobileBroadbandResources.ni.dll
MOD - [2013.01.15 22:15:31 | 000,019,456 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MobileBroa#\a898a34cb3613fe42c5a502f01773c2e\Vodafone.MobileBroadband.CallbackHandler.ni.dll
MOD - [2013.01.15 22:15:26 | 000,096,256 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LogEngine\a455bcf66b06fd85fd03f7560979b37f\Vodafone.LogEngine.ni.dll
MOD - [2013.01.15 19:06:15 | 001,597,440 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\229b5280b4e310f5e83657abbf257632\System.Drawing.ni.dll
MOD - [2013.01.15 19:05:50 | 011,493,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2012.12.12 07:32:26 | 005,025,792 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2012.10.05 12:53:24 | 003,198,976 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2012.10.05 12:53:24 | 000,630,784 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2012.08.31 12:59:19 | 004,550,656 | ---- | M] () -- C:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
MOD - [2011.11.14 00:43:22 | 000,329,328 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libcurl.dll
MOD - [2011.11.14 00:43:18 | 000,144,496 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\liblber.dll
MOD - [2011.11.14 00:43:18 | 000,122,992 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libcds.dll
MOD - [2011.11.14 00:43:16 | 001,229,424 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
MOD - [2011.11.14 00:43:06 | 000,317,552 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libldap_r.dll
MOD - [2011.11.14 00:43:00 | 000,069,232 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\zlib1.dll
MOD - [2011.11.14 00:42:44 | 000,644,720 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\glibmm-2.4.dll
MOD - [2011.04.19 17:12:12 | 000,308,736 | ---- | M] () -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\Vodafone.View.Taskbar.dll
MOD - [2011.04.14 19:15:52 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
MOD - [2010.11.05 03:58:14 | 002,048,000 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2010.11.05 03:58:10 | 000,303,104 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2010.11.05 03:58:04 | 000,425,984 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
MOD - [2009.07.14 03:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\SysWOW64\msjetoledb40.dll
MOD - [2009.06.10 23:23:19 | 000,261,632 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2009.06.10 23:22:40 | 000,010,752 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
MOD - [2009.04.27 14:37:18 | 000,025,256 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe
MOD - [2008.05.16 13:35:22 | 000,040,960 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.Monitor.Core.dll
MOD - [2008.05.16 13:35:22 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.Monitor.Common.dll
MOD - [2008.05.16 13:34:18 | 000,057,344 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.MCMDevMon.dll
MOD - [2007.04.30 09:20:26 | 000,011,776 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.MCMDevMon.AutoPlayUtil.dll
MOD - [2007.04.30 09:19:52 | 000,020,480 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.ScanDevMon.dll
MOD - [2007.04.30 09:19:48 | 000,020,480 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.NetworkCardDevMon.dll
MOD - [2006.11.22 11:11:22 | 000,291,760 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe
MOD - [2006.08.08 17:54:18 | 000,278,528 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctscw.dll
MOD - [2006.06.09 04:39:54 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctdrec.dll
MOD - [2006.05.25 18:20:44 | 000,241,664 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\iptk.dll


========== Services (SafeList) ==========

SRV:64bit: - [2013.05.01 17:02:26 | 002,280,960 | ---- | M] (Proxy Labs) [Auto | Running] -- C:\Program Files\Proxy Labs\ProxyCap\pcapsvc.exe -- (pcapsvc)
SRV:64bit: - [2012.12.11 07:22:08 | 000,060,272 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC)
SRV:64bit: - [2011.10.17 16:48:24 | 000,970,016 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2011.08.08 08:39:18 | 001,166,848 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3)
SRV:64bit: - [2011.07.27 22:04:48 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2011.07.27 21:44:18 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2011.07.22 13:21:34 | 000,060,264 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe -- (LENOVO.TPKNRSVC)
SRV:64bit: - [2011.07.22 13:21:18 | 000,041,832 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe -- (LENOVO.CAMMUTE)
SRV:64bit: - [2011.06.03 13:51:38 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr)
SRV:64bit: - [2011.04.20 17:04:38 | 000,144,232 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD)
SRV:64bit: - [2011.04.04 17:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)
SRV:64bit: - [2011.03.29 20:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)
SRV:64bit: - [2011.03.29 20:15:36 | 000,047,728 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Windows\SysNative\TPHDEXLG64.exe -- (TPHDEXLGSVC)
SRV:64bit: - [2010.04.07 21:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2007.05.25 10:42:22 | 000,034,224 | ---- | M] () [Auto | Stopped] -- C:\windows\SysNative\spool\DRIVERS\x64\3\\lxddserv.exe -- (lxddCATSCustConnectService)
SRV:64bit: - [2007.05.25 10:42:12 | 000,567,216 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxddcoms.exe -- (lxdd_device)
SRV:64bit: - [2006.11.22 11:11:54 | 000,566,192 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxctcoms.exe -- (lxct_device)
SRV - [2013.06.04 18:24:53 | 000,116,632 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.28 08:45:11 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013.01.15 19:46:09 | 000,184,528 | ---- | M] (IBM Corp.) [Auto | Running] -- c:\sdwork\issimsvc.exe -- (ISSIMon)
SRV - [2012.11.07 18:27:16 | 000,511,288 | ---- | M] (IBM Corp.) [Auto | Running] -- C:\Program Files (x86)\C4ebreg\c4ebreg.exe -- (ISAMSvc)
SRV - [2012.07.21 16:05:20 | 001,588,544 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe -- (PGP RDD Service)
SRV - [2012.07.19 14:38:28 | 004,448,256 | ---- | M] (IBM) [Auto | Stopped] -- c:\notes\nsd.exe -- (Lotus Notes Diagnostics)
SRV - [2012.02.09 16:30:04 | 000,745,472 | ---- | M] (IBM Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\IBM\Tivoli\Remote Control\Target\trc_base.exe -- (TRCTARGET)
SRV - [2011.12.05 20:49:22 | 004,678,552 | ---- | M] (IBM Corp.) [Auto | Running] -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe -- (BESClient)
SRV - [2011.12.01 04:05:00 | 000,478,056 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE -- (DozeSvc)
SRV - [2011.12.01 04:05:00 | 000,175,168 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe -- (PwmEWSvc)
SRV - [2011.12.01 04:05:00 | 000,089,152 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)
SRV - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service)
SRV - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2011.09.16 09:31:34 | 000,189,832 | ---- | M] (IBM Corp) [Auto | Running] -- c:\notes\SUService.exe -- (LNSUSvc)
SRV - [2011.09.16 09:29:18 | 000,071,048 | ---- | M] (IBM Corp) [Auto | Stopped] -- c:\notes\ntmulti.exe -- (Multi-user Cleanup Service)
SRV - [2011.08.29 23:11:04 | 000,846,448 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe -- (VMUSBArbService)
SRV - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService)
SRV - [2011.04.19 17:12:22 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2011.04.14 20:22:28 | 000,263,528 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe -- (AcSvc)
SRV - [2011.04.14 20:22:26 | 000,124,264 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe -- (AcPrfMgrSvc)
SRV - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2011.03.24 22:11:32 | 000,428,912 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE -- (SNAC)
SRV - [2011.03.24 22:11:30 | 003,249,768 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)
SRV - [2011.03.24 22:11:30 | 001,839,776 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2010.09.09 19:40:38 | 000,079,200 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe -- (NetLogSvc)
SRV - [2010.09.09 19:40:24 | 000,476,000 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe -- (netcfgsvr)
SRV - [2010.09.09 19:40:02 | 000,349,536 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe -- (NetClientSvc)
SRV - [2010.09.07 22:05:51 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.18 16:19:30 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.04.29 02:00:00 | 000,436,736 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\XAudio64.dll -- (HsfXAudioService)
SRV - [2008.09.18 09:30:54 | 000,122,880 | ---- | M] () [Auto | Running] -- C:\Windows\wrtService.exe -- (WRTService)
SRV - [2007.05.25 10:42:22 | 000,034,224 | ---- | M] () [Auto | Stopped] -- C:\windows\system32\spool\DRIVERS\x64\3\\lxddserv.exe -- (lxddCATSCustConnectService)
SRV - [2007.05.25 10:41:38 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxddcoms.exe -- (lxdd_device)
SRV - [2006.11.22 11:11:36 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxctcoms.exe -- (lxct_device)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AnyDVD.sys -- (AnyDVD)
DRV:64bit: - [2013.04.04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013.03.04 14:24:27 | 000,040,344 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2012.12.11 07:22:08 | 000,042,824 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV)
DRV:64bit: - [2012.09.30 18:05:08 | 000,233,120 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wpshelper.sys -- (WpsHelper)
DRV:64bit: - [2012.09.27 07:00:40 | 000,052,320 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0)
DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.07.21 16:05:34 | 000,015,848 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\PGPwdefs.sys -- (Pgpwdefs)
DRV:64bit: - [2012.07.21 16:05:32 | 000,372,704 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\PGPwded.sys -- (PGPwded)
DRV:64bit: - [2012.07.21 16:05:30 | 000,051,856 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\PGPsdk.sys -- (PGPsdkDriver)
DRV:64bit: - [2012.07.21 16:05:22 | 000,273,848 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\windows\SysNative\drivers\PGPdisk.sys -- (PGPdisk)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.20 15:28:25 | 000,039,552 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tcpipBM.sys -- (tcpipBM)
DRV:64bit: - [2012.02.20 15:28:25 | 000,016,512 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BMLoad.sys -- (BMLoad)
DRV:64bit: - [2011.12.01 04:05:00 | 000,031,344 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\DZHDD64.SYS -- (DzHDD64)
DRV:64bit: - [2011.12.01 04:05:00 | 000,014,960 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\TPPWR64V.SYS -- (TPPWRIF)
DRV:64bit: - [2011.11.14 00:43:36 | 000,063,088 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86)
DRV:64bit: - [2011.11.14 00:42:40 | 000,032,880 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd)
DRV:64bit: - [2011.11.14 00:42:12 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV:64bit: - [2011.11.13 22:33:56 | 000,045,680 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV:64bit: - [2011.11.13 22:33:56 | 000,020,080 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV:64bit: - [2011.10.17 17:24:50 | 000,437,288 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (BTWAMPFL)
DRV:64bit: - [2011.10.17 17:24:44 | 000,164,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2011.10.17 17:24:44 | 000,146,984 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2011.10.17 17:24:44 | 000,039,976 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2011.10.17 17:24:44 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2011.10.03 23:46:40 | 001,577,088 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2011.09.26 03:40:28 | 012,309,440 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011.08.29 23:11:04 | 000,039,024 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon)
DRV:64bit: - [2011.08.29 23:01:10 | 000,037,680 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmusb.sys -- (vmusb)
DRV:64bit: - [2011.08.23 07:12:56 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2011.08.08 15:59:12 | 000,116,336 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci)
DRV:64bit: - [2011.08.08 08:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP)
DRV:64bit: - [2011.08.08 08:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL)
DRV:64bit: - [2011.08.04 16:45:24 | 000,341,680 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress)
DRV:64bit: - [2011.08.03 18:28:32 | 008,604,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64)
DRV:64bit: - [2011.05.25 18:23:00 | 000,101,888 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdxc64.sys -- (risdxc)
DRV:64bit: - [2011.04.18 16:43:30 | 000,086,528 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gt72ubus.sys -- (GT72UBUS)
DRV:64bit: - [2011.04.18 16:43:28 | 000,130,048 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Gt51Ip.sys -- (GT72NDISIPXP)
DRV:64bit: - [2011.04.18 16:43:28 | 000,010,496 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gtptser.sys -- (GTPTSER)
DRV:64bit: - [2011.04.18 16:43:26 | 000,085,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:64bit: - [2011.03.29 20:13:40 | 000,139,888 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsX64.sys -- (Shockprf)
DRV:64bit: - [2011.03.29 20:11:48 | 000,023,664 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsHM64.sys -- (TPDIGIMN)
DRV:64bit: - [2011.03.28 21:52:12 | 000,173,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2011.03.25 02:00:00 | 001,423,408 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011.03.24 22:11:36 | 000,053,808 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\WPSDRVnt.sys -- (WPS)
DRV:64bit: - [2011.03.24 22:11:34 | 000,482,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\srtspl64.sys -- (SRTSPL)
DRV:64bit: - [2011.03.24 22:11:34 | 000,449,072 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2011.03.24 22:11:34 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\srtspx64.sys -- (SRTSPX)
DRV:64bit: - [2011.03.24 22:11:32 | 000,064,048 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Teefer2.sys -- (Teefer2)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.05 02:00:00 | 000,166,016 | ---- | M] (Ricoh co.,Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\5U877.sys -- (5U877)
DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2011.02.16 19:23:46 | 000,074,240 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.10 02:00:00 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.12.10 02:00:00 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.12.02 02:00:00 | 000,101,416 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\l36wgps64.sys -- (l36wgps)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 11:57:43 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.05 02:00:00 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iastor)
DRV:64bit: - [2010.10.31 02:00:00 | 000,419,912 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Mbm3DevMt.sys -- (Mbm3DevMt)
DRV:64bit: - [2010.10.31 02:00:00 | 000,411,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Mbm3CBus.sys -- (Mbm3CBus)
DRV:64bit: - [2010.10.19 02:00:00 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.10.19 02:00:00 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2010.09.09 22:24:04 | 000,190,464 | R--- | M] (AT&T) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\agnfilt.sys -- (agnfilt)
DRV:64bit: - [2010.09.07 21:09:34 | 000,015,472 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\smiifx64.sys -- (lenovo.smi)
DRV:64bit: - [2010.09.01 15:33:12 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K3805-z_dc_enum.sys -- (vodafone_K3805-z_dc_enum)
DRV:64bit: - [2010.08.24 02:00:00 | 000,091,648 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_jucdcacm.sys -- (huawei_cdcacm)
DRV:64bit: - [2010.08.07 02:00:00 | 000,121,600 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2010.07.27 02:00:00 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:64bit: - [2010.07.27 02:00:00 | 000,029,696 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_juextctrl.sys -- (huawei_ext_ctrl)
DRV:64bit: - [2010.06.30 01:22:50 | 000,014,848 | ---- | M] (AT&T) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avpnnic.sys -- (avpnnic)
DRV:64bit: - [2010.05.04 02:00:00 | 000,022,528 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwupgrade.sys -- (huawei_update)
DRV:64bit: - [2010.03.20 02:00:00 | 000,013,952 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter)
DRV:64bit: - [2010.03.03 02:00:00 | 000,030,248 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wwussf64.sys -- (ecnssndisfltr)
DRV:64bit: - [2010.03.03 02:00:00 | 000,026,664 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wwuss64.sys -- (ecnssndis)
DRV:64bit: - [2009.10.26 02:00:00 | 000,061,952 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimspe64.sys -- (rimspci)
DRV:64bit: - [2009.09.28 02:00:00 | 000,055,808 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rixdpe64.sys -- (rixdpcie)
DRV:64bit: - [2009.09.04 02:00:00 | 000,067,072 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk)
DRV:64bit: - [2009.09.04 02:00:00 | 000,057,856 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp)
DRV:64bit: - [2009.09.04 02:00:00 | 000,054,784 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.30 02:00:00 | 001,486,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV)
DRV:64bit: - [2009.06.30 02:00:00 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf)
DRV:64bit: - [2009.06.30 02:00:00 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL)
DRV:64bit: - [2009.06.10 22:35:02 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\e1k60x64.sys -- (e1kexpress)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.11 02:00:00 | 000,118,016 | ---- | M] (Lenovo) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LenovoRd.sys -- (LenovoRd)
DRV:64bit: - [2009.04.29 02:00:00 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio)
DRV:64bit: - [2009.01.09 16:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2008.05.06 17:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:64bit: - [2007.02.19 07:56:38 | 000,027,136 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\psadd.sys -- (psadd)
DRV:64bit: - [2006.06.19 02:00:00 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk)
DRV - [2013.05.24 10:00:00 | 002,098,776 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130603.023\ex64.sys -- (NAVEX15)
DRV - [2013.05.24 10:00:00 | 000,126,040 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130603.023\eng64.sys -- (NAVENG)
DRV - [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2012.08.09 09:46:25 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2012.08.09 09:46:25 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011.03.24 22:11:34 | 000,482,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\srtspl64.sys -- (SRTSPL)
DRV - [2011.03.24 22:11:34 | 000,449,072 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysWOW64\drivers\srtsp64.sys -- (SRTSP)
DRV - [2011.03.24 22:11:34 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysWOW64\drivers\srtspx64.sys -- (SRTSPX)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2002.07.18 06:00:00 | 000,007,012 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\PMEMNT.SYS -- (PMEM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [String data over 1000 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C ED 65 D5 DD 17 CB 01 [binary data]
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = w3-501.ibm.com;<local>

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: ietab%40ip.cn:2.04.20110724.3ibm
FF - prefs.js..extensions.enabledAddons: langpack-en-US%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-fr%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-ja%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-ko%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-zh-CN%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-zh-TW%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: %7B25A1388B-6B18-46c3-BEBA-A81915D0DE8F%7D:1.7.8.3
FF - prefs.js..extensions.enabledAddons: IBM-cck%40firefox-extensions.ibm.com:2.1.11
FF - prefs.js..extensions.enabledAddons: bpaddtonab%40firefox-extensions.ibm.com:1.1.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.6
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@IBM.com/Java60: C:\Program Files\IBM\Java60\jre\bin\new_plugin\npjp2.dll (IBM)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@IBM.com/Java,version=1.6.0: C:\Program Files (x86)\IBM\Java60\jre\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@IBM.com/JavaPlugin: C:\Program Files (x86)\IBM\Java60\jre\bin\plugin2\npjp2.dll (IBM)
FF - HKLM\Software\MozillaPlugins\@IBM.com/WDPlugin,version=1: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@rim.com/npappworld: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll ()
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@IBM.com/WDPlugin,version=1: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\ [2012.02.20 15:27:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [2012.12.27 10:31:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.04 18:24:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.04 18:24:53 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]

[2010.07.14 01:32:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Extensions
[2013.06.04 09:09:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions
[2013.06.04 09:09:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2013.06.04 09:09:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
[2013.06.04 09:08:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-en-US@firefox.mozilla.org
[2013.06.04 09:08:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-fr@firefox.mozilla.org
[2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-ja@firefox.mozilla.org
[2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.06.04 18:49:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions
[2013.06.04 18:36:30 | 000,000,000 | ---D | M] (Quick Locale Switcher) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}
[2013.06.04 18:36:51 | 000,000,000 | ---D | M] (IBM Add To Notes Address Book BluePages Plugin) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com
[2013.06.04 18:36:48 | 000,000,000 | ---D | M] (IBM CCK) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com
[2013.06.04 18:36:19 | 000,000,000 | ---D | M] (IE Tab + (IBM Edition)) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\ietab@ip.cn
[2013.06.04 18:36:20 | 000,000,000 | ---D | M] ("English (US) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org
[2013.06.04 18:36:21 | 000,000,000 | ---D | M] ("Français Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org
[2013.06.04 18:36:22 | 000,000,000 | ---D | M] ("Japanese Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org
[2013.06.04 18:36:23 | 000,000,000 | ---D | M] ("Korean (KR) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org
[2013.06.04 18:36:24 | 000,000,000 | ---D | M] ("Chinese Simplified (zh-CN) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 18:36:26 | 000,000,000 | ---D | M] ("Traditional Chinese (zh-TW) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.06.04 18:49:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\staged
[2013.06.04 18:36:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com\defaults
[2013.06.04 18:36:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com\plugins
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\chrome
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\components
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\defaults
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\modules
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\searchplugins
[2013.06.04 18:36:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\extensions
[2013.06.04 18:36:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\extensions
[2013.06.04 18:36:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\extensions
[2013.06.04 18:36:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\extensions
[2013.06.04 18:36:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\extensions
[2013.06.04 18:36:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\extensions
[2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions
[2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.03.28 22:01:51 | 000,002,906 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\global\xpinstall\xpinstall.properties
[2013.03.28 22:01:51 | 000,000,580 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.28 22:01:51 | 000,000,639 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 01:22:59 | 000,003,417 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\global\xpinstall\xpinstall.properties
[2013.03.29 01:22:59 | 000,000,623 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 01:22:59 | 000,000,706 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 00:24:11 | 000,004,294 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\global\xpinstall\xpinstall.properties
[2013.03.29 00:24:11 | 000,000,726 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 00:24:11 | 000,000,842 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 00:51:01 | 000,002,817 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\global\xpinstall\xpinstall.properties
[2013.03.29 00:51:01 | 000,000,642 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 00:51:01 | 000,000,642 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 02:03:55 | 000,002,927 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\global\xpinstall\xpinstall.properties
[2013.03.29 02:03:55 | 000,000,575 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 02:03:55 | 000,000,584 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 02:10:39 | 000,002,948 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\global\xpinstall\xpinstall.properties
[2013.03.29 02:10:40 | 000,000,588 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 02:10:40 | 000,000,541 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\xpinstall\xpinstallConfirm.properties
[2013.06.04 18:49:14 | 000,504,298 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\staged\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}.xpi
[2013.06.04 18:24:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013.06.04 18:24:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2013.06.04 18:24:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2013.06.04 18:24:44 | 000,000,000 | ---D | M] (Quick Locale Switcher) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (IBM CCK) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (IE Tab + (IBM Edition)) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\ietab@ip.cn
[2013.06.04 18:24:23 | 000,000,000 | ---D | M] ("English (US) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org
[2013.06.04 18:24:24 | 000,000,000 | ---D | M] ("Français Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-fr@firefox.mozilla.org
[2013.06.04 18:24:26 | 000,000,000 | ---D | M] ("Japanese Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ja@firefox.mozilla.org
[2013.06.04 18:24:28 | 000,000,000 | ---D | M] ("Korean (KR) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ko@firefox.mozilla.org
[2013.06.04 18:24:32 | 000,000,000 | ---D | M] ("Chinese Simplified (zh-CN) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 18:24:39 | 000,000,000 | ---D | M] ("Traditional Chinese (zh-TW) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\chrome
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\components
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\defaults
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\modules
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\searchplugins
[2013.06.04 18:24:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\extensions
[2013.06.04 18:24:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\extensions
[2013.06.04 18:24:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\extensions
[2013.06.04 18:24:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\extensions
[2013.06.04 18:24:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\extensions
[2013.06.04 18:24:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\extensions
[2013.06.04 18:24:53 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.08.02 19:01:32 | 000,122,880 | ---- | M] (IBM ) -- C:\Program Files (x86)\mozilla firefox\plugins\npcpsweb.dll
[2011.12.09 19:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2011.11.11 15:10:34 | 000,297,864 | ---- | M] (IBM ) -- C:\Program Files (x86)\mozilla firefox\plugins\npwdplugin821.dll
[2013.03.28 23:50:17 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.03.28 23:50:17 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012.03.19 00:21:52 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\IBM\Java60\jre\bin\ssv.dll (IBM)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\IBM\Java60\jre\bin\jp2ssv.dll (IBM)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [AcWin7Hlpr] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe (Lenovo)
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe (Lexmark International Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe (Lenovo Group Limited)
O4:64bit: - HKLM..\Run: [LXCTCATS] C:\windows\SysNative\spool\DRIVERS\x64\3\LXCTtime.DLL (Lexmark International Inc.)
O4:64bit: - HKLM..\Run: [lxctmon.exe] C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe ()
O4:64bit: - HKLM..\Run: [lxddamon] C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe ()
O4:64bit: - HKLM..\Run: [lxddmon.exe] C:\Program Files (x86)\Lexmark 2500 Series\lxddmon.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [ProxyCap] C:\Program Files\Proxy Labs\ProxyCap\pcapui.exe (Proxy Labs)
O4:64bit: - HKLM..\Run: [TpShocks] C:\windows\SysNative\TpShocks.exe (Lenovo.)
O4 - HKLM..\Run: [ACSW14DE] C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (ACD Systems)
O4 - HKLM..\Run: [ACTray] C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe (Lenovo)
O4 - HKLM..\Run: [ACWLIcon] C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe (Lenovo)
O4 - HKLM..\Run: [ALTOOLS] AccessL.exe File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [C4EBReg] C:\Program Files (x86)\C4ebreg\c4ebreg.exe (IBM Corp.)
O4 - HKLM..\Run: [ccApp] C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [Isamtray] C:\Program Files (x86)\C4ebreg\isamtray.exe (IBM Corp.)
O4 - HKLM..\Run: [Lexmark 5400 Series] C:\Program Files (x86)\Lexmark 5400 Series\fm3032.exe ()
O4 - HKLM..\Run: [lxddamon] C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddamon.exe ()
O4 - HKLM..\Run: [lxddmon.exe] C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddmon.exe ()
O4 - HKLM..\Run: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
O4 - HKLM..\Run: [PWMTRV] C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [stgclean] c:\sdwork\w32maing.exe (IBM Corp.)
O4 - HKCU..\Run: [NetSP - restore settings on power failure] C:\Program Files (x86)\AT&T Network Client\NetSP.exe (AT&T)
O4 - HKCU..\Run: [SymphonyPreLoad] "C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.standard.launcher.win32.x86_3.0.1.20120110-2000\IBM Lotus Symphony" -nogui -nosplash File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Activities present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Safety present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\windows\SysNative\pcapwsp.dll (Proxy Labs)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - ppcapwsp.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\windows\SysWow64\pcapwsp.dll (Proxy Labs)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - pcapwsp.dll File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: ibm.com ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: ibm.com ([w3-03] http in Local intranet)
O15 - HKCU\..Trusted Domains: ibm.com ([w3-03] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1ACECAFE-0016-0000-0000-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp:// (Java Plug-in 1.6.0)
O16 - DPF: {8B8A0588-356B-431E-A4C3-A56553266DAA} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Smartscript.cab (Siebel SmartScript)
O16 - DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Desktop_Integration.cab (Siebel Desktop Integration)
O16 - DPF: {A6F9E1F5-780D-42F6-9644-3FC630A7AB39} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_HI_Client.cab (Siebel High Interactivity Framework)
O16 - DPF: {AD4EA0DC-8CC7-4F7B-B730-267823DCE9B7} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_OutBound_mail.cab (Siebel Email Support for Microsoft Outlook and Lotus Notes)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0169DF91-D033-43F4-A7DA-F04CD0C87DA4}: DhcpNameServer = 9.0.136.50 9.0.138.50
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: DhcpNameServer = 139.7.30.125 139.7.30.126
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: NameServer = 127.0.0.1,139.7.30.125,139.7.30.126
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: Domain = ibm.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: NameServer = 9.64.163.21,9.64.162.21
O18:64bit: - Protocol\Handler\gopher - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~1\GO36F4~1.DLL) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013.06.04 18:56:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe
[2013.06.04 18:35:32 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Desktop\Old Firefox Data-1
[2013.06.04 18:24:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.06.04 16:02:08 | 000,000,000 | ---D | C] -- C:\swd
[2013.06.04 15:59:53 | 000,000,000 | ---D | C] -- C:\sdwork
[2013.06.04 12:40:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2013.06.04 09:07:19 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Desktop\Old Firefox Data
[2013.06.03 19:09:00 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Documents\S
[2013.05.28 16:20:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Workstation Security Tool
[2013.05.28 15:41:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\C4ebreg
[2013.05.28 14:31:36 | 000,158,016 | ---- | C] (IBM) -- C:\windows\SysWow64\javaws.exe
[2013.05.28 14:31:35 | 000,149,824 | ---- | C] (IBM) -- C:\windows\SysWow64\javaw.exe
[2013.05.28 14:31:35 | 000,149,824 | ---- | C] (IBM) -- C:\windows\SysWow64\java.exe
[2013.05.28 14:31:33 | 000,084,288 | ---- | C] (IBM) -- C:\windows\SysWow64\javacplIBM60.cpl
[2013.05.28 14:09:42 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.05.26 18:01:24 | 038,944,576 | ---- | C] (Atomix Productions) -- C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe
[2013.05.19 13:04:48 | 000,142,424 | ---- | C] (SlySoft, Inc.) -- C:\windows\SysWow64\drivers\AnyDVD.sys
[2013.05.19 13:04:48 | 000,142,424 | ---- | C] (SlySoft, Inc.) -- C:\windows\SysNative\drivers\AnyDVD.sys
[2013.05.19 12:54:27 | 000,097,176 | ---- | C] (Elaborate Bytes AG) -- C:\windows\SysWow64\ElbyCDIO.dll
[2012.07.12 10:28:44 | 002,174,976 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Program Files (x86)\Common Files\atimpenc.dll
[8 C:\Users\IBM_ADMIN\Documents\*.tmp files -> C:\Users\IBM_ADMIN\Documents\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.06.04 19:12:00 | 000,783,562 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2013.06.04 19:12:00 | 000,663,252 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2013.06.04 19:12:00 | 000,122,674 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2013.06.04 18:58:15 | 000,000,000 | ---- | M] () -- C:\Users\IBM_ADMIN\defogger_reenable
[2013.06.04 18:56:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe
[2013.06.04 18:56:34 | 000,050,477 | ---- | M] () -- C:\Users\IBM_ADMIN\Desktop\Defogger.exe
[2013.06.04 18:36:50 | 000,001,151 | ---- | M] () -- C:\Users\IBM_ADMIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013.06.04 18:23:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2013.06.04 16:01:15 | 000,000,134 | ---- | M] () -- C:\windows\issiunin.bat
[2013.06.04 16:01:13 | 000,000,590 | ---- | M] () -- C:\Users\Public\Desktop\ISSI EZUpdate.lnk
[2013.06.04 16:01:02 | 000,000,112 | ---- | M] () -- C:\Users\Public\Desktop\IBM Standard Software Installer.url
[2013.06.04 12:40:39 | 000,001,151 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.06.04 08:31:46 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2013.06.03 23:05:02 | 000,016,528 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.03 23:05:02 | 000,016,528 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.03 15:48:42 | 000,316,215 | ---- | M] () -- C:\Users\IBM_ADMIN\Documents\ANGEBOT 13000238.pdf
[2013.06.03 09:55:36 | 2055,655,423 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.28 15:22:52 | 000,373,888 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2013.05.28 13:43:50 | 000,002,116 | ---- | M] () -- C:\Users\Public\Desktop\IBM Lotus Symphony.lnk
[2013.05.27 17:10:40 | 000,000,160 | ---- | M] () -- C:\Users\IBM_ADMIN\AppData\Roaming\default.rss
[2013.05.26 18:01:54 | 038,944,576 | ---- | M] (Atomix Productions) -- C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe
[2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) -- C:\windows\SysWow64\drivers\AnyDVD.sys
[2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) -- C:\windows\SysNative\drivers\AnyDVD.sys
[2013.05.19 12:54:27 | 000,097,176 | ---- | M] (Elaborate Bytes AG) -- C:\windows\SysWow64\ElbyCDIO.dll
[8 C:\Users\IBM_ADMIN\Documents\*.tmp files -> C:\Users\IBM_ADMIN\Documents\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.06.04 18:58:15 | 000,000,000 | ---- | C] () -- C:\Users\IBM_ADMIN\defogger_reenable
[2013.06.04 18:56:34 | 000,050,477 | ---- | C] () -- C:\Users\IBM_ADMIN\Desktop\Defogger.exe
[2013.06.04 16:03:55 | 000,001,151 | ---- | C] () -- C:\Users\IBM_ADMIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013.06.04 12:40:39 | 000,001,163 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.06.04 12:40:39 | 000,001,151 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.06.03 15:48:41 | 000,316,215 | ---- | C] () -- C:\Users\IBM_ADMIN\Documents\ANGEBOT 13000238.pdf
[2013.05.31 15:08:46 | 000,002,601 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ProxyCap.lnk
[2013.05.28 08:45:11 | 000,000,830 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2013.05.01 17:08:02 | 000,331,776 | ---- | C] ( ) -- C:\windows\SysWow64\sbcrreag.dll
[2012.12.27 13:35:03 | 000,000,000 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\downloads.m3u
[2012.12.04 22:39:57 | 000,413,696 | ---- | C] ( ) -- C:\windows\SysWow64\lxddinpa.dll
[2012.12.04 22:39:57 | 000,397,312 | ---- | C] ( ) -- C:\windows\SysWow64\lxddiesc.dll
[2012.12.04 22:39:57 | 000,385,024 | ---- | C] () -- C:\windows\SysWow64\lxddcomx.dll
[2012.12.04 22:39:57 | 000,286,720 | ---- | C] () -- C:\windows\SysWow64\LXDDinst.dll
[2012.12.04 22:39:56 | 001,232,896 | ---- | C] ( ) -- C:\windows\SysWow64\lxddserv.dll
[2012.12.04 22:39:56 | 000,999,424 | ---- | C] ( ) -- C:\windows\SysWow64\lxddusb1.dll
[2012.12.04 22:39:56 | 000,643,072 | ---- | C] ( ) -- C:\windows\SysWow64\lxddpmui.dll
[2012.12.04 22:39:56 | 000,163,840 | ---- | C] ( ) -- C:\windows\SysWow64\lxddprox.dll
[2012.12.04 22:39:55 | 000,700,416 | ---- | C] ( ) -- C:\windows\SysWow64\lxddhbn3.dll
[2012.12.04 22:39:55 | 000,684,032 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcomc.dll
[2012.12.04 22:39:55 | 000,585,728 | ---- | C] ( ) -- C:\windows\SysWow64\lxddlmpm.dll
[2012.12.04 22:39:55 | 000,537,520 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcoms.exe
[2012.12.04 22:39:55 | 000,425,984 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcomm.dll
[2012.12.04 22:39:55 | 000,394,160 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcfg.exe
[2012.12.04 22:39:55 | 000,385,968 | ---- | C] ( ) -- C:\windows\SysWow64\lxddih.exe
[2012.12.04 22:39:55 | 000,181,168 | ---- | C] ( ) -- C:\windows\SysWow64\lxddppls.exe
[2012.12.04 22:39:55 | 000,094,208 | ---- | C] ( ) -- C:\windows\SysWow64\lxddpplc.dll
[2012.11.20 15:57:53 | 000,059,487 | ---- | C] () -- C:\Users\IBM_ADMIN\install.xml
[2012.10.17 18:37:16 | 000,000,600 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\PUTTY.RND
[2012.10.09 15:35:25 | 000,000,600 | ---- | C] () -- C:\Users\IBM_ADMIN\PUTTY.RND
[2012.07.21 16:07:34 | 000,000,280 | ---- | C] () -- C:\windows\SysWow64\PGPsdk.dll.sig
[2012.06.01 13:36:53 | 000,001,057 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\vso_ts_preview.xml
[2012.04.05 10:20:35 | 000,007,600 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\Resmon.ResmonCfg
[2012.03.20 16:11:35 | 000,000,632 | RHS- | C] () -- C:\Users\IBM_ADMIN\ntuser.pol
[2012.03.18 21:24:10 | 000,000,460 | ---- | C] () -- C:\windows\win_bak.ini
[2012.03.01 14:22:44 | 000,000,160 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\default.rss
[2012.02.21 14:50:01 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.02.20 17:06:15 | 000,005,120 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.20 12:08:51 | 000,122,880 | ---- | C] () -- C:\windows\wrtService.exe
[2012.02.20 12:08:51 | 000,000,156 | ---- | C] () -- C:\windows\SysWow64\wrtservice.ini
[2012.02.18 20:15:49 | 000,274,432 | ---- | C] () -- C:\windows\SysWow64\LXCTinst.dll
[2012.02.18 20:15:48 | 000,413,696 | ---- | C] ( ) -- C:\windows\SysWow64\lxctinpa.dll
[2012.02.18 20:15:48 | 000,397,312 | ---- | C] ( ) -- C:\windows\SysWow64\lxctiesc.dll
[2012.02.18 20:15:46 | 000,643,072 | ---- | C] ( ) -- C:\windows\SysWow64\lxctpmui.dll
[2012.02.18 20:15:44 | 000,991,232 | ---- | C] ( ) -- C:\windows\SysWow64\lxctusb1.dll
[2012.02.18 20:15:43 | 001,224,704 | ---- | C] ( ) -- C:\windows\SysWow64\lxctserv.dll
[2012.02.18 20:15:42 | 000,163,840 | ---- | C] ( ) -- C:\windows\SysWow64\lxctprox.dll
[2012.02.18 20:15:41 | 000,585,728 | ---- | C] ( ) -- C:\windows\SysWow64\lxctlmpm.dll
[2012.02.18 20:15:41 | 000,181,168 | ---- | C] ( ) -- C:\windows\SysWow64\lxctppls.exe
[2012.02.18 20:15:41 | 000,094,208 | ---- | C] ( ) -- C:\windows\SysWow64\lxctpplc.dll
[2012.02.18 20:15:40 | 000,696,320 | ---- | C] ( ) -- C:\windows\SysWow64\lxcthbn3.dll
[2012.02.18 20:15:40 | 000,385,968 | ---- | C] ( ) -- C:\windows\SysWow64\lxctih.exe
[2012.02.18 20:15:39 | 000,537,520 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcoms.exe
[2012.02.18 20:15:39 | 000,421,888 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcomm.dll
[2012.02.18 20:15:38 | 000,684,032 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcomc.dll
[2012.02.18 20:15:37 | 000,381,872 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcfg.exe
[2012.02.18 14:08:24 | 000,004,767 | ---- | C] () -- C:\windows\Irremote.ini
[2012.02.18 10:27:46 | 000,204,800 | ---- | C] () -- C:\windows\SysWow64\IVIresizeW7.dll
[2012.02.18 10:27:46 | 000,200,704 | ---- | C] () -- C:\windows\SysWow64\IVIresizeA6.dll
[2012.02.18 10:27:46 | 000,192,512 | ---- | C] () -- C:\windows\SysWow64\IVIresizeP6.dll
[2012.02.18 10:27:46 | 000,192,512 | ---- | C] () -- C:\windows\SysWow64\IVIresizeM6.dll
[2012.02.18 10:27:46 | 000,188,416 | ---- | C] () -- C:\windows\SysWow64\IVIresizePX.dll
[2012.02.18 10:27:46 | 000,020,480 | ---- | C] () -- C:\windows\SysWow64\IVIresize.dll
[2012.02.18 10:25:57 | 000,831,600 | ---- | C] () -- C:\windows\SysWow64\Ctaa1.dat
[2012.02.18 10:25:52 | 000,122,880 | ---- | C] () -- C:\windows\SysWow64\cddvdint.dll
[2012.02.15 17:47:03 | 000,000,376 | ---- | C] () -- C:\windows\ODBC.INI
[2012.02.15 16:21:38 | 000,216,000 | ---- | C] () -- C:\windows\SysWow64\igfcg600m.bin
[2012.02.15 16:21:37 | 000,056,832 | ---- | C] () -- C:\windows\SysWow64\igdde32.dll
[2012.02.15 16:21:35 | 013,903,360 | ---- | C] () -- C:\windows\SysWow64\ig4icd32.dll
[2012.02.15 16:20:56 | 000,777,778 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2011.12.09 22:41:04 | 000,000,033 | ---- | C] () -- C:\windows\Uninst.ini
[2011.12.09 22:35:14 | 000,039,424 | ---- | C] () -- C:\windows\SysWow64\pdresrc.dll
[2011.12.09 22:35:07 | 000,786,432 | ---- | C] () -- C:\windows\SysWow64\pdclntif.dll
[2011.12.09 22:35:07 | 000,270,336 | ---- | C] () -- C:\windows\SysWow64\pdprDlg.dll
[2011.12.09 22:35:07 | 000,208,896 | ---- | C] () -- C:\windows\SysWow64\selpms.dll
[2011.12.09 22:35:07 | 000,106,496 | ---- | C] () -- C:\windows\SysWow64\IBMMenu.dll
[2011.12.09 22:35:07 | 000,086,016 | ---- | C] () -- C:\windows\SysWow64\selpmcui.dll
[2011.12.09 14:24:23 | 000,066,856 | ---- | C] () -- C:\windows\SysWow64\SynTPEnhPS.dll
[2011.12.09 14:23:48 | 000,963,116 | ---- | C] () -- C:\windows\SysWow64\igkrng600.bin
[2011.12.09 14:23:46 | 000,145,804 | ---- | C] () -- C:\windows\SysWow64\igcompkrng600.bin
[2011.04.18 16:39:56 | 000,226,364 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
[2010.07.03 01:50:13 | 000,000,566 | RHS- | C] () -- C:\ProgramData\ntuser.pol

========== ZeroAccess Check ==========

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012.02.18 20:30:47 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\5400 Series
[2012.02.24 20:28:04 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\ACD Systems
[2012.10.12 12:35:05 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Azureus
[2013.02.06 12:27:12 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\calibre
[2012.07.05 09:34:15 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\com.unitedinternet.ums.sms-mms-manager
[2013.01.01 18:06:03 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Dropbox
[2012.12.27 10:34:19 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoft
[2012.12.27 10:34:36 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.30 10:59:59 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\IBM
[2012.03.14 10:54:48 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\IBMERS
[2012.11.28 16:38:23 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\JawboneUpdater
[2012.12.04 22:46:28 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Lexmark Productivity Studio
[2011.12.09 22:17:22 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Lotus
[2012.02.16 09:04:43 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\pdfforge
[2012.11.14 18:00:43 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\PGP Corporation
[2012.02.15 17:10:34 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\PwrMgr
[2012.02.20 17:01:05 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Research In Motion
[2010.07.14 01:18:48 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Sierra Wireless
[2012.02.20 15:35:49 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Vodafone
[2013.01.01 18:04:23 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Vso
[2012.12.17 18:13:32 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\WDPlugin
[2010.11.12 02:36:49 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\WinBatch
[2012.12.27 14:10:09 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Xilisoft

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\IBM_ADMIN\Documents\Liste 2.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\IBM_ADMIN\Documents\checkliste travel.xls:Roxio EMC Stream

< End of report >

Alt 04.06.2013, 20:07   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Hi,

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches OTL log. LOgs bitte in Codetags posten.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________

Alt 04.06.2013, 20:56   #3
mailmeback
 
Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Hallo Schrauber,

danke für das sehr schnell melden. Ich hoffe Du bist mein Rettungsengel. Habe alles haarklein so gemacht, hier das Ergebnis:

Danke
mailmeback
************************

Code:
ATTFilter
# AdwCleaner v2.301 - Logfile created 06/04/2013 at 21:21:18
# Updated 16/05/2013 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : xxx - IBM-IF34NF70CTV
# Boot Mode : Normal
# Running from : C:\Users\IBM_ADMIN\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\END
Folder Deleted : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\Vuze_Remote
Folder Deleted : C:\Users\IBM_ADMIN\AppData\Local\Conduit
Folder Deleted : C:\Users\IBM_ADMIN\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\IBM_ADMIN\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\IBM_ADMIN\AppData\LocalLow\Vuze_Remote
Folder Deleted : C:\Users\IBM_ADMIN\AppData\Roaming\dvdvideosoftiehelpers
Folder Deleted : C:\Users\IBM_ADMIN\AppData\Roaming\pdfforge

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\AppDataLow\Software\Vuze_Remote
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E30ED111-BD63-48C2-A6CB-AB3C9FFFB07C}
Key Deleted : HKCU\Software\OCS
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2504091
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E30ED111-BD63-48C2-A6CB-AB3C9FFFB07C}
Key Deleted : HKLM\Software\Vuze_Remote
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E30ED111-BD63-48C2-A6CB-AB3C9FFFB07C}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ABEF8EAA-76C1-4BF8-A21E-2C98D498CD0B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BABEBD82-9B49-4397-BDAC-0B1618E25AB7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Vuze_Remote Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{acaa314b-eeba-48e4-ad47-84e31c44796c}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{BA14329E-9550-4989-B3F2-9732E92D17CC}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v17.0.6 (en-US)

File : C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\prefs.js

[OK] File is clean.

File : C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\prefs.js

[OK] File is clean.

File : C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\prefs.js

[OK] File is clean.

File : C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\prefs.js

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [4639 octets] - [04/06/2013 21:21:18]

########## EOF - C:\AdwCleaner[S1].txt - [4699 octets] ##########
         


Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Professional x64
Ran by xxx on 04.06.2013 at 21:33:21,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Failed to delete: [Folder] "C:\ProgramData\bigfix"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.06.2013 at 21:36:44,30
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         


OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 04.06.2013 21:39:27 - Run 6
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\IBM_ADMIN\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
7,89 Gb Total Physical Memory | 5,64 Gb Available Physical Memory | 71,49% Memory free
15,77 Gb Paging File | 13,53 Gb Available in Paging File | 85,80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 298,09 Gb Total Space | 68,73 Gb Free Space | 23,06% Space Free | Partition Type: NTFS
 
Computer Name: IBM-IF34NF70CTV | User Name: xxxxxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.06.04 18:56:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.01.15 19:46:09 | 000,184,528 | ---- | M] (IBM Corp.) -- c:\sdwork\issimsvc.exe
PRC - [2012.11.16 13:28:17 | 011,296,768 | ---- | M] (IBM) -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.brand.win32_3.0.1.20120110-2000\program\soffice.bin
PRC - [2012.11.07 18:28:31 | 000,326,968 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\C4ebreg\isamtray.exe
PRC - [2012.11.07 18:27:16 | 000,511,288 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\C4ebreg\c4ebreg.exe
PRC - [2012.07.21 16:05:20 | 001,588,544 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe
PRC - [2012.07.21 16:05:14 | 003,935,944 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe
PRC - [2012.07.19 14:38:28 | 004,448,256 | ---- | M] (IBM) -- c:\notes\nsd.exe
PRC - [2011.12.05 20:49:22 | 004,678,552 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
PRC - [2011.12.05 20:49:22 | 001,471,896 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe
PRC - [2011.12.01 04:05:00 | 000,064,576 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
PRC - [2011.11.17 02:36:22 | 001,231,472 | ---- | M] (ACD Systems) -- C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe
PRC - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe
PRC - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe
PRC - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
PRC - [2011.09.16 09:31:34 | 000,189,832 | ---- | M] (IBM Corp) -- c:\notes\SUService.exe
PRC - [2011.09.16 09:29:18 | 000,071,048 | ---- | M] (IBM Corp) -- c:\notes\ntmulti.exe
PRC - [2011.09.15 17:19:14 | 000,079,232 | ---- | M] (IBM) -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\symphony.exe
PRC - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe
PRC - [2011.07.22 13:21:34 | 000,060,264 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
PRC - [2011.07.22 13:21:32 | 000,042,344 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
PRC - [2011.07.22 13:21:18 | 000,041,832 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe
PRC - [2011.05.27 02:43:12 | 000,328,040 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2011.04.19 17:12:22 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2011.04.19 17:12:18 | 000,408,576 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
PRC - [2011.04.14 20:24:26 | 000,410,984 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
PRC - [2011.04.14 20:22:42 | 000,361,832 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
PRC - [2011.04.14 20:22:36 | 000,193,896 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe
PRC - [2011.04.14 20:22:30 | 000,431,464 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe
PRC - [2011.04.14 20:22:28 | 000,263,528 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
PRC - [2011.04.14 20:22:26 | 000,124,264 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
PRC - [2011.04.07 23:41:32 | 000,138,680 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\ZOOM\TpScrex.exe
PRC - [2011.04.04 17:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\micmute.exe
PRC - [2011.03.29 20:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
PRC - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2011.03.24 22:11:32 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe
PRC - [2011.03.24 22:11:30 | 001,839,776 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe
PRC - [2011.03.24 22:11:30 | 000,050,544 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe
PRC - [2011.02.18 12:47:12 | 000,079,192 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2010.09.09 19:40:38 | 000,079,200 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe
PRC - [2010.09.09 19:40:24 | 000,476,000 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe
PRC - [2010.09.09 19:40:02 | 000,349,536 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe
PRC - [2010.04.07 21:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
PRC - [2010.04.01 21:50:44 | 000,043,960 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
PRC - [2009.06.18 16:19:30 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2009.04.27 14:37:18 | 000,025,256 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe
PRC - [2008.09.18 09:30:54 | 000,122,880 | ---- | M] () -- C:\Windows\wrtService.exe
PRC - [2006.11.22 11:11:24 | 000,082,864 | ---- | M] (Lexmark International Inc.) -- C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe
PRC - [2006.11.22 11:11:22 | 000,291,760 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.05.28 15:26:45 | 000,077,824 | ---- | M] () -- C:\Users\IBM_ADMIN\IBM\Lotus\Symphony\.config\org.eclipse.osgi\bundles\529\1\.cp\officebean.dll
MOD - [2013.05.28 15:26:43 | 000,073,728 | ---- | M] () -- C:\Users\IBM_ADMIN\IBM\Lotus\Symphony\.config\org.eclipse.osgi\bundles\280\1\.cp\swtIbmWrapper.dll
MOD - [2013.05.27 08:09:32 | 002,297,856 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\3c2ed368e1f3889997dfb42a5ca77284\System.Core.ni.dll
MOD - [2013.05.27 08:09:18 | 000,181,248 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Common\087705bc24370a204f2c6255fc68ad0e\Vodafone.Common.ni.dll
MOD - [2013.05.27 08:09:17 | 000,673,280 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Data\d509111dd6accedf8942eb2b6b83fec6\Vodafone.Data.ni.dll
MOD - [2013.05.26 20:24:57 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5dabd015d753b028750e4853dde12178\System.Windows.Forms.ni.dll
MOD - [2013.05.26 20:24:49 | 003,347,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll
MOD - [2013.05.26 20:24:45 | 000,687,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\23673bbebe3c0ca7c894e614bb3ffd1a\System.Security.ni.dll
MOD - [2013.05.26 20:24:40 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013.02.18 12:00:50 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Manag#\6c4e587713b061a12ee470864ca4fb97\Vodafone.View.ManagedToolTip.ni.dll
MOD - [2013.02.18 12:00:49 | 000,876,544 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Shared\0e762a83572c331f3475b6c20722f4fb\Vodafone.View.Shared.ni.dll
MOD - [2013.02.18 12:00:45 | 000,606,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Secon#\32cf63de2f013751cd1874dc1fd9debf\Vodafone.View.SecondaryWindows.ni.dll
MOD - [2013.02.18 12:00:43 | 000,031,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\cc6f7fbebb0748b98dfce775d95005c6\Vodafone.DeviceAccess.Factory.ni.dll
MOD - [2013.02.18 12:00:42 | 000,499,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\fd8de9d227b25a729338f4fdca7571b0\Vodafone.DeviceAccess.Internals.ni.dll
MOD - [2013.02.18 12:00:40 | 000,674,304 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\b53a516b601a9dc1c183a48339e7a92e\Vodafone.ConnectionServices.ni.dll
MOD - [2013.02.18 12:00:37 | 000,050,176 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\c3058f2d5d8b4717e85d530f54463e0d\Vodafone.Contracts.Adapter.ni.dll
MOD - [2013.02.18 12:00:32 | 001,304,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\eb027595e692626525390ae831f4934e\Infragistics2.Win.UltraWinEditors.v9.2.ni.dll
MOD - [2013.02.18 12:00:29 | 003,348,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.M#\2a1a484a011c63a38d01cba92f641890\Infragistics2.Win.Misc.v9.2.ni.dll
MOD - [2013.02.18 12:00:22 | 011,053,056 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.v#\9c3e7a0a80452bab80237eafcc576389\Infragistics2.Win.v9.2.ni.dll
MOD - [2013.02.18 12:00:02 | 000,871,424 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Share#\8edb485e7273579bb217330f8ba7fb98\Infragistics2.Shared.v9.2.ni.dll
MOD - [2013.02.18 11:59:59 | 007,137,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\4c43791aeb4aede26a3bd89d86bc89b5\Infragistics2.Win.UltraWinToolbars.v9.2.ni.dll
MOD - [2013.02.18 11:59:46 | 000,037,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\74f8482ed000aed6d9057d4f2d5dc2f3\Vodafone.Contracts.Presenter.ni.dll
MOD - [2013.02.18 11:59:45 | 000,132,608 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\5f8ef1464fd770130f9715f485bf94bc\Vodafone.Contracts.Model.ni.dll
MOD - [2013.02.18 11:59:44 | 000,105,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\acb2ca5e34236615024edcdcc4fa6b2b\Vodafone.Contracts.View.ni.dll
MOD - [2013.02.18 11:59:43 | 000,094,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\9ec5cec32e8e823f78144fcb9a47fb64\Vodafone.Contracts.Common.ni.dll
MOD - [2013.02.18 11:59:39 | 000,342,016 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.CommonDial#\30b0a9cd1f814f94fa0de09349a7e4d7\Vodafone.CommonDialogs.ni.dll
MOD - [2013.02.18 11:59:37 | 000,947,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Applicatio#\6a874bbee313ab4f3ab630a2e6855d58\Vodafone.ApplicationHost.Impl.ni.dll
MOD - [2013.02.18 11:59:34 | 000,326,656 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DataAccess#\d9173324d53199cabf7f663060356804\Vodafone.DataAccessor.ni.dll
MOD - [2013.02.18 11:59:16 | 000,158,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Contr#\0a6abb05d1f030b0aca6c78857f130ae\Vodafone.Base.Contracts.ni.dll
MOD - [2013.02.18 11:59:13 | 001,368,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Platform\7ee6c9cdec2c6eee428213bb5646b97c\Vodafone.Platform.ni.dll
MOD - [2013.02.18 11:59:09 | 000,283,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\MobileBroadband\e6c36364416e40614eac2b777471961d\MobileBroadband.ni.exe
MOD - [2013.02.17 17:50:08 | 000,212,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\7ff638de44686eab4afaa8b3c8a9cfca\System.ServiceProcess.ni.dll
MOD - [2013.01.16 14:13:48 | 001,065,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\d602f7a5bbd392dddbc07c2f5f083a11\System.Management.ni.dll
MOD - [2013.01.16 14:13:43 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d908c91e24616e6b8d38c9da61038b25\Accessibility.ni.dll
MOD - [2013.01.16 14:13:32 | 005,459,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\fa022967bdd1030211f9cadcab797520\System.Xml.ni.dll
MOD - [2013.01.16 14:13:27 | 007,989,760 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.16 14:13:08 | 000,774,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\83265111769de5cd294df17e6d762958\System.Runtime.Remoting.ni.dll
MOD - [2013.01.16 14:13:07 | 000,627,712 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\7e584aeb8aa941f7f9bce2a31ea750f0\System.Transactions.ni.dll
MOD - [2013.01.16 14:13:06 | 006,638,592 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\81f61d2c8af0d34385679aa2465c609a\System.Data.ni.dll
MOD - [2013.01.16 14:12:40 | 012,678,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\09594e500a32cd9a1e4ddf33b45b4e44\PresentationCore.ni.dll
MOD - [2013.01.16 10:25:55 | 000,080,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsProfile#\037db27d8cacfabe7ed7b999e14552c4\Vodafone.SmsProfileManager.ni.dll
MOD - [2013.01.16 10:25:55 | 000,031,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.OutlookCon#\8c256f277b654a2421f817711d72a72f\Vodafone.OutlookConnector.ni.dll
MOD - [2013.01.16 10:25:45 | 000,321,536 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Win32\4fc713e9bd132a9c0e0b177b9eceddf3\Vodafone.Base.Win32.ni.dll
MOD - [2013.01.16 10:25:45 | 000,197,120 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsContact#\2e27dae10259458ed19ab28802d6d435\Vodafone.SmsContactManager.ni.dll
MOD - [2013.01.15 22:16:27 | 000,252,928 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.FNCClient11#\fd734656ee66b5253483a686d6d679d8\Interop.FNCClient11Lib.ni.dll
MOD - [2013.01.15 22:16:26 | 000,219,648 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Conn#\9365c6b816ac5d118accc3e870ec8759\Vodafone.Model.Connection.ni.dll
MOD - [2013.01.15 22:16:26 | 000,033,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.UpdateMana#\ec56e9bcdd353278994778ebfa8f5aab\Vodafone.UpdateManager.ni.dll
MOD - [2013.01.15 22:16:23 | 000,082,432 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Remot#\552e346f1bc27fa324a710072104ab0f\Vodafone.Core.Remoting.ni.dll
MOD - [2013.01.15 22:16:23 | 000,054,784 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.TrafficOpt#\f6bb1fbd008e4be503a15a0633fa694b\Vodafone.TrafficOptimiser.ni.dll
MOD - [2013.01.15 22:16:23 | 000,024,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.CoreI#\06cf2695acff680bd5008e4bd1cb5375\Vodafone.Core.CoreInstanceProvider.ni.dll
MOD - [2013.01.15 22:16:22 | 000,119,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\d65e3892ff3bfd90b6b37f7ef0c8761c\Interop.Shell32.ni.dll
MOD - [2013.01.15 22:16:22 | 000,106,496 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LanWlanMan#\c1a004ae9c01857bccbdaa343e885422\Vodafone.LanWlanManager.ni.dll
MOD - [2013.01.15 22:16:22 | 000,072,704 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Vpn\1f2f44b9c1e6f8d028b5005fc7658972\Vodafone.Vpn.ni.dll
MOD - [2013.01.15 22:16:21 | 000,393,728 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MbbManagem#\64bd72f4e684ee7fd460fe4c65f2bc0d\Vodafone.MbbManagement.ni.dll
MOD - [2013.01.15 22:16:21 | 000,081,408 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.MbnApi\f450d8d019b097372ed1dea56de0e5a2\Interop.MbnApi.ni.dll
MOD - [2013.01.15 22:16:21 | 000,039,936 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\e3be5dd41dd4f191b99353a091afbb2f\Vodafone.DeviceAccess.Interfaces.ni.dll
MOD - [2013.01.15 22:16:20 | 000,733,696 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.WwanWrapper\657dd7faab285319de359b2fa0706558\Vodafone.WwanWrapper.ni.dll
MOD - [2013.01.15 22:16:19 | 000,020,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Inter#\f70562c22e9a0d5d45171b13d6c56b7f\Vodafone.Core.Interfaces.ni.dll
MOD - [2013.01.15 22:16:18 | 000,942,080 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.BusinessLo#\02c5bea3c3542435991367afd45d0ae9\Vodafone.BusinessLogic.ni.dll
MOD - [2013.01.15 22:16:17 | 002,110,976 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Spring.Core\b559dd7a2b0f458d9e89412c4728b824\Spring.Core.ni.dll
MOD - [2013.01.15 22:16:17 | 000,047,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Common.Logging\e1f5430a5664ac36d30136ffe1339bc2\Common.Logging.ni.dll
MOD - [2013.01.15 22:16:15 | 000,042,496 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.InstancePr#\eb9e8b0000726b973085e44c1e8e3ec8\Vodafone.InstanceProvider.Impl.ni.dll
MOD - [2013.01.15 22:15:59 | 000,098,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Contr#\4648622b8786e9df320724f55d507421\Vodafone.Core.Contracts.ni.dll
MOD - [2013.01.15 22:15:59 | 000,026,112 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\e5f971684a0cfdbade27c8a77b94c1dc\Vodafone.DeviceAccess.Contracts.ni.dll
MOD - [2013.01.15 22:15:58 | 000,089,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Inter#\cce3a30a9dc0d6b0d0817ac8c539cb1c\Vodafone.Base.Internals.ni.dll
MOD - [2013.01.15 22:15:58 | 000,017,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Facto#\5ea47d1f504e95a19ea37b2d56bb32bd\Vodafone.Base.Factory.ni.dll
MOD - [2013.01.15 22:15:57 | 000,153,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\014e1457c2135de51d117bb23bde328c\Vodafone.ConnectionManagement.ni.dll
MOD - [2013.01.15 22:15:55 | 000,350,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.ReportingM#\8e36bfb3548a969d0431c4c7f6d273e9\Vodafone.ReportingManager.ni.dll
MOD - [2013.01.15 22:15:53 | 000,055,296 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SettingsMa#\378a6b2759e2c491e34cc6cfef7a46d6\Vodafone.SettingsManager.ni.dll
MOD - [2013.01.15 22:15:52 | 000,074,240 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.NtServiceM#\7bebcfbb3c250b011b8b5e70a3e15cba\Vodafone.NtServiceMessaging.ni.dll
MOD - [2013.01.15 22:15:51 | 002,003,456 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\MobileBroadbandReso#\36c482b2fb56d28a66adf894213b43df\MobileBroadbandResources.ni.dll
MOD - [2013.01.15 22:15:31 | 000,019,456 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MobileBroa#\a898a34cb3613fe42c5a502f01773c2e\Vodafone.MobileBroadband.CallbackHandler.ni.dll
MOD - [2013.01.15 22:15:26 | 000,096,256 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LogEngine\a455bcf66b06fd85fd03f7560979b37f\Vodafone.LogEngine.ni.dll
MOD - [2013.01.15 19:06:15 | 001,597,440 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\229b5280b4e310f5e83657abbf257632\System.Drawing.ni.dll
MOD - [2013.01.15 19:05:50 | 011,493,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2012.12.12 07:32:26 | 005,025,792 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2012.11.16 13:28:17 | 000,967,168 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.brand.win32_3.0.1.20120110-2000\program\libxml2.dll
MOD - [2012.11.16 13:28:10 | 000,163,840 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.basis.system.win32_3.0.1.20120110-2000\basis\program\libxslt.dll
MOD - [2012.11.16 13:27:48 | 000,139,264 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.basis.base.win32_3.0.1.20120110-2000\basis\program\nsldap32v50.dll
MOD - [2012.11.16 13:27:27 | 000,077,824 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.filetype.win32.x86_3.0.1.20120110-2000\seditorReg.dll
MOD - [2012.11.16 13:26:35 | 000,106,496 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\eclipse\plugins\com.ibm.rcp.swt.browser.dom.ie_6.2.3.20110915-1350\os\win32\x86\comex.dll
MOD - [2012.10.05 12:53:24 | 003,198,976 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2012.10.05 12:53:24 | 000,630,784 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2012.08.31 12:59:19 | 004,550,656 | ---- | M] () -- C:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
MOD - [2012.02.17 07:47:08 | 000,034,816 | ---- | M] () -- C:\Program Files (x86)\Google\Google Desktop Search\gzlib.dll
MOD - [2011.09.15 17:19:14 | 000,081,920 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\eclipse_1118.dll
MOD - [2011.09.15 17:19:12 | 000,110,592 | ---- | M] () -- C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\pipeserver.dll
MOD - [2011.04.19 17:12:12 | 000,308,736 | ---- | M] () -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\Vodafone.View.Taskbar.dll
MOD - [2011.04.14 19:15:52 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
MOD - [2010.11.05 03:58:14 | 002,048,000 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2010.11.05 03:58:10 | 000,303,104 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2010.11.05 03:58:04 | 000,425,984 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
MOD - [2009.07.14 03:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\SysWOW64\msjetoledb40.dll
MOD - [2009.06.10 23:23:19 | 000,261,632 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2009.06.10 23:22:40 | 000,010,752 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
MOD - [2009.04.27 14:37:18 | 000,025,256 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe
MOD - [2008.05.16 13:35:22 | 000,040,960 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.Monitor.Core.dll
MOD - [2008.05.16 13:35:22 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.Monitor.Common.dll
MOD - [2008.05.16 13:34:18 | 000,057,344 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.MCMDevMon.dll
MOD - [2007.04.30 09:20:26 | 000,011,776 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.MCMDevMon.AutoPlayUtil.dll
MOD - [2007.04.30 09:19:52 | 000,020,480 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.ScanDevMon.dll
MOD - [2007.04.30 09:19:48 | 000,020,480 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.NetworkCardDevMon.dll
MOD - [2006.11.22 11:11:22 | 000,291,760 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe
MOD - [2006.08.08 17:54:18 | 000,278,528 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctscw.dll
MOD - [2006.06.09 04:39:54 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctdrec.dll
MOD - [2006.05.25 18:20:44 | 000,241,664 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\iptk.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2013.05.01 17:02:26 | 002,280,960 | ---- | M] (Proxy Labs) [Auto | Running] -- C:\Program Files\Proxy Labs\ProxyCap\pcapsvc.exe -- (pcapsvc)
SRV:64bit: - [2012.12.11 07:22:08 | 000,060,272 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC)
SRV:64bit: - [2011.10.17 16:48:24 | 000,970,016 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2011.08.08 08:39:18 | 001,166,848 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3)
SRV:64bit: - [2011.07.27 22:04:48 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2011.07.27 21:44:18 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2011.07.22 13:21:34 | 000,060,264 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe -- (LENOVO.TPKNRSVC)
SRV:64bit: - [2011.07.22 13:21:18 | 000,041,832 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe -- (LENOVO.CAMMUTE)
SRV:64bit: - [2011.06.03 13:51:38 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr)
SRV:64bit: - [2011.04.20 17:04:38 | 000,144,232 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD)
SRV:64bit: - [2011.04.04 17:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)
SRV:64bit: - [2011.03.29 20:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)
SRV:64bit: - [2011.03.29 20:15:36 | 000,047,728 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Windows\SysNative\TPHDEXLG64.exe -- (TPHDEXLGSVC)
SRV:64bit: - [2010.04.07 21:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2007.05.25 10:42:22 | 000,034,224 | ---- | M] () [Auto | Stopped] -- C:\windows\SysNative\spool\DRIVERS\x64\3\\lxddserv.exe -- (lxddCATSCustConnectService)
SRV:64bit: - [2007.05.25 10:42:12 | 000,567,216 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxddcoms.exe -- (lxdd_device)
SRV:64bit: - [2006.11.22 11:11:54 | 000,566,192 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxctcoms.exe -- (lxct_device)
SRV - [2013.06.04 18:24:53 | 000,116,632 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.28 08:45:11 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013.01.15 19:46:09 | 000,184,528 | ---- | M] (IBM Corp.) [Auto | Running] -- c:\sdwork\issimsvc.exe -- (ISSIMon)
SRV - [2012.11.07 18:27:16 | 000,511,288 | ---- | M] (IBM Corp.) [Auto | Running] -- C:\Program Files (x86)\C4ebreg\c4ebreg.exe -- (ISAMSvc)
SRV - [2012.07.21 16:05:20 | 001,588,544 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe -- (PGP RDD Service)
SRV - [2012.07.19 14:38:28 | 004,448,256 | ---- | M] (IBM) [Auto | Running] -- c:\notes\nsd.exe -- (Lotus Notes Diagnostics)
SRV - [2012.02.09 16:30:04 | 000,745,472 | ---- | M] (IBM Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\IBM\Tivoli\Remote Control\Target\trc_base.exe -- (TRCTARGET)
SRV - [2011.12.05 20:49:22 | 004,678,552 | ---- | M] (IBM Corp.) [Auto | Running] -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe -- (BESClient)
SRV - [2011.12.01 04:05:00 | 000,478,056 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE -- (DozeSvc)
SRV - [2011.12.01 04:05:00 | 000,175,168 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe -- (PwmEWSvc)
SRV - [2011.12.01 04:05:00 | 000,089,152 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)
SRV - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service)
SRV - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2011.09.16 09:31:34 | 000,189,832 | ---- | M] (IBM Corp) [Auto | Running] -- c:\notes\SUService.exe -- (LNSUSvc)
SRV - [2011.09.16 09:29:18 | 000,071,048 | ---- | M] (IBM Corp) [Auto | Running] -- c:\notes\ntmulti.exe -- (Multi-user Cleanup Service)
SRV - [2011.08.29 23:11:04 | 000,846,448 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe -- (VMUSBArbService)
SRV - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService)
SRV - [2011.04.19 17:12:22 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2011.04.14 20:22:28 | 000,263,528 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe -- (AcSvc)
SRV - [2011.04.14 20:22:26 | 000,124,264 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe -- (AcPrfMgrSvc)
SRV - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2011.03.24 22:11:32 | 000,428,912 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE -- (SNAC)
SRV - [2011.03.24 22:11:30 | 003,249,768 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)
SRV - [2011.03.24 22:11:30 | 001,839,776 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2010.09.09 19:40:38 | 000,079,200 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe -- (NetLogSvc)
SRV - [2010.09.09 19:40:24 | 000,476,000 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe -- (netcfgsvr)
SRV - [2010.09.09 19:40:02 | 000,349,536 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe -- (NetClientSvc)
SRV - [2010.09.07 22:05:51 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.18 16:19:30 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.04.29 02:00:00 | 000,436,736 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\XAudio64.dll -- (HsfXAudioService)
SRV - [2008.09.18 09:30:54 | 000,122,880 | ---- | M] () [Auto | Running] -- C:\Windows\wrtService.exe -- (WRTService)
SRV - [2007.05.25 10:42:22 | 000,034,224 | ---- | M] () [Auto | Stopped] -- C:\windows\system32\spool\DRIVERS\x64\3\\lxddserv.exe -- (lxddCATSCustConnectService)
SRV - [2007.05.25 10:41:38 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxddcoms.exe -- (lxdd_device)
SRV - [2006.11.22 11:11:36 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxctcoms.exe -- (lxct_device)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AnyDVD.sys -- (AnyDVD)
DRV:64bit: - [2013.04.04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013.03.04 14:24:27 | 000,040,344 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2012.12.11 07:22:08 | 000,042,824 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV)
DRV:64bit: - [2012.09.30 18:05:08 | 000,233,120 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wpshelper.sys -- (WpsHelper)
DRV:64bit: - [2012.09.27 07:00:40 | 000,052,320 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0)
DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.07.21 16:05:34 | 000,015,848 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\PGPwdefs.sys -- (Pgpwdefs)
DRV:64bit: - [2012.07.21 16:05:32 | 000,372,704 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\PGPwded.sys -- (PGPwded)
DRV:64bit: - [2012.07.21 16:05:30 | 000,051,856 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\PGPsdk.sys -- (PGPsdkDriver)
DRV:64bit: - [2012.07.21 16:05:22 | 000,273,848 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\windows\SysNative\drivers\PGPdisk.sys -- (PGPdisk)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.20 15:28:25 | 000,039,552 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tcpipBM.sys -- (tcpipBM)
DRV:64bit: - [2012.02.20 15:28:25 | 000,016,512 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BMLoad.sys -- (BMLoad)
DRV:64bit: - [2011.12.01 04:05:00 | 000,031,344 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\DZHDD64.SYS -- (DzHDD64)
DRV:64bit: - [2011.12.01 04:05:00 | 000,014,960 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\TPPWR64V.SYS -- (TPPWRIF)
DRV:64bit: - [2011.11.14 00:43:36 | 000,063,088 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86)
DRV:64bit: - [2011.11.14 00:42:40 | 000,032,880 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd)
DRV:64bit: - [2011.11.14 00:42:12 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV:64bit: - [2011.11.13 22:33:56 | 000,045,680 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV:64bit: - [2011.11.13 22:33:56 | 000,020,080 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV:64bit: - [2011.10.17 17:24:50 | 000,437,288 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (BTWAMPFL)
DRV:64bit: - [2011.10.17 17:24:44 | 000,164,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2011.10.17 17:24:44 | 000,146,984 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2011.10.17 17:24:44 | 000,039,976 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2011.10.17 17:24:44 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2011.10.03 23:46:40 | 001,577,088 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2011.09.26 03:40:28 | 012,309,440 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011.08.29 23:11:04 | 000,039,024 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon)
DRV:64bit: - [2011.08.29 23:01:10 | 000,037,680 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmusb.sys -- (vmusb)
DRV:64bit: - [2011.08.23 07:12:56 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2011.08.08 15:59:12 | 000,116,336 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci)
DRV:64bit: - [2011.08.08 08:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP)
DRV:64bit: - [2011.08.08 08:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL)
DRV:64bit: - [2011.08.04 16:45:24 | 000,341,680 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress)
DRV:64bit: - [2011.08.03 18:28:32 | 008,604,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64)
DRV:64bit: - [2011.05.25 18:23:00 | 000,101,888 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdxc64.sys -- (risdxc)
DRV:64bit: - [2011.04.18 16:43:30 | 000,086,528 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gt72ubus.sys -- (GT72UBUS)
DRV:64bit: - [2011.04.18 16:43:28 | 000,130,048 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Gt51Ip.sys -- (GT72NDISIPXP)
DRV:64bit: - [2011.04.18 16:43:28 | 000,010,496 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gtptser.sys -- (GTPTSER)
DRV:64bit: - [2011.04.18 16:43:26 | 000,085,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:64bit: - [2011.03.29 20:13:40 | 000,139,888 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsX64.sys -- (Shockprf)
DRV:64bit: - [2011.03.29 20:11:48 | 000,023,664 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsHM64.sys -- (TPDIGIMN)
DRV:64bit: - [2011.03.28 21:52:12 | 000,173,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2011.03.25 02:00:00 | 001,423,408 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011.03.24 22:11:36 | 000,053,808 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\WPSDRVnt.sys -- (WPS)
DRV:64bit: - [2011.03.24 22:11:34 | 000,482,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\srtspl64.sys -- (SRTSPL)
DRV:64bit: - [2011.03.24 22:11:34 | 000,449,072 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2011.03.24 22:11:34 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\srtspx64.sys -- (SRTSPX)
DRV:64bit: - [2011.03.24 22:11:32 | 000,064,048 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Teefer2.sys -- (Teefer2)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.05 02:00:00 | 000,166,016 | ---- | M] (Ricoh co.,Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\5U877.sys -- (5U877)
DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2011.02.16 19:23:46 | 000,074,240 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.10 02:00:00 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.12.10 02:00:00 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.12.02 02:00:00 | 000,101,416 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\l36wgps64.sys -- (l36wgps)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 11:57:43 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.05 02:00:00 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iastor)
DRV:64bit: - [2010.10.31 02:00:00 | 000,419,912 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Mbm3DevMt.sys -- (Mbm3DevMt)
DRV:64bit: - [2010.10.31 02:00:00 | 000,411,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Mbm3CBus.sys -- (Mbm3CBus)
DRV:64bit: - [2010.10.19 02:00:00 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.10.19 02:00:00 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2010.09.09 22:24:04 | 000,190,464 | R--- | M] (AT&T) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\agnfilt.sys -- (agnfilt)
DRV:64bit: - [2010.09.07 21:09:34 | 000,015,472 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\smiifx64.sys -- (lenovo.smi)
DRV:64bit: - [2010.09.01 15:33:12 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K3805-z_dc_enum.sys -- (vodafone_K3805-z_dc_enum)
DRV:64bit: - [2010.08.24 02:00:00 | 000,091,648 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_jucdcacm.sys -- (huawei_cdcacm)
DRV:64bit: - [2010.08.07 02:00:00 | 000,121,600 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2010.07.27 02:00:00 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:64bit: - [2010.07.27 02:00:00 | 000,029,696 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_juextctrl.sys -- (huawei_ext_ctrl)
DRV:64bit: - [2010.06.30 01:22:50 | 000,014,848 | ---- | M] (AT&T) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avpnnic.sys -- (avpnnic)
DRV:64bit: - [2010.05.04 02:00:00 | 000,022,528 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwupgrade.sys -- (huawei_update)
DRV:64bit: - [2010.03.20 02:00:00 | 000,013,952 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter)
DRV:64bit: - [2010.03.03 02:00:00 | 000,030,248 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wwussf64.sys -- (ecnssndisfltr)
DRV:64bit: - [2010.03.03 02:00:00 | 000,026,664 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wwuss64.sys -- (ecnssndis)
DRV:64bit: - [2009.10.26 02:00:00 | 000,061,952 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimspe64.sys -- (rimspci)
DRV:64bit: - [2009.09.28 02:00:00 | 000,055,808 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rixdpe64.sys -- (rixdpcie)
DRV:64bit: - [2009.09.04 02:00:00 | 000,067,072 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk)
DRV:64bit: - [2009.09.04 02:00:00 | 000,057,856 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp)
DRV:64bit: - [2009.09.04 02:00:00 | 000,054,784 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.30 02:00:00 | 001,486,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV)
DRV:64bit: - [2009.06.30 02:00:00 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf)
DRV:64bit: - [2009.06.30 02:00:00 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL)
DRV:64bit: - [2009.06.10 22:35:02 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\e1k60x64.sys -- (e1kexpress)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.11 02:00:00 | 000,118,016 | ---- | M] (Lenovo) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LenovoRd.sys -- (LenovoRd)
DRV:64bit: - [2009.04.29 02:00:00 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio)
DRV:64bit: - [2009.01.09 16:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2008.05.06 17:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:64bit: - [2007.02.19 07:56:38 | 000,027,136 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\psadd.sys -- (psadd)
DRV:64bit: - [2006.06.19 02:00:00 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk)
DRV - [2013.05.24 10:00:00 | 002,098,776 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130603.023\ex64.sys -- (NAVEX15)
DRV - [2013.05.24 10:00:00 | 000,126,040 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130603.023\eng64.sys -- (NAVENG)
DRV - [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2012.08.09 09:46:25 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2012.08.09 09:46:25 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011.03.24 22:11:34 | 000,482,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\srtspl64.sys -- (SRTSPL)
DRV - [2011.03.24 22:11:34 | 000,449,072 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysWOW64\drivers\srtsp64.sys -- (SRTSP)
DRV - [2011.03.24 22:11:34 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysWOW64\drivers\srtspx64.sys -- (SRTSPX)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2002.07.18 06:00:00 | 000,007,012 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\PMEMNT.SYS -- (PMEM)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C ED 65 D5 DD 17 CB 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = w3-501.ibm.com;<local>
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: ietab%40ip.cn:2.04.20110724.3ibm
FF - prefs.js..extensions.enabledAddons: langpack-en-US%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-fr%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-ja%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-ko%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-zh-CN%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-zh-TW%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: IBM-cck%40firefox-extensions.ibm.com:2.1.11
FF - prefs.js..extensions.enabledAddons: bpaddtonab%40firefox-extensions.ibm.com:1.1.2
FF - prefs.js..extensions.enabledAddons: %7B25A1388B-6B18-46c3-BEBA-A81915D0DE8F%7D:1.7.8.5
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.6
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@IBM.com/Java60: C:\Program Files\IBM\Java60\jre\bin\new_plugin\npjp2.dll (IBM)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@IBM.com/Java,version=1.6.0: C:\Program Files (x86)\IBM\Java60\jre\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@IBM.com/JavaPlugin: C:\Program Files (x86)\IBM\Java60\jre\bin\plugin2\npjp2.dll (IBM)
FF - HKLM\Software\MozillaPlugins\@IBM.com/WDPlugin,version=1: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@rim.com/npappworld: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll ()
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@IBM.com/WDPlugin,version=1: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\ [2012.02.20 15:27:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.04 18:24:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.04 18:24:53 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]
 
[2010.07.14 01:32:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Extensions
[2013.06.04 09:09:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions
[2013.06.04 09:09:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2013.06.04 09:09:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
[2013.06.04 09:08:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-en-US@firefox.mozilla.org
[2013.06.04 09:08:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-fr@firefox.mozilla.org
[2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-ja@firefox.mozilla.org
[2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.06.04 20:30:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions
[2013.06.04 18:36:51 | 000,000,000 | ---D | M] (IBM Add To Notes Address Book BluePages Plugin) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com
[2013.06.04 18:36:48 | 000,000,000 | ---D | M] (IBM CCK) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com
[2013.06.04 18:36:19 | 000,000,000 | ---D | M] (IE Tab + (IBM Edition)) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\ietab@ip.cn
[2013.06.04 18:36:20 | 000,000,000 | ---D | M] ("English (US) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org
[2013.06.04 18:36:21 | 000,000,000 | ---D | M] ("Français Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org
[2013.06.04 18:36:22 | 000,000,000 | ---D | M] ("Japanese Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org
[2013.06.04 18:36:23 | 000,000,000 | ---D | M] ("Korean (KR) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org
[2013.06.04 18:36:24 | 000,000,000 | ---D | M] ("Chinese Simplified (zh-CN) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 18:36:26 | 000,000,000 | ---D | M] ("Traditional Chinese (zh-TW) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.06.04 18:36:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com\defaults
[2013.06.04 18:36:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com\plugins
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\chrome
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\components
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\defaults
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\modules
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\searchplugins
[2013.06.04 18:36:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\extensions
[2013.06.04 18:36:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\extensions
[2013.06.04 18:36:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\extensions
[2013.06.04 18:36:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\extensions
[2013.06.04 18:36:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\extensions
[2013.06.04 18:36:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\extensions
[2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions
[2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.06.04 20:30:41 | 000,504,298 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}.xpi
[2013.03.28 22:01:51 | 000,002,906 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\global\xpinstall\xpinstall.properties
[2013.03.28 22:01:51 | 000,000,580 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.28 22:01:51 | 000,000,639 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 01:22:59 | 000,003,417 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\global\xpinstall\xpinstall.properties
[2013.03.29 01:22:59 | 000,000,623 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 01:22:59 | 000,000,706 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 00:24:11 | 000,004,294 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\global\xpinstall\xpinstall.properties
[2013.03.29 00:24:11 | 000,000,726 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 00:24:11 | 000,000,842 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 00:51:01 | 000,002,817 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\global\xpinstall\xpinstall.properties
[2013.03.29 00:51:01 | 000,000,642 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 00:51:01 | 000,000,642 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 02:03:55 | 000,002,927 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\global\xpinstall\xpinstall.properties
[2013.03.29 02:03:55 | 000,000,575 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 02:03:55 | 000,000,584 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 02:10:39 | 000,002,948 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\global\xpinstall\xpinstall.properties
[2013.03.29 02:10:40 | 000,000,588 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 02:10:40 | 000,000,541 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\xpinstall\xpinstallConfirm.properties
[2013.06.04 18:24:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013.06.04 18:24:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2013.06.04 18:24:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2013.06.04 18:24:44 | 000,000,000 | ---D | M] (Quick Locale Switcher) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (IBM CCK) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (IE Tab + (IBM Edition)) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\ietab@ip.cn
[2013.06.04 18:24:23 | 000,000,000 | ---D | M] ("English (US) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org
[2013.06.04 18:24:24 | 000,000,000 | ---D | M] ("Français Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-fr@firefox.mozilla.org
[2013.06.04 18:24:26 | 000,000,000 | ---D | M] ("Japanese Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ja@firefox.mozilla.org
[2013.06.04 18:24:28 | 000,000,000 | ---D | M] ("Korean (KR) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ko@firefox.mozilla.org
[2013.06.04 18:24:32 | 000,000,000 | ---D | M] ("Chinese Simplified (zh-CN) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 18:24:39 | 000,000,000 | ---D | M] ("Traditional Chinese (zh-TW) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\chrome
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\components
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\defaults
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\modules
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\searchplugins
[2013.06.04 18:24:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\extensions
[2013.06.04 18:24:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\extensions
[2013.06.04 18:24:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\extensions
[2013.06.04 18:24:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\extensions
[2013.06.04 18:24:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\extensions
[2013.06.04 18:24:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\extensions
[2013.06.04 18:24:53 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.08.02 19:01:32 | 000,122,880 | ---- | M] (IBM ) -- C:\Program Files (x86)\mozilla firefox\plugins\npcpsweb.dll
[2011.12.09 19:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2011.11.11 15:10:34 | 000,297,864 | ---- | M] (IBM ) -- C:\Program Files (x86)\mozilla firefox\plugins\npwdplugin821.dll
[2013.03.28 23:50:17 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.03.28 23:50:17 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
 
O1 HOSTS File: ([2012.03.19 00:21:52 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\IBM\Java60\jre\bin\ssv.dll (IBM)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\IBM\Java60\jre\bin\jp2ssv.dll (IBM)
O4:64bit: - HKLM..\Run: [AcWin7Hlpr] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe (Lenovo)
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe (Lexmark International Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe (Lenovo Group Limited)
O4:64bit: - HKLM..\Run: [LXCTCATS] C:\windows\SysNative\spool\DRIVERS\x64\3\LXCTtime.DLL (Lexmark International Inc.)
O4:64bit: - HKLM..\Run: [lxctmon.exe] C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe ()
O4:64bit: - HKLM..\Run: [lxddamon] C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe ()
O4:64bit: - HKLM..\Run: [lxddmon.exe] C:\Program Files (x86)\Lexmark 2500 Series\lxddmon.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [ProxyCap] C:\Program Files\Proxy Labs\ProxyCap\pcapui.exe (Proxy Labs)
O4:64bit: - HKLM..\Run: [TpShocks] C:\windows\SysNative\TpShocks.exe (Lenovo.)
O4 - HKLM..\Run: [ACSW14DE] C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (ACD Systems)
O4 - HKLM..\Run: [ACTray] C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe (Lenovo)
O4 - HKLM..\Run: [ACWLIcon] C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe (Lenovo)
O4 - HKLM..\Run: [ALTOOLS] AccessL.exe File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [C4EBReg] C:\Program Files (x86)\C4ebreg\c4ebreg.exe (IBM Corp.)
O4 - HKLM..\Run: [ccApp] C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [Isamtray] C:\Program Files (x86)\C4ebreg\isamtray.exe (IBM Corp.)
O4 - HKLM..\Run: [Lexmark 5400 Series] C:\Program Files (x86)\Lexmark 5400 Series\fm3032.exe ()
O4 - HKLM..\Run: [lxddamon] C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddamon.exe ()
O4 - HKLM..\Run: [lxddmon.exe] C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddmon.exe ()
O4 - HKLM..\Run: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
O4 - HKLM..\Run: [PWMTRV] C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [stgclean] c:\sdwork\w32maing.exe (IBM Corp.)
O4 - HKCU..\Run: [NetSP - restore settings on power failure] C:\Program Files (x86)\AT&T Network Client\NetSP.exe (AT&T)
O4 - HKCU..\Run: [SymphonyPreLoad] "C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.standard.launcher.win32.x86_3.0.1.20120110-2000\IBM Lotus Symphony" -nogui -nosplash File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Activities present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Safety present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8:64bit: - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\windows\SysNative\pcapwsp.dll (Proxy Labs)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - ppcapwsp.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\windows\SysWow64\pcapwsp.dll (Proxy Labs)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - pcapwsp.dll File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: ibm.com ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: ibm.com ([w3-03] http in Local intranet)
O15 - HKCU\..Trusted Domains: ibm.com ([w3-03] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1ACECAFE-0016-0000-0000-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp:// (Java Plug-in 1.6.0)
O16 - DPF: {8B8A0588-356B-431E-A4C3-A56553266DAA} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Smartscript.cab (Siebel SmartScript)
O16 - DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Desktop_Integration.cab (Siebel Desktop Integration)
O16 - DPF: {A6F9E1F5-780D-42F6-9644-3FC630A7AB39} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_HI_Client.cab (Siebel High Interactivity Framework)
O16 - DPF: {AD4EA0DC-8CC7-4F7B-B730-267823DCE9B7} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_OutBound_mail.cab (Siebel Email Support for Microsoft Outlook and Lotus Notes)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0169DF91-D033-43F4-A7DA-F04CD0C87DA4}: DhcpNameServer = 9.0.136.50 9.0.138.50
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: DhcpNameServer = 139.7.30.125 139.7.30.126
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: NameServer = 127.0.0.1,139.7.30.125,139.7.30.126
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: Domain = ibm.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: NameServer = 9.64.163.21,9.64.162.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D695B2A3-769C-439D-AB2D-A34914269145}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\gopher - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~1\GO36F4~1.DLL) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.04 21:33:12 | 000,000,000 | ---D | C] -- C:\windows\ERUNT
[2013.06.04 21:33:04 | 000,000,000 | ---D | C] -- C:\JRT
[2013.06.04 21:28:10 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\IBM_ADMIN\Desktop\JRT.exe
[2013.06.04 18:56:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe
[2013.06.04 18:35:32 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Desktop\Old Firefox Data-1
[2013.06.04 18:24:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.06.04 16:02:08 | 000,000,000 | ---D | C] -- C:\swd
[2013.06.04 15:59:53 | 000,000,000 | ---D | C] -- C:\sdwork
[2013.06.04 12:40:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2013.06.04 09:07:19 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Desktop\Old Firefox Data
[2013.06.03 19:09:00 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Documents\S
[2013.05.28 16:20:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Workstation Security Tool
[2013.05.28 15:41:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\C4ebreg
[2013.05.28 14:31:36 | 000,158,016 | ---- | C] (IBM) -- C:\windows\SysWow64\javaws.exe
[2013.05.28 14:31:35 | 000,149,824 | ---- | C] (IBM) -- C:\windows\SysWow64\javaw.exe
[2013.05.28 14:31:35 | 000,149,824 | ---- | C] (IBM) -- C:\windows\SysWow64\java.exe
[2013.05.28 14:31:33 | 000,084,288 | ---- | C] (IBM) -- C:\windows\SysWow64\javacplIBM60.cpl
[2013.05.28 14:09:42 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.05.26 20:20:20 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\dxgmms1.sys
[2013.05.26 20:20:19 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\cdd.dll
[2013.05.26 20:19:01 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\authui.dll
[2013.05.26 20:19:01 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\shdocvw.dll
[2013.05.26 20:18:58 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\consent.exe
[2013.05.26 20:18:57 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\authui.dll
[2013.05.26 20:18:44 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\wwanprotdim.dll
[2013.05.26 20:18:04 | 000,735,232 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\msfeeds.dll
[2013.05.26 20:17:57 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mshtmled.dll
[2013.05.26 20:17:56 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ieui.dll
[2013.05.26 20:17:55 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ieui.dll
[2013.05.26 20:17:55 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\url.dll
[2013.05.26 20:17:55 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\url.dll
[2013.05.26 20:17:55 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mshtmled.dll
[2013.05.26 18:01:24 | 038,944,576 | ---- | C] (Atomix Productions) -- C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe
[2013.05.19 13:04:48 | 000,142,424 | ---- | C] (SlySoft, Inc.) -- C:\windows\SysWow64\drivers\AnyDVD.sys
[2013.05.19 13:04:48 | 000,142,424 | ---- | C] (SlySoft, Inc.) -- C:\windows\SysNative\drivers\AnyDVD.sys
[2013.05.19 12:54:27 | 000,097,176 | ---- | C] (Elaborate Bytes AG) -- C:\windows\SysWow64\ElbyCDIO.dll
[2012.07.12 10:28:44 | 002,174,976 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Program Files (x86)\Common Files\atimpenc.dll
[8 C:\Users\IBM_ADMIN\Documents\*.tmp files -> C:\Users\IBM_ADMIN\Documents\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.04 21:32:00 | 000,016,528 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.04 21:32:00 | 000,016,528 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.04 21:29:40 | 000,783,562 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2013.06.04 21:29:40 | 000,663,252 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2013.06.04 21:29:40 | 000,122,674 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2013.06.04 21:27:49 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\IBM_ADMIN\Desktop\JRT.exe
[2013.06.04 21:23:33 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2013.06.04 21:23:10 | 2055,655,423 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.04 21:19:13 | 000,632,031 | ---- | M] () -- C:\Users\IBM_ADMIN\Desktop\adwcleaner.exe
[2013.06.04 20:23:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2013.06.04 19:33:19 | 000,377,856 | ---- | M] () -- C:\Users\IBM_ADMIN\Desktop\gmer_2.1.19163.exe
[2013.06.04 18:58:15 | 000,000,000 | ---- | M] () -- C:\Users\IBM_ADMIN\defogger_reenable
[2013.06.04 18:56:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe
[2013.06.04 18:56:34 | 000,050,477 | ---- | M] () -- C:\Users\IBM_ADMIN\Desktop\Defogger.exe
[2013.06.04 18:36:50 | 000,001,151 | ---- | M] () -- C:\Users\IBM_ADMIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013.06.04 16:01:15 | 000,000,134 | ---- | M] () -- C:\windows\issiunin.bat
[2013.06.04 16:01:13 | 000,000,590 | ---- | M] () -- C:\Users\Public\Desktop\ISSI EZUpdate.lnk
[2013.06.04 16:01:02 | 000,000,112 | ---- | M] () -- C:\Users\Public\Desktop\IBM Standard Software Installer.url
[2013.06.04 12:40:39 | 000,001,151 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.06.03 15:48:42 | 000,316,215 | ---- | M] () -- C:\Users\IBM_ADMIN\Documents\ANGEBOT 13000238.pdf
[2013.05.28 15:22:52 | 000,373,888 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2013.05.28 13:43:50 | 000,002,116 | ---- | M] () -- C:\Users\Public\Desktop\IBM Lotus Symphony.lnk
[2013.05.28 08:45:11 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerApp.exe
[2013.05.28 08:45:11 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.05.27 17:10:40 | 000,000,160 | ---- | M] () -- C:\Users\IBM_ADMIN\AppData\Roaming\default.rss
[2013.05.26 18:01:54 | 038,944,576 | ---- | M] (Atomix Productions) -- C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe
[2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) -- C:\windows\SysWow64\drivers\AnyDVD.sys
[2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) -- C:\windows\SysNative\drivers\AnyDVD.sys
[2013.05.19 12:54:27 | 000,097,176 | ---- | M] (Elaborate Bytes AG) -- C:\windows\SysWow64\ElbyCDIO.dll
[8 C:\Users\IBM_ADMIN\Documents\*.tmp files -> C:\Users\IBM_ADMIN\Documents\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.06.04 21:19:38 | 000,632,031 | ---- | C] () -- C:\Users\IBM_ADMIN\Desktop\adwcleaner.exe
[2013.06.04 19:33:19 | 000,377,856 | ---- | C] () -- C:\Users\IBM_ADMIN\Desktop\gmer_2.1.19163.exe
[2013.06.04 18:58:15 | 000,000,000 | ---- | C] () -- C:\Users\IBM_ADMIN\defogger_reenable
[2013.06.04 18:56:34 | 000,050,477 | ---- | C] () -- C:\Users\IBM_ADMIN\Desktop\Defogger.exe
[2013.06.04 16:03:55 | 000,001,151 | ---- | C] () -- C:\Users\IBM_ADMIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013.06.04 12:40:39 | 000,001,163 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.06.04 12:40:39 | 000,001,151 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.06.03 15:48:41 | 000,316,215 | ---- | C] () -- C:\Users\IBM_ADMIN\Documents\ANGEBOT 13000238.pdf
[2013.05.31 15:08:46 | 000,002,601 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ProxyCap.lnk
[2013.05.28 08:45:11 | 000,000,830 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2013.05.01 17:08:02 | 000,331,776 | ---- | C] ( ) -- C:\windows\SysWow64\sbcrreag.dll
[2012.12.27 13:35:03 | 000,000,000 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\downloads.m3u
[2012.12.04 22:39:57 | 000,413,696 | ---- | C] ( ) -- C:\windows\SysWow64\lxddinpa.dll
[2012.12.04 22:39:57 | 000,397,312 | ---- | C] ( ) -- C:\windows\SysWow64\lxddiesc.dll
[2012.12.04 22:39:57 | 000,385,024 | ---- | C] () -- C:\windows\SysWow64\lxddcomx.dll
[2012.12.04 22:39:57 | 000,286,720 | ---- | C] () -- C:\windows\SysWow64\LXDDinst.dll
[2012.12.04 22:39:56 | 001,232,896 | ---- | C] ( ) -- C:\windows\SysWow64\lxddserv.dll
[2012.12.04 22:39:56 | 000,999,424 | ---- | C] ( ) -- C:\windows\SysWow64\lxddusb1.dll
[2012.12.04 22:39:56 | 000,643,072 | ---- | C] ( ) -- C:\windows\SysWow64\lxddpmui.dll
[2012.12.04 22:39:56 | 000,163,840 | ---- | C] ( ) -- C:\windows\SysWow64\lxddprox.dll
[2012.12.04 22:39:55 | 000,700,416 | ---- | C] ( ) -- C:\windows\SysWow64\lxddhbn3.dll
[2012.12.04 22:39:55 | 000,684,032 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcomc.dll
[2012.12.04 22:39:55 | 000,585,728 | ---- | C] ( ) -- C:\windows\SysWow64\lxddlmpm.dll
[2012.12.04 22:39:55 | 000,537,520 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcoms.exe
[2012.12.04 22:39:55 | 000,425,984 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcomm.dll
[2012.12.04 22:39:55 | 000,394,160 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcfg.exe
[2012.12.04 22:39:55 | 000,385,968 | ---- | C] ( ) -- C:\windows\SysWow64\lxddih.exe
[2012.12.04 22:39:55 | 000,181,168 | ---- | C] ( ) -- C:\windows\SysWow64\lxddppls.exe
[2012.12.04 22:39:55 | 000,094,208 | ---- | C] ( ) -- C:\windows\SysWow64\lxddpplc.dll
[2012.11.20 15:57:53 | 000,059,487 | ---- | C] () -- C:\Users\IBM_ADMIN\install.xml
[2012.10.17 18:37:16 | 000,000,600 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\PUTTY.RND
[2012.10.09 15:35:25 | 000,000,600 | ---- | C] () -- C:\Users\IBM_ADMIN\PUTTY.RND
[2012.07.21 16:07:34 | 000,000,280 | ---- | C] () -- C:\windows\SysWow64\PGPsdk.dll.sig
[2012.06.01 13:36:53 | 000,001,057 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\vso_ts_preview.xml
[2012.04.05 10:20:35 | 000,007,600 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\Resmon.ResmonCfg
[2012.03.20 16:11:35 | 000,000,632 | RHS- | C] () -- C:\Users\IBM_ADMIN\ntuser.pol
[2012.03.18 21:24:10 | 000,000,460 | ---- | C] () -- C:\windows\win_bak.ini
[2012.03.01 14:22:44 | 000,000,160 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\default.rss
[2012.02.21 14:50:01 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.02.20 17:06:15 | 000,005,120 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.20 12:08:51 | 000,122,880 | ---- | C] () -- C:\windows\wrtService.exe
[2012.02.20 12:08:51 | 000,000,156 | ---- | C] () -- C:\windows\SysWow64\wrtservice.ini
[2012.02.18 20:15:49 | 000,274,432 | ---- | C] () -- C:\windows\SysWow64\LXCTinst.dll
[2012.02.18 20:15:48 | 000,413,696 | ---- | C] ( ) -- C:\windows\SysWow64\lxctinpa.dll
[2012.02.18 20:15:48 | 000,397,312 | ---- | C] ( ) -- C:\windows\SysWow64\lxctiesc.dll
[2012.02.18 20:15:46 | 000,643,072 | ---- | C] ( ) -- C:\windows\SysWow64\lxctpmui.dll
[2012.02.18 20:15:44 | 000,991,232 | ---- | C] ( ) -- C:\windows\SysWow64\lxctusb1.dll
[2012.02.18 20:15:43 | 001,224,704 | ---- | C] ( ) -- C:\windows\SysWow64\lxctserv.dll
[2012.02.18 20:15:42 | 000,163,840 | ---- | C] ( ) -- C:\windows\SysWow64\lxctprox.dll
[2012.02.18 20:15:41 | 000,585,728 | ---- | C] ( ) -- C:\windows\SysWow64\lxctlmpm.dll
[2012.02.18 20:15:41 | 000,181,168 | ---- | C] ( ) -- C:\windows\SysWow64\lxctppls.exe
[2012.02.18 20:15:41 | 000,094,208 | ---- | C] ( ) -- C:\windows\SysWow64\lxctpplc.dll
[2012.02.18 20:15:40 | 000,696,320 | ---- | C] ( ) -- C:\windows\SysWow64\lxcthbn3.dll
[2012.02.18 20:15:40 | 000,385,968 | ---- | C] ( ) -- C:\windows\SysWow64\lxctih.exe
[2012.02.18 20:15:39 | 000,537,520 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcoms.exe
[2012.02.18 20:15:39 | 000,421,888 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcomm.dll
[2012.02.18 20:15:38 | 000,684,032 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcomc.dll
[2012.02.18 20:15:37 | 000,381,872 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcfg.exe
[2012.02.18 14:08:24 | 000,004,767 | ---- | C] () -- C:\windows\Irremote.ini
[2012.02.18 10:27:46 | 000,204,800 | ---- | C] () -- C:\windows\SysWow64\IVIresizeW7.dll
[2012.02.18 10:27:46 | 000,200,704 | ---- | C] () -- C:\windows\SysWow64\IVIresizeA6.dll
[2012.02.18 10:27:46 | 000,192,512 | ---- | C] () -- C:\windows\SysWow64\IVIresizeP6.dll
[2012.02.18 10:27:46 | 000,192,512 | ---- | C] () -- C:\windows\SysWow64\IVIresizeM6.dll
[2012.02.18 10:27:46 | 000,188,416 | ---- | C] () -- C:\windows\SysWow64\IVIresizePX.dll
[2012.02.18 10:27:46 | 000,020,480 | ---- | C] () -- C:\windows\SysWow64\IVIresize.dll
[2012.02.18 10:25:57 | 000,831,600 | ---- | C] () -- C:\windows\SysWow64\Ctaa1.dat
[2012.02.18 10:25:52 | 000,122,880 | ---- | C] () -- C:\windows\SysWow64\cddvdint.dll
[2012.02.15 17:47:03 | 000,000,376 | ---- | C] () -- C:\windows\ODBC.INI
[2012.02.15 16:21:38 | 000,216,000 | ---- | C] () -- C:\windows\SysWow64\igfcg600m.bin
[2012.02.15 16:21:37 | 000,056,832 | ---- | C] () -- C:\windows\SysWow64\igdde32.dll
[2012.02.15 16:21:35 | 013,903,360 | ---- | C] () -- C:\windows\SysWow64\ig4icd32.dll
[2012.02.15 16:20:56 | 000,777,778 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2011.12.09 22:41:04 | 000,000,033 | ---- | C] () -- C:\windows\Uninst.ini
[2011.12.09 22:35:14 | 000,039,424 | ---- | C] () -- C:\windows\SysWow64\pdresrc.dll
[2011.12.09 22:35:07 | 000,786,432 | ---- | C] () -- C:\windows\SysWow64\pdclntif.dll
[2011.12.09 22:35:07 | 000,270,336 | ---- | C] () -- C:\windows\SysWow64\pdprDlg.dll
[2011.12.09 22:35:07 | 000,208,896 | ---- | C] () -- C:\windows\SysWow64\selpms.dll
[2011.12.09 22:35:07 | 000,106,496 | ---- | C] () -- C:\windows\SysWow64\IBMMenu.dll
[2011.12.09 22:35:07 | 000,086,016 | ---- | C] () -- C:\windows\SysWow64\selpmcui.dll
[2011.12.09 14:24:23 | 000,066,856 | ---- | C] () -- C:\windows\SysWow64\SynTPEnhPS.dll
[2011.12.09 14:23:48 | 000,963,116 | ---- | C] () -- C:\windows\SysWow64\igkrng600.bin
[2011.12.09 14:23:46 | 000,145,804 | ---- | C] () -- C:\windows\SysWow64\igcompkrng600.bin
[2011.04.18 16:39:56 | 000,226,364 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
[2010.07.03 01:50:13 | 000,000,566 | RHS- | C] () -- C:\ProgramData\ntuser.pol
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 76 bytes -> C:\Users\IBM_ADMIN\Documents\Liste 2.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\IBM_ADMIN\Documents\checkliste travel.xls:Roxio EMC Stream

< End of report >
         
--- --- ---

Hallo,

siehe bitte meine letzte Antwort mit den logs. Bitte weiterhin um support. Nach den bisherigen Aktionen stürzt FFox erneut wieder ab nach Neustart heute morgen.

Bitte auch um Info ob und wann ich Defogger wieder re-enablen soll. Danke
__________________

Geändert von schrauber (05.06.2013 um 14:52 Uhr)

Alt 05.06.2013, 08:04   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Hi,

Defogger erst ganz am Schluss wieder aktivieren.


Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32bit oder FRST 64bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Scan.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 05.06.2013, 08:08   #5
mailmeback
 
Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Hallo,

danke. Mache ich gleich, ich habe Malwarebytes Vollversion, soll ich es trotzdem machen ?


Alt 05.06.2013, 08:16   #6
mailmeback
 
Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



bekomme beim Start von rootkit folg. Meldung im Anhang, was tun ?
Miniaturansicht angehängter Grafiken
-rootkit-message.jpg  

Alt 05.06.2013, 08:22   #7
schrauber
/// the machine
/// TB-Ausbilder
 

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Klick Yes
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 05.06.2013, 08:37   #8
mailmeback
 
Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Hallo,

hier bitte alles wie gefordert, Rootkit kam mit folg. Meldungen:

"Scan finished, no malware found!"
"The system volume seems inaccessable or encrypted. Scan can not continue" (habe PGP Encription laufen ?)

Bitte um rasche Hilfe. Danke !!!

P.S. habe noch meinen Namen in den logs von 21:56 gestern abend gefunden, wie kann ich das editieren?

********************

Code:
ATTFilter
Malwarebytes Anti-Rootkit BETA 1.06.0.1003
www.malwarebytes.org

Database version: v2013.06.05.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
xxxxxx :: IBM-IF34NF70CTV [administrator]

05.06.2013 09:19:33
mbar-log-2013-06-05 (09-19-33).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: Deep Anti-Rootkit Scan | PUP
Objects scanned: 0
Time elapsed: 10 second(s) [aborted]

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-06-2013
Ran by xxxxxx at 2013-06-05 09:24:42 Run:
Running from C:\Users\IBM_ADMIN\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

"Nero SoundTrax Help (Version: 4.4.32.0)
7-Zip 9.20
ABBYY FineReader 6.0 Sprint (Version: 6.00.1784.41616)
ACDSee 14 (Version: 14.2.156)
ACDSee Photo Manager 12 (Version: 12.0.344)
Adobe AIR (Version: 3.3.0.3650)
Adobe Flash Player 11 ActiveX (Version: 11.7.700.202)
Adobe Flash Player 11 Plugin (Version: 11.7.700.202)
Adobe Reader X (10.1.7) (Version: 10.1.7)
Advertising Center (Version: 0.0.0.2)
Amazon Kindle
AnyDVD (Version: 7.2.0.0)
Apple Application Support (Version: 2.3)
Apple Software Update (Version: 2.1.3.127)
AT&T Network Client – IBM (Version: 8.2.0.3003)
BlackBerry App World Browser Plugin (Version: 3.1.4.38)
BlackBerry Desktop Software 6.1 (Version: 6.1.0.35)
calibre (Version: 0.9.17)
CCleaner (Version: 3.16)
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
Conexant 20672 SmartAudio HD (Version: 8.32.23.2)
ConvertXtoDVD 4.1.19.365 (Version: 4.1.19.365)
Creative DVD Audio Plugin for Audigy Series
CVE-2012-4792
DolbyFiles (Version: 2.0)
DVD Shrink 3.2
FaxRedist (Version: 1.0.0)
Free M4a to MP3 Converter 7.0
Free Studio version 5.9.0.1212 (Version: 5.9.0.1212)
GMX SMS-Manager (Version: 2.6.3)
Google Desktop (Version: 5.9.0906.04286)
IBM 32-bit Runtime Environment for Java v6 (Version: 6)
IBM 64-bit Runtime Environment for Java v6 (Version: 6)
IBM Ayúdame Utility (Version: 1.5.3.0046)
IBM Gateway Migration Plugin 1.0.0 (Version: 1.0.0.201108081212)
IBM Lotus Sametime Advanced Embedded 8.5.1 (Version: 8.5.1.20110610-1701)
IBM Lotus Sametime Connect 8.5.1 (Version: 8.51.10219)
IBM Lotus Symphony (Version: 3.01.12011)
IBM My Help (Version: 1.7.8)
IBM SSH Tunnel
IBM Standard Asset Manager
IBM Standard Software Installer
IBM Tivoli Remote Control Ayúdame Premium Edition - Target (Version: 8.2.0.0104)
IBM Tivoli Storage Manager Client (Version: 05.05.0212)
ImagXpress (Version: 7.0.74.0)
InfoPrint Select (Version: 4.3.0)
Intel PROSet Wireless
Intel(R) Control Center (Version: 1.2.1.1007)
Intel(R) Network Connections Drivers (Version: 16.4)
Intel(R) Processor Graphics (Version: 8.15.10.2538)
Intel(R) PROSet/Wireless WiFi-Software (Version: 14.2.0000)
InterVideo WinDVD 7 (Version: 7.0-B27.49)
Java Auto Updater (Version: 2.0.7.1)
Java(TM) 6 Update 31 (64-bit) (Version: 6.0.310)
Java(TM) 6 Update 31 (Version: 6.0.310)
Jawbone Updater (Version: 0.1)
JDownloader 0.9 (Version: 0.9)
Lenovo Auto Scroll Utility (Version: 1.00)
Lenovo Patch Utility (Version: 1.00.0000)
Lenovo Patch Utility 64 bit (Version: 1.20.0001)
Lenovo Power Management Driver (Version: 1.66.00.22)
Lenovo System Interface Driver (Version: 1.05)
Lexmark 2500 Series
Lexmark 5400 Series
LiveUpdate 3.3 (Symantec Corporation) (Version: 3.3.0.99)
Lotus Notes 8.5.1 (Version: 8.51.9271)
Lotus Notes 8.5.3 (Version: 8.53.11258)
LotusLive Meetings for IBM
LotusLive Meetings for IBM (Version: 8.2.1)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Menu Templates - Pack 1 (Version: 9.4.6.0)
Menu Templates - Pack 2 (Version: 9.4.6.0)
Menu Templates - Pack 3 (Version: 9.4.6.0)
Menu Templates - Starter Kit (Version: 9.4.6.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Office 2003 Proofing Tools (Version: 11.0.8173.0)
Microsoft Office Excel Viewer 2003 (Version: 11.0.8173.0)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6612.1000)
Microsoft Office Standard Edition 2003 (Version: 11.0.8173.0)
Microsoft Office Word Viewer 2003 (Version: 11.0.8173.0)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
MIView
Movie Templates - Pack 1 (Version: 9.4.6.0)
Movie Templates - Starter Kit (Version: 9.4.6.0)
Mozilla Firefox 17.0.6 (x86 en-US) (Version: 17.0.6)
Mozilla Maintenance Service (Version: 17.0.6)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Nero 9
Nero Burning ROM Help (Version: 9.4.17.100)
Nero BurnRights (Version: 3.4.11.100)
Nero BurnRights Help (Version: 3.4.4.100)
Nero ControlCenter (Version: 9.0.0.1)
Nero CoverDesigner (Version: 4.4.9.100)
Nero CoverDesigner Help (Version: 4.4.9.100)
Nero Disc Copy Gadget (Version: 2.4.22.0)
Nero Disc Copy Gadget Help (Version: 2.4.22.0)
Nero DiscSpeed (Version: 5.4.12.100)
Nero DiscSpeed Help (Version: 5.4.4.100)
Nero DriveSpeed (Version: 4.4.11.100)
Nero DriveSpeed Help (Version: 4.4.4.100)
Nero Express Help (Version: 9.4.17.100)
Nero InfoTool (Version: 6.4.11.100)
Nero InfoTool Help (Version: 6.4.4.100)
Nero Installer (Version: 4.4.9.0)
Nero Live (Version: 1.4.48.0)
Nero Live Help (Version: 1.4.48.0)
Nero PhotoSnap (Version: 1.53.2.0)
Nero PhotoSnap Help (Version: 1.53.2.0)
Nero Recode (Version: 4.4.31.0)
Nero Recode Help (Version: 4.4.31.0)
Nero Rescue Agent (Version: 2.4.12.100)
Nero RescueAgent Help (Version: 2.4.4.100)
Nero ShowTime (Version: 5.4.0.100)
Nero ShowTime (Version: 5.4.14.100)
Nero StartSmart (Version: 9.4.12.100)
Nero StartSmart Help (Version: 9.4.12.100)
Nero Vision (Version: 6.4.10.205)
Nero Vision Help (Version: 6.4.8.100)
Nero WaveEditor (Version: 5.4.32.0)
NeroBurningROM (Version: 9.4.17.100)
NeroExpress (Version: 9.4.17.100)
NeroLiveGadget (Version: 1.2.16.100)
NeroLiveGadget Help (Version: 1.2.16.100)
neroxml (Version: 1.0.0)
On Screen Display (Version: 6.42.00)
OpenSSH_3.7.1p2
Paint Shop Pro 7 (Version: 7.0.0.0000)
PDFCreator (Version: 1.2.3)
PGP Desktop (Version: 10.2.1.4869)
Phase 5 HTML-Editor (Version: 5.6.2.3)
ProxyCap (Version: 5.2.50)
QuickTime (Version: 7.73.80.64)
RICOH_Media_Driver_v2.14.18.01 (Version: 2.14.18.01)
SoundTrax (Version: 4.4.32.0)
SpeedFan (remove only)
Symantec Endpoint Protection (Version: 11.0.6200.754)
Synaptics Pointing Device Driver (Version: 15.2.19.0)
System Update (Version: 4.01.0015)
ThinkPad Bluetooth with Enhanced Data Rate Software (Version: 6.4.0.2900)
ThinkPad Energie-Manager (Version: 3.65)
ThinkPad FullScreen Magnifier (Version: 2.30)
ThinkPad Modem Adapter (Version: 7.80.5.0)
ThinkPad UltraNav Utility (Version: 2.13.0)
ThinkVantage Access Connections (Version: 5.83)
ThinkVantage Active Protection System (Version: 1.75)
ThinkVantage Communications Utility (Version: 2.08)
Tivoli Endpoint Manager Client (Version: 8.2.1093.0)
tools-linux (Version: 8.8.1.528992)
tools-windows (Version: 8.8.1.528992)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
VirtualCloneDrive
VmciSockets (Version: 9.1.54.1)
VMware Player (Version: 4.0.1.27038)
Vodafone Mobile Broadband (Version: 10.2.103.31248)
Vuze (Version: 4.7)
Winamp (Version: 5.623 )
Winamp Erkennungs-Plug-in (Version: 1.0.0.1)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
WinRAR 4.10 (64-Bit) (Version: 4.10.0)
WinZip 15.0 (Version: 15.0.9411)
Workstation Security Tool 2.5
Xilisoft MKV Converter (Version: 7.5.0.20120822)

==================== Restore Points  =========================

03-06-2013 10:23:02 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============

Name: AGN Virtual Network Adapter
Description: AGN Virtual Network Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: AT&T
Service: avpnnic
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (06/05/2013 08:17:18 AM) (Source: Service Control Manager) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Spooler service.

Error: (06/05/2013 08:16:29 AM) (Source: Service Control Manager) (User: )
Description: The PMEM service failed to start due to the following error: 
%%1275

Error: (06/05/2013 08:16:29 AM) (Source: Application Popup) (User: )
Description: \??\C:\Windows\SysWow64\drivers\PMEMNT.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (06/05/2013 08:16:26 AM) (Source: Service Control Manager) (User: )
Description: The lxddCATSCustConnectService service failed to start due to the following error: 
%%1053

Error: (06/05/2013 08:16:26 AM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the lxddCATSCustConnectService service to connect.

Error: (06/05/2013 00:44:39 AM) (Source: DCOM) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (06/04/2013 11:45:01 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 71%
Total physical RAM: 8075.23 MB
Available physical RAM: 2276.26 MB
Total Pagefile: 16148.65 MB
Available Pagefile: 10086.23 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:298.09 GB) (Free:67.44 GB) NTFS (Disk=0 Partition=1) ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 7A7FF5FC)
Partition 1: (Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-06-2013
Ran by xxxxxx (administrator) on 05-06-2013 09:24:10
Running from C:\Users\IBM_ADMIN\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Lenovo.) C:\windows\system32\ibmpmsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe
(Symantec Corporation) C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SmcGui.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(IBM Corp.) C:\Program Files (x86)\C4ebreg\c4ebreg.exe
(IBM Corp.) c:\sdwork\issimsvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
(Lenovo Group Limited) C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
(IBM Corp) c:\notes\SUService.exe
(IBM) c:\notes\nsd.exe
( ) C:\windows\system32\lxctcoms.exe
( ) C:\windows\system32\lxddcoms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(IBM Corp) c:\notes\ntmulti.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(AT&T) C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe
(AT&T) C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe
(AT&T) C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe
(Proxy Labs) C:\Program Files\Proxy Labs\ProxyCap\pcapsvc.exe
(Symantec Corporation) C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe
(Microsoft Corporation) C:\windows\system32\UI0Detect.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe
(VMware, Inc.) C:\windows\SysWOW64\vmnat.exe
() C:\windows\wrtService.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
(VMware, Inc.) C:\windows\SysWOW64\vmnetdhcp.exe
(Intel Corporation) C:\windows\system32\igfxext.exe
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
() C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe
(Lexmark International Inc.) C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe
(Proxy Labs) C:\Program Files\Proxy Labs\ProxyCap\pcapui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Symantec Corporation) C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe
(Google) C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(IBM) C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\symphony.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Lenovo Group Limited) C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
(ACD Systems) C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe
(Symantec Corporation) C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(IBM Corp.) C:\Program Files (x86)\C4ebreg\isamtray.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe
(Symantec Corporation) C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPcbt64.exe
(IBM Corp.) C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
(IBM Corp.) C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe
(IBM) C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.brand.win32_3.0.1.20120110-2000\program\soffice.bin
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\System Update\SUService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE
(IBM Corp) C:\notes\NLNOTES.EXE
(IBM) C:\notes\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\notes2.exe
(IBM Corporation) C:\Program Files\Tivoli\TSM\baclient\dsmc.exe
(IBM Corp) C:\notes\ntaskldr.EXE
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmplayer.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-unity-helper.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\x64\vmware-vmx.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vprintproxy.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\windows\splwow64.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_7_700_202_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\windows\system32\prevhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\prevhost.exe
(Jasc Software, Inc.) C:\Program Files (x86)\Jasc Software Inc\Paint Shop Pro 7\Psp.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] TpShocks.exe [380776 2011-03-29] (Lenovo.)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2731304 2011-03-25] (Synaptics Incorporated)
HKLM\...\Run: [AcWin7Hlpr] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [31592 2011-04-14] (Lenovo)
HKLM\...\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [42344 2011-07-22] (Lenovo Group Limited)
HKLM\...\Run: [lxctmon.exe] "C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe" [291760 2006-11-22] ()
HKLM\...\Run: [EzPrint] "C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe" [82864 2006-11-22] (Lexmark International Inc.)
HKLM\...\Run: [LXCTCATS] rundll32 C:\windows\system32\spool\DRIVERS\x64\3\LXCTtime.dll,RunDLLEntry [31744 2006-11-21] (Lexmark International Inc.)
HKLM\...\Run: [ProxyCap] C:\PROGRA~1\PROXYL~1\ProxyCap\pcapui.exe [2597888 2013-05-01] (Proxy Labs)
HKLM\...\Run: [lxddmon.exe] "C:\Program Files (x86)\Lexmark 2500 Series\lxddmon.exe" [291496 2009-04-27] ()
HKLM\...\Run: [lxddamon] "C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe" [25256 2009-04-27] ()
HKCU\...\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [NetSP - restore settings on power failure] "C:\Program Files (x86)\AT&T Network Client\NetSP.exe" -show [53600 2010-09-09] (AT&T)
HKCU\...\Run: [SymphonyPreLoad] "C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.standard.launcher.win32.x86_3.0.1.20120110-2000\IBM Lotus Symphony" -nogui -nosplash [x]
HKLM-x32\...\Run: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe" [115560 2011-03-24] (Symantec Corporation)
HKLM-x32\...\Run: [ALTOOLS] AccessL.exe [x]
HKLM-x32\...\Run: [ACWLIcon] C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe [193896 2011-04-14] (Lenovo)
HKLM-x32\...\Run: [ACTray] C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe [431464 2011-04-14] (Lenovo)
HKLM-x32\...\Run: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor [1631808 2011-12-01] (Lenovo Group Limited)
HKLM-x32\...\Run: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup [30192 2012-02-17] (Google)
HKLM-x32\...\Run: [Lexmark 5400 Series] "C:\Program Files (x86)\Lexmark 5400 Series\fm3032.exe" /s [304048 2006-11-22] ()
HKLM-x32\...\Run: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe /silent [408576 2011-04-19] (Vodafone)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [79192 2011-02-18] (Research In Motion Limited)
HKLM-x32\...\Run: [lxddmon.exe] "C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddmon.exe" [291496 2009-04-27] ()
HKLM-x32\...\Run: [lxddamon] "C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddamon.exe" [25256 2009-04-27] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [ACSW14DE] "C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe" /pid ACSW14DE [1231472 2011-11-17] (ACD Systems)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [stgclean] c:\sdwork\w32maing.exe /cleanup [292352 2013-01-15] (IBM Corp.)
HKLM-x32\...\Run: [C4EBReg] "C:\Program Files (x86)\C4ebreg\c4ebreg.exe" /q [511288 2012-11-07] (IBM Corp.)
HKLM-x32\...\Run: [Isamtray] "C:\Program Files (x86)\C4ebreg\isamtray.exe" [326968 2012-11-07] (IBM Corp.)
HKU\Standard User\...\Policies\system: [LogonHoursAction] 2
HKU\Standard User\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Lsa: [Notification Packages] scecli ACGina PGPpwflt
Startup: C:\ProgramData\Start Menu\Programs\Startup\AT&T Global Network Client Monitor.lnk
ShortcutTarget: AT&T Global Network Client Monitor.lnk -> C:\windows\Installer\{007AAB7C-E893-48BD-9DA2-7F417CA16322}\NetGM1_89563E53ECF44E868145468A128BDC83.exe (Acresso Software Inc.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\PGP Tray.lnk
ShortcutTarget: PGP Tray.lnk -> C:\windows\Installer\{806D3984-9484-470A-BC63-3B7F65488B58}\Icon6560581611.exe ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\TSM SCHEDULE.BAT.lnk
ShortcutTarget: TSM SCHEDULE.BAT.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\IBM\Java60\jre\bin\ssv.dll (IBM)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\IBM\Java60\jre\bin\jp2ssv.dll (IBM)
PDF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
PDF: HKLM-x32 {1ACECAFE-0016-0000-0000-ABCDEFFEDCBA} hxxp://
PDF: HKLM-x32 {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://
PDF: HKLM-x32 {8B8A0588-356B-431E-A4C3-A56553266DAA} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Smartscript.cab
PDF: HKLM-x32 {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Desktop_Integration.cab
PDF: HKLM-x32 {A6F9E1F5-780D-42F6-9644-3FC630A7AB39} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_HI_Client.cab
PDF: HKLM-x32 {AD4EA0DC-8CC7-4F7B-B730-267823DCE9B7} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_OutBound_mail.cab
PDF: HKLM-x32 {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://
PDF: HKLM-x32 {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} -  No File
Handler: msdaipp - No CLSID Value - 
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\windows\syswow64\urlmon.dll (Microsoft Corporation)
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler-x32: msdaipp - No CLSID Value - 
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Winsock: Catalog5 08 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9 01 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9 02 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9 03 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9 04 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9 15 %SystemRoot%\system32\vsocklib.dll [63088] (VMware, Inc.)
Winsock: Catalog9 16 %SystemRoot%\system32\vsocklib.dll [63088] (VMware, Inc.)
Winsock: Catalog9 18 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog5-x64 08 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9-x64 01 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9-x64 02 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9-x64 03 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9-x64 04 pcapwsp.dll File Not found (Proxy Labs)
Winsock: Catalog9-x64 15 %SystemRoot%\system32\vsocklib.dll [67184] (VMware, Inc.)
Winsock: Catalog9-x64 16 %SystemRoot%\system32\vsocklib.dll [67184] (VMware, Inc.)
Winsock: Catalog9-x64 18 pcapwsp.dll File Not found (Proxy Labs)
Tcpip\..\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: [NameServer]127.0.0.1,139.7.30.125,139.7.30.126
Tcpip\..\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: [NameServer]9.64.163.21,9.64.162.21

FireFox:
========
FF ProfilePath: C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @IBM.com/Java60 - C:\Program Files\IBM\Java60\jre\bin\new_plugin\npjp2.dll (IBM)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @IBM.com/Java,version=1.6.0 - C:\Program Files (x86)\IBM\Java60\jre\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @IBM.com/JavaPlugin - C:\Program Files (x86)\IBM\Java60\jre\bin\plugin2\npjp2.dll (IBM)
FF Plugin-x32: @IBM.com/WDPlugin,version=1 - C:\Program Files (x86)\Mozilla Firefox\plugins ()
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @rim.com/npappworld - C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll ()
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\langpack-en-US@firefox.mozilla.org
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\langpack-fr@firefox.mozilla.org
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\langpack-ja@firefox.mozilla.org
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\langpack-zh-CN@firefox.mozilla.org
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\langpack-zh-TW@firefox.mozilla.org
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
FF Extension: No Name - C:\Users\IBM_ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\2ziq4yrx.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}

==================== Services (Whitelisted) =================

R2 BESClient; C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe [4678552 2011-12-05] (IBM Corp.)
R2 ccEvtMgr; C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe [108392 2011-03-24] (Symantec Corporation)
R2 ccSetMgr; C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe [108392 2011-03-24] (Symantec Corporation)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [478056 2011-12-01] (Lenovo.)
S3 GoogleDesktopManager-060409-093314; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2012-02-17] (Google)
R2 ISAMSvc; C:\Program Files (x86)\C4ebreg\c4ebreg.exe [511288 2012-11-07] (IBM Corp.)
R2 ISSIMon; c:\sdwork\issimsvc.exe [184528 2013-01-15] (IBM Corp.)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [93032 2010-04-07] (Lenovo Group Limited)
S3 LiveUpdate; C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE [3093880 2010-09-07] (Symantec Corporation)
R2 LNSUSvc; c:\notes\SUService.exe [189832 2011-09-16] (IBM Corp)
R2 Lotus Notes Diagnostics; c:\notes\notes.ini [10965 2013-06-05] ()
R2 lxct_device; C:\windows\system32\lxctcoms.exe [566192 2006-11-22] ( )
R2 lxdd_device; C:\windows\system32\lxddcoms.exe [567216 2007-05-25] ( )
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 Multi-user Cleanup Service; c:\notes\ntmulti.exe [71048 2011-09-16] (IBM Corp)
R2 netcfgsvr; C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe [476000 2010-09-09] (AT&T)
R2 NetClientSvc; C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe [349536 2010-09-09] (AT&T)
R2 NetLogSvc; C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe [79200 2010-09-09] (AT&T)
R2 pcapsvc; C:\Program Files\Proxy Labs\ProxyCap\pcapsvc.exe [2280960 2013-05-01] (Proxy Labs)
R2 PGP RDD Service; C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe [1588544 2012-07-21] (Symantec Corporation)
R2 SmcService; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe [3249768 2011-03-24] (Symantec Corporation)
S4 SNAC; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE [428912 2011-03-24] (Symantec Corporation)
R2 Symantec AntiVirus; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe [1839776 2011-03-24] (Symantec Corporation)
S3 TRCTARGET; C:\Program Files (x86)\IBM\Tivoli\Remote Control\Target\trc_base.exe [745472 2012-02-09] (IBM Corporation)
R2 WRTService; C:\windows\wrtService.exe [122880 2008-09-18] ()

==================== Drivers (Whitelisted) ====================

R1 agnfilt; C:\Windows\System32\DRIVERS\agnfilt.sys [190464 2010-09-09] (AT&T)
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [142424 2013-05-19] (SlySoft, Inc.)
S3 avpnnic; C:\Windows\System32\DRIVERS\avpnnic.sys [14848 2010-06-30] (AT&T)
R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2012-02-20] (Bytemobile, Inc.)
S3 e1kexpress; C:\Windows\System32\DRIVERS\e1k60x64.sys [220672 2009-06-10] (Intel Corporation)
S3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [26664 2010-03-03] (Ericsson AB)
S3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [30248 2010-03-03] (Ericsson AB)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-08-09] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-08-09] (Symantec Corporation)
S3 GT72NDISIPXP; C:\Windows\System32\DRIVERS\Gt51Ip.sys [130048 2011-04-18] (Option N.V.)
S3 GT72UBUS; C:\Windows\System32\DRIVERS\gt72ubus.sys [86528 2011-04-18] (Option N.V.)
S3 GTPTSER; C:\Windows\System32\DRIVERS\gtptser.sys [10496 2011-04-18] (Option N.V.)
S3 huawei_update; C:\Windows\system32\drivers\ew_hwupgrade.sys [22528 2010-05-04] (Huawei Technologies Co., Ltd.)
S3 l36wgps; C:\Windows\system32\drivers\l36wgps64.sys [101416 2010-12-02] (Ericsson AB)
R3 LenovoRd; C:\Windows\System32\Drivers\LenovoRd.sys [118016 2009-05-11] (Lenovo)
R3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [52320 2012-09-27] (hxxp://libusb-win32.sourceforge.net)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 Mbm3CBus; C:\Windows\system32\drivers\Mbm3CBus.sys [411208 2010-10-31] (MCCI Corporation)
S3 Mbm3DevMt; C:\Windows\system32\drivers\Mbm3DevMt.sys [419912 2010-10-31] (MCCI Corporation)
R3 NAVENG; C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20130603.023\ENG64.SYS [126040 2013-05-24] (Symantec Corporation)
R3 NAVEX15; C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20130603.023\EX64.SYS [2098776 2013-05-24] (Symantec Corporation)
R0 Pgpwdefs; C:\Windows\System32\DRIVERS\Pgpwdefs.sys [15848 2012-07-21] (Symantec Corporation)
S2 PMEM; C:\Windows\SysWow64\drivers\PMEMNT.SYS [7012 2002-07-18] (Microsoft Corporation)
R3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [74240 2011-02-16] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 speedfan; C:\Windows\SysWow64\speedfan.sys [14104 2007-02-07] (Windows (R) Server 2003 DDK provider)
R1 SRTSP; C:\Windows\SysWow64\Drivers\SRTSP64.SYS [449072 2011-03-24] (Symantec Corporation)
S3 SRTSPL; C:\Windows\SysWow64\Drivers\SRTSPL64.SYS [482352 2011-03-24] (Symantec Corporation)
R1 SRTSPX; C:\Windows\SysWow64\Drivers\SRTSPX64.SYS [32304 2011-03-24] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [173616 2011-03-28] (Symantec Corporation)
R1 tcpipBM; C:\windows\system32\drivers\tcpipBM.sys [39552 2012-02-20] (Bytemobile, Inc.)
R3 Teefer2; C:\Windows\System32\DRIVERS\teefer2.sys [64048 2011-03-24] (Symantec Corporation)
R1 WPS; C:\Windows\system32\drivers\wpsdrvnt.sys [53808 2011-03-24] (Symantec Corporation)
R3 WpsHelper; C:\Windows\system32\drivers\WpsHelper.sys [233120 2012-09-30] (Symantec Corporation)
R1 ElbyCDIO; System32\Drivers\ElbyCDIO.sys [x]
R1 PGPsdkDriver; System32\Drivers\PGPsdk.sys [x]
R1 TPPWRIF; System32\drivers\Tppwr64v.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-05 09:24 - 2013-06-05 09:24 - 00000000 ____D C:\FRST
2013-06-05 09:22 - 2013-06-05 09:22 - 01916712 ____A (Farbar) C:\Users\IBM_ADMIN\Desktop\FRST64.exe
2013-06-05 09:19 - 2013-06-05 09:19 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-06-05 09:09 - 2013-06-05 09:21 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\mbar
2013-06-05 09:09 - 2013-06-05 09:09 - 13169742 ____A C:\Users\IBM_ADMIN\Desktop\mbar-1.06.0.1003.zip
2013-06-05 08:21 - 2013-06-05 08:21 - 00000000 ____D C:\Users\IBM_ADMIN\AppData\Roaming\smkits
2013-06-04 21:36 - 2013-06-04 21:36 - 00000687 ____A C:\Users\IBM_ADMIN\Desktop\JRT.txt
2013-06-04 21:33 - 2013-06-04 21:33 - 00000000 ____D C:\Windows\ERUNT
2013-06-04 21:33 - 2013-06-04 21:33 - 00000000 ____D C:\JRT
2013-06-04 21:28 - 2013-06-04 21:27 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\IBM_ADMIN\Desktop\JRT.exe
2013-06-04 21:27 - 2013-06-04 21:27 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\IBM_ADMIN\Downloads\JRT.exe
2013-06-04 21:21 - 2013-06-04 21:21 - 00004764 ____A C:\AdwCleaner[S1].txt
2013-06-04 21:19 - 2013-06-04 21:19 - 00632031 ____A C:\Users\IBM_ADMIN\Downloads\adwcleaner.exe
2013-06-04 21:19 - 2013-06-04 21:19 - 00632031 ____A C:\Users\IBM_ADMIN\Desktop\adwcleaner.exe
2013-06-04 20:13 - 2013-06-05 08:16 - 00000224 ____A C:\Windows\setupact.log
2013-06-04 20:13 - 2013-06-04 20:13 - 00002912 ____A C:\Windows\PFRO.log
2013-06-04 20:13 - 2013-06-04 20:13 - 00000000 ____A C:\Windows\setuperr.log
2013-06-04 19:33 - 2013-06-04 19:33 - 00377856 ____A C:\Users\IBM_ADMIN\Desktop\gmer_2.1.19163.exe
2013-06-04 19:18 - 2013-06-04 21:50 - 00221256 ____A C:\Users\IBM_ADMIN\Desktop\OTL.Txt
2013-06-04 18:58 - 2013-06-04 20:24 - 00000488 ____A C:\Users\IBM_ADMIN\Desktop\defogger_disable.log
2013-06-04 18:58 - 2013-06-04 18:58 - 00000000 ____A C:\Users\IBM_ADMIN\defogger_reenable
2013-06-04 18:56 - 2013-06-04 18:56 - 00602112 ____A (OldTimer Tools) C:\Users\IBM_ADMIN\Desktop\OTL.exe
2013-06-04 18:56 - 2013-06-04 18:56 - 00050477 ____A C:\Users\IBM_ADMIN\Desktop\Defogger.exe
2013-06-04 18:35 - 2013-06-04 18:36 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\Old Firefox Data-1
2013-06-04 18:24 - 2013-06-04 18:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-04 16:02 - 2013-06-04 16:02 - 00000000 ____D C:\swd
2013-06-04 15:59 - 2013-06-04 16:03 - 00000000 ____D C:\sdwork
2013-06-04 15:58 - 2013-06-04 15:58 - 01687248 ____A (IBM Corp.) C:\Users\IBM_ADMIN\Downloads\ospw32(1).exe
2013-06-04 15:56 - 2013-06-04 15:56 - 01687248 ____A (IBM Corp.) C:\Users\IBM_ADMIN\Downloads\ospw32.exe
2013-06-04 12:40 - 2013-06-04 20:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-04 12:40 - 2013-06-04 12:40 - 00001151 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-04 09:07 - 2013-06-04 09:08 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\Old Firefox Data
2013-06-03 19:09 - 2013-06-05 08:20 - 00000000 ___AD C:\Users\IBM_ADMIN\Documents\S
2013-06-02 12:42 - 2013-06-02 12:42 - 00414016 ____A C:\ProgramData\SPL1631.tmp
2013-05-28 15:41 - 2013-06-04 14:23 - 00000000 ____D C:\Program Files (x86)\C4ebreg
2013-05-28 14:31 - 2013-03-04 07:49 - 00158016 ____A (IBM) C:\Windows\SysWOW64\javaws.exe
2013-05-28 14:31 - 2013-03-04 07:49 - 00149824 ____A (IBM) C:\Windows\SysWOW64\javaw.exe
2013-05-28 14:31 - 2013-03-04 07:49 - 00084288 ____A (IBM) C:\Windows\SysWOW64\javacplIBM60.cpl
2013-05-28 14:31 - 2013-03-04 07:48 - 00149824 ____A (IBM) C:\Windows\SysWOW64\java.exe
2013-05-28 08:45 - 2013-06-05 09:23 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-05-26 20:20 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-26 20:20 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-26 20:20 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-26 20:19 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-26 20:19 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-26 20:19 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-26 20:18 - 2013-05-06 15:39 - 09060352 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-26 20:18 - 2013-05-06 15:04 - 06033408 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-26 20:18 - 2013-04-10 07:51 - 01492992 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-26 20:18 - 2013-04-10 07:51 - 01188864 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-26 20:18 - 2013-04-10 07:47 - 00735232 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-26 20:18 - 2013-04-10 07:46 - 12294656 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-26 20:18 - 2013-04-10 07:46 - 02458112 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-26 20:18 - 2013-04-10 07:08 - 00981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-26 20:18 - 2013-04-10 07:07 - 01231872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-26 20:18 - 2013-04-10 07:03 - 00627712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-26 20:18 - 2013-04-10 07:02 - 11020800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-26 20:18 - 2013-04-10 07:02 - 02078208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-26 20:18 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-26 20:18 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-26 20:18 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-26 20:18 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-26 20:18 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-05-26 20:18 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-05-26 20:18 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-05-26 20:18 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-05-26 20:17 - 2013-04-10 07:51 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-26 20:17 - 2013-04-10 07:47 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-26 20:17 - 2013-04-10 07:46 - 00247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-26 20:17 - 2013-04-10 07:46 - 00064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-26 20:17 - 2013-04-10 07:07 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-26 20:17 - 2013-04-10 07:03 - 00067584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-26 20:17 - 2013-04-10 07:03 - 00048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-26 20:17 - 2013-04-10 07:02 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-26 18:01 - 2013-05-26 18:01 - 38944576 ____A (Atomix Productions) C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe
2013-05-19 13:04 - 2013-05-19 13:04 - 00142424 ____A (SlySoft, Inc.) C:\Windows\SysWOW64\Drivers\AnyDVD.sys
2013-05-19 13:04 - 2013-05-19 13:04 - 00142424 ____A (SlySoft, Inc.) C:\Windows\System32\Drivers\AnyDVD.sys
2013-05-19 12:54 - 2013-05-19 12:54 - 00097176 ____A (Elaborate Bytes AG) C:\Windows\SysWOW64\ElbyCDIO.dll
2013-05-06 15:00 - 2013-05-06 15:00 - 00414016 ____A C:\ProgramData\SPL10DE.tmp

==================== One Month Modified Files and Folders =======

2013-06-05 09:24 - 2013-06-05 09:24 - 00000000 ____D C:\FRST
2013-06-05 09:23 - 2013-05-28 08:45 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-05 09:22 - 2013-06-05 09:22 - 01916712 ____A (Farbar) C:\Users\IBM_ADMIN\Desktop\FRST64.exe
2013-06-05 09:21 - 2013-06-05 09:09 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\mbar
2013-06-05 09:21 - 2012-02-16 09:57 - 00000000 ____D C:\ProgramData\VMware
2013-06-05 09:19 - 2013-06-05 09:19 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-06-05 09:09 - 2013-06-05 09:09 - 13169742 ____A C:\Users\IBM_ADMIN\Desktop\mbar-1.06.0.1003.zip
2013-06-05 09:03 - 2009-07-14 07:13 - 00783562 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-05 08:54 - 2012-02-22 15:38 - 02917376 ____A C:\Users\IBM_ADMIN\Documents\Liste.xls
2013-06-05 08:30 - 2012-02-16 16:24 - 00000000 ____D C:\Users\IBM_ADMIN\AppData\Roaming\VMware
2013-06-05 08:30 - 2012-02-16 16:24 - 00000000 ____D C:\Users\IBM_ADMIN\AppData\Local\VMware
2013-06-05 08:26 - 2012-02-22 16:35 - 00000000 ____D C:\adsm.sys
2013-06-05 08:24 - 2009-07-14 06:45 - 00016528 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-05 08:24 - 2009-07-14 06:45 - 00016528 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-05 08:21 - 2013-06-05 08:21 - 00000000 ____D C:\Users\IBM_ADMIN\AppData\Roaming\smkits
2013-06-05 08:20 - 2013-06-03 19:09 - 00000000 ___AD C:\Users\IBM_ADMIN\Documents\S
2013-06-05 08:20 - 2012-10-17 17:44 - 01855072 ____A C:\Windows\WindowsUpdate.log
2013-06-05 08:17 - 2012-03-06 15:33 - 00074776 ____A C:\Users\IBM_ADMIN\seditor.launcher.log
2013-06-05 08:16 - 2013-06-04 20:13 - 00000224 ____A C:\Windows\setupact.log
2013-06-05 08:16 - 2012-11-20 15:59 - 00018194 ____A C:\SUService.log
2013-06-05 08:16 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-04 21:50 - 2013-06-04 19:18 - 00221256 ____A C:\Users\IBM_ADMIN\Desktop\OTL.Txt
2013-06-04 21:36 - 2013-06-04 21:36 - 00000687 ____A C:\Users\IBM_ADMIN\Desktop\JRT.txt
2013-06-04 21:33 - 2013-06-04 21:33 - 00000000 ____D C:\Windows\ERUNT
2013-06-04 21:33 - 2013-06-04 21:33 - 00000000 ____D C:\JRT
2013-06-04 21:27 - 2013-06-04 21:28 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\IBM_ADMIN\Desktop\JRT.exe
2013-06-04 21:27 - 2013-06-04 21:27 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\IBM_ADMIN\Downloads\JRT.exe
2013-06-04 21:21 - 2013-06-04 21:21 - 00004764 ____A C:\AdwCleaner[S1].txt
2013-06-04 21:19 - 2013-06-04 21:19 - 00632031 ____A C:\Users\IBM_ADMIN\Downloads\adwcleaner.exe
2013-06-04 21:19 - 2013-06-04 21:19 - 00632031 ____A C:\Users\IBM_ADMIN\Desktop\adwcleaner.exe
2013-06-04 20:24 - 2013-06-04 18:58 - 00000488 ____A C:\Users\IBM_ADMIN\Desktop\defogger_disable.log
2013-06-04 20:13 - 2013-06-04 20:13 - 00002912 ____A C:\Windows\PFRO.log
2013-06-04 20:13 - 2013-06-04 20:13 - 00000000 ____A C:\Windows\setuperr.log
2013-06-04 20:13 - 2013-06-04 12:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-04 19:33 - 2013-06-04 19:33 - 00377856 ____A C:\Users\IBM_ADMIN\Desktop\gmer_2.1.19163.exe
2013-06-04 18:58 - 2013-06-04 18:58 - 00000000 ____A C:\Users\IBM_ADMIN\defogger_reenable
2013-06-04 18:58 - 2010-06-29 06:27 - 00000000 ____D C:\users\IBM_ADMIN
2013-06-04 18:56 - 2013-06-04 18:56 - 00602112 ____A (OldTimer Tools) C:\Users\IBM_ADMIN\Desktop\OTL.exe
2013-06-04 18:56 - 2013-06-04 18:56 - 00050477 ____A C:\Users\IBM_ADMIN\Desktop\Defogger.exe
2013-06-04 18:36 - 2013-06-04 18:35 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\Old Firefox Data-1
2013-06-04 18:24 - 2013-06-04 18:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-04 16:03 - 2013-06-04 15:59 - 00000000 ____D C:\sdwork
2013-06-04 16:02 - 2013-06-04 16:02 - 00000000 ____D C:\swd
2013-06-04 16:01 - 2011-07-18 10:01 - 00000590 ____A C:\Users\Public\Desktop\ISSI EZUpdate.lnk
2013-06-04 16:01 - 2011-07-18 10:01 - 00000112 ____A C:\Users\Public\Desktop\IBM Standard Software Installer.url
2013-06-04 16:01 - 2010-11-12 03:40 - 00000134 ____A C:\Windows\issiunin.bat
2013-06-04 15:58 - 2013-06-04 15:58 - 01687248 ____A (IBM Corp.) C:\Users\IBM_ADMIN\Downloads\ospw32(1).exe
2013-06-04 15:56 - 2013-06-04 15:56 - 01687248 ____A (IBM Corp.) C:\Users\IBM_ADMIN\Downloads\ospw32.exe
2013-06-04 15:44 - 2010-11-12 03:35 - 00000000 ____D C:\sdwork old
2013-06-04 14:23 - 2013-05-28 15:41 - 00000000 ____D C:\Program Files (x86)\C4ebreg
2013-06-04 14:11 - 2010-11-12 03:08 - 00000000 ____D C:\Program Files (x86)\WST
2013-06-04 13:47 - 2011-12-09 20:45 - 00000000 ____D C:\swd old
2013-06-04 12:40 - 2013-06-04 12:40 - 00001151 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-04 09:08 - 2013-06-04 09:07 - 00000000 ____D C:\Users\IBM_ADMIN\Desktop\Old Firefox Data
2013-06-02 12:42 - 2013-06-02 12:42 - 00414016 ____A C:\ProgramData\SPL1631.tmp
2013-05-31 19:34 - 2012-02-22 15:38 - 00033792 ____A C:\Users\IBM_ADMIN\Documents\checkliste travel.xls
2013-05-31 16:10 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-05-31 15:42 - 2012-02-22 15:38 - 00044032 ____A C:\Users\IBM_ADMIN\Documents\GT CM Outlook Plan 2013.xls
2013-05-31 15:20 - 2012-02-18 17:27 - 00000000 ____D C:\Users\IBM_ADMIN\AppData\Roaming\Winamp
2013-05-31 01:41 - 2012-12-13 15:16 - 00000000 ____D C:\linuxshared
2013-05-28 15:41 - 2010-07-14 01:12 - 00000000 ____D C:\ProgramData\IGS
2013-05-28 15:22 - 2009-07-14 06:45 - 00373888 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-28 14:31 - 2010-07-01 01:55 - 00098208 ____A C:\Users\IBM_ADMIN\AppData\Local\GDIPFONTCACHEV1.DAT
2013-05-28 14:30 - 2010-07-14 01:55 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-05-28 14:27 - 2010-07-14 01:58 - 00000000 ____D C:\Program Files (x86)\IBM
2013-05-28 13:43 - 2012-11-16 13:33 - 00002116 ____A C:\Users\Public\Desktop\IBM Lotus Symphony.lnk
2013-05-28 08:45 - 2012-04-05 10:28 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-05-28 08:45 - 2011-12-09 22:34 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-27 17:10 - 2012-03-01 14:22 - 00000160 ____A C:\Users\IBM_ADMIN\AppData\Roaming\default.rss
2013-05-27 11:17 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-05-26 20:31 - 2010-06-29 20:41 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-26 20:07 - 2012-02-18 20:26 - 00000000 ____D C:\Program Files\Lx_cats
2013-05-26 18:01 - 2013-05-26 18:01 - 38944576 ____A (Atomix Productions) C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe
2013-05-26 15:03 - 2012-02-20 13:55 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-05-19 13:04 - 2013-05-19 13:04 - 00142424 ____A (SlySoft, Inc.) C:\Windows\SysWOW64\Drivers\AnyDVD.sys
2013-05-19 13:04 - 2013-05-19 13:04 - 00142424 ____A (SlySoft, Inc.) C:\Windows\System32\Drivers\AnyDVD.sys
2013-05-19 12:54 - 2013-05-19 12:54 - 00097176 ____A (Elaborate Bytes AG) C:\Windows\SysWOW64\ElbyCDIO.dll
2013-05-07 22:51 - 2013-02-23 09:48 - 01247839 ____A C:\lxct.log
2013-05-06 15:39 - 2013-05-26 20:18 - 09060352 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-06 15:04 - 2013-05-26 20:18 - 06033408 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-06 15:00 - 2013-05-06 15:00 - 00414016 ____A C:\ProgramData\SPL10DE.tmp

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


Last Boot: 2013-06-03 12:16

==================== End Of Log ============================
         
Habe noch meinen Namen in der Message von gestern 21:56, wie kann ich es editieren oder hiden, oder kannst Du es bitte machen ?

Alt 05.06.2013, 10:05   #9
schrauber
/// the machine
/// TB-Ausbilder
 

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Wo genau steht der Name?

Ist das ein Firmenrechner? Hast du die Proxys und IP's eingetragen?

Firefox hast Du nach AdwCleaner schon wieder versucht? Auch im Safe Mode?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 05.06.2013, 11:04   #10
mailmeback
 
Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Name ist Rainer usw., steht in AdwareCleaner header und junkware log oben.

Ist Firmenrechner, habe keine Proxys IPs eingetragen. Habe noch Java cleanup gemacht mit support hier und auch im safe mode stürzte der Ffox genau bei aufrufen dieses Link aus der mail wieder ab...

pls. help (wenn malware/virus-relevant), danke

Alt 05.06.2013, 12:39   #11
schrauber
/// the machine
/// TB-Ausbilder
 

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Firmenrechner:

dürfen hier nicht behandelt werden, wenn es um eine Firma mit eigenen IT-Leuten oder Abteilung geht.

Wenn Das ne kleine oder eigene Firma ist kein Problem.

Ich muss es nur wissen, nicht dass ich hier irgendwelche Proxy-Einstellungen kille die (ohne dein Wissen) wichtig sind.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 05.06.2013, 12:55   #12
mailmeback
 
Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Hallo,

korrekt. Ist größere Firma mit eig. IT-Abteilung. Gibt sicher Proxy-Einstellungen die relevant sind und nicht gekillt werden dürfen. Habe jetzt auch einen klaren Verdächtigen der auch bei einem Kollegen zum gleichen Problem geführt. ProxyCap für ein tunneling, macht statische IPs die sich wohl mit den dynamischen IPs hier nicht vertragen.

Ich teste das gerade und wenn das sich bestätigt, dann melde ich mich zum erfolgreichen zumachen des threats wenn nötig ? Kann ich den defogger wieder anschalten jetzt ?

War denn bei den Aktionen mit Dir bislang überhaupt irgendetwas auffälliges dabei ? Kannst Du noch bitte den Namen, siehe letzte Nachricht, deleted, kann das ja von hier nicht ?

Danke

Alt 05.06.2013, 14:53   #13
schrauber
/// the machine
/// TB-Ausbilder
 

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Defogger kann wieder an, war bissl Adware drauf, aber nichts schlimmes.

Namen ist editiert .
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 05.06.2013, 15:36   #14
mailmeback
 
Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



danke !

dann können wir das hier schließen erstmal, Test bislang 100% positiv.

Lob ist raus, Spende kommt.

Gruss
R

Alt 05.06.2013, 16:28   #15
schrauber
/// the machine
/// TB-Ausbilder
 

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Standard

Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?



Alles klar, danke

Dann entfernen wir noch unsre tools:

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?
antivirus, avp, bho, browser, checkliste, converter, diagnostics, email, error, firefox, firefox abstürze malware ?, flash player, format, geld, google, home, hängt, intranet, logfile, malware, mp3, outbound, programm, prozess, pwmtr64v.dll, refresh, registry, remote control, sierra, software, starten, symantec, usb, window 7, windows, wrapper



Ähnliche Themen: Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?


  1. T-Online Mailkonto seit einigen Tagen ständig SPAM Mail an mein Adressbuch u.a
    Log-Analyse und Auswertung - 24.08.2015 (9)
  2. Mozilla Firefox stürzt ständig ab
    Plagegeister aller Art und deren Bekämpfung - 16.07.2015 (11)
  3. Internetverbindung seit 7 Tagen verschlechtert. Verdacht auf Virus.
    Log-Analyse und Auswertung - 18.09.2014 (19)
  4. Firefox stürzt ständig ab
    Plagegeister aller Art und deren Bekämpfung - 30.05.2014 (23)
  5. Firefox stürzt ständig ab/System voll mit Malware
    Plagegeister aller Art und deren Bekämpfung - 28.04.2014 (21)
  6. Pc stürzt seit Tagen dauernd ab.
    Plagegeister aller Art und deren Bekämpfung - 14.02.2014 (13)
  7. Firefox stürzt ständig ab !
    Plagegeister aller Art und deren Bekämpfung - 22.11.2013 (13)
  8. PC ist seit wenigen Tagen langsamer und arbeitet ständig
    Log-Analyse und Auswertung - 19.09.2013 (9)
  9. Mozilla öffnet ständig selbst neue Seiten, seit paar Tagen >> PC langsam
    Plagegeister aller Art und deren Bekämpfung - 16.06.2013 (36)
  10. Laptop seit Tagen Extrem Langsam geworden IE , Firefox .
    Log-Analyse und Auswertung - 29.01.2013 (22)
  11. CPU Auslastung seit 3 Tagen ständig auf 100% und alles laggt !
    Log-Analyse und Auswertung - 08.11.2011 (15)
  12. ebay - Seitenladefehler - Bekomme seit ca. 7 Tagen ständig Timeout
    Log-Analyse und Auswertung - 22.07.2011 (14)
  13. Ständig Werbefenster seit ein paar Tagen
    Plagegeister aller Art und deren Bekämpfung - 19.12.2009 (16)
  14. Firefox stürzt ständig ab
    Log-Analyse und Auswertung - 15.10.2009 (2)
  15. Seit heute ständig werbung bei Firefox und IE8
    Log-Analyse und Auswertung - 14.10.2009 (6)
  16. IE stürzt ab Malware verdacht hir is meine Log datein
    Log-Analyse und Auswertung - 26.09.2008 (1)
  17. Seit 2 Tagen ständig Probleme mit gmx Accounts
    Überwachung, Datenschutz und Spam - 30.05.2006 (2)

Zum Thema Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? - Hallo, ich hoffe Ihr könnte mir helfen. Wenn ja und dauerhaft ohne kompletten systemreset werde ich einen 2-3stelligen Betrag an Euch spenden da (verlorene) Zeit Geld ist. Nach dem ich - Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?...
Archiv
Du betrachtest: Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.