OTL.exe mit diversen Funden - konfuse Situation
Was ist los?
McAffee hatte einen Fund in einer ca. 622 MB großen Zip-Datei auf der DVD PC-Praxis 12/11 gemeldet. Diese habe ich nicht genutzt, weil dies alles Programme für eine Stick sind. Auf Grund der Rechercheergebnisse habe ich die SVCHOST bei VirusTotal (VT) checken lassen. Ein Fund des Win32.TrojanHorse von einem der Virenscanner. Bei Chip habe ich Nachgefragt unter dem Titel: McAffee findet W32/YahLover.worm. Leider erhalte ich seit ca. 2 Tagen keine Antwort mehr, obwohl der "Bearbeiter" aktiv ist. Deshalb habe ich mich dort aus dem Thread abgemeldet und stelle mein Problem hier vor.
Habe weiter nach Lösungen und Informationen gesucht und deshalb auch Programme wie Netmeter oder whireshark installiert. Leider komme ich damit kaum, bis gar nicht zu recht.
Aktuelle Schwierigkeiten:
McAffee Echtzeit-Scan lässt sich nicht einschalten. Manueller - Scan lässt sich zwar anschalten, zeigt aber keine untersuchte Datei, auch die Prozentanzeige verändert sich nicht. Malwarbites, Adaware finden mit den Standardeinstellungen nichts. Gestern ging Windows-Defender nicht. Nun liefert der Schnelldurchlauf keinen Fund.
Firefox leitet alle, auch google, Seiten auf eine Seite mit chinesischem (?) Schriftsatz um. In der OTL.exe und der SVCHOST.exe werden durch VT diese Funde angezeigt:
SVCHOST.EXE
eSafe 7.0.17.0 2011.12.11 Win32.TrojanHorse
MD5 : 54a47f6b5e09a77e61649109c6a08866
SHA1 : 4af001b3c3816b860660cf2de2c0fd3c1dfb4878
SHA256: 121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2
OTL.exe
Antiy-AVL 2.0.3.7 2011.12.12 Trojan/win32.agent.gen
ByteHero 1.0.0.1 2011.12.07 Trojan.Win32.Heur.087
ClamAV 0.97.3.0 2011.12.12 PUA.Packed.PECompact-1
eSafe 7.0.17.0 2011.12.11 Suspicious File
Jiangmin 13.0.900 2011.12.12 Trojan/Swisyn.see
MD5 : 3270cb86f79b3e23720bafc2e48be3be
SHA1 : 590bf47c71b26cd01d70b34c567c75f9613341ac
SHA256: 851a1822872f6c47711ff5377f46d3063c4ac94422fb83d38226b8d080f7a044
Defogger.exe lief nicht durch. Lt. TaskManager war der Prozeß ohne Aktivität.Nach ca. 30 min. ohne Aktivität habe ich das System manuell rebeootet. Der Log sieht so aus:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:06 on 12/12/2011 (Ghost)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
OTL - eine Extra.txt wurde nicht erstellt.
OTL.txt
OTL Logfile: Code:
OTL logfile created on: 12.12.2011 21:09:05 - Run 6
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Ghost\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,98 Gb Total Physical Memory | 6,00 Gb Available Physical Memory | 75,26% Memory free
15,95 Gb Paging File | 13,68 Gb Available in Paging File | 85,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,69 Gb Total Space | 37,70 Gb Free Space | 33,76% Space Free | Partition Type: NTFS
Drive D: | 224,61 Gb Total Space | 206,68 Gb Free Space | 92,02% Space Free | Partition Type: NTFS
Drive E: | 241,15 Gb Total Space | 190,42 Gb Free Space | 78,96% Space Free | Partition Type: NTFS
Drive G: | 465,64 Gb Total Space | 381,59 Gb Free Space | 81,95% Space Free | Partition Type: FAT32
Computer Name: GHOST-PC | User Name: Ghost | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011.12.12 16:47:13 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Ghost\Desktop\OTL.exe
PRC - [2011.11.03 19:25:09 | 002,358,656 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2011.10.28 19:35:26 | 002,152,152 | ---- | M] (Lavasoft Limited) -- D:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2011.10.28 19:35:26 | 001,187,072 | ---- | M] (Lavasoft Limited) -- D:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.04.29 23:32:54 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.04.29 23:32:50 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.12.07 15:32:24 | 001,097,344 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe
PRC - [2010.12.02 09:37:22 | 001,425,536 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
PRC - [2010.12.02 03:15:14 | 000,915,584 | R--- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
PRC - [2010.11.26 20:50:04 | 002,931,328 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
PRC - [2010.11.17 02:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2010.11.16 09:38:22 | 000,654,464 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\pnSvc.exe
PRC - [2010.11.10 10:23:44 | 001,204,656 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
PRC - [2010.11.09 09:34:26 | 002,529,920 | R--- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\EC Simulator.exe
PRC - [2010.11.03 10:30:14 | 000,918,144 | R--- | M] () -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
PRC - [2010.10.21 10:52:26 | 000,586,880 | R--- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
PRC - [2010.10.12 15:39:50 | 001,115,776 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ VRM\VRMHelp.exe
PRC - [2010.09.28 14:47:10 | 000,252,544 | R--- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsShellProcess.exe
PRC - [2010.09.24 20:29:32 | 001,115,776 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
PRC - [2010.06.30 15:46:32 | 000,121,456 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
PRC - [2010.06.30 15:46:30 | 001,264,240 | ---- | M] (Portrait Displays, Inc) -- C:\Program Files (x86)\Acer Display\eDisplay Management\DTHtml.exe
PRC - [2010.06.30 15:46:08 | 000,129,648 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe
PRC - [2010.05.13 15:34:48 | 000,711,792 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe
PRC - [2010.05.13 15:34:42 | 000,674,928 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe
PRC - [2010.04.16 14:34:34 | 000,109,168 | ---- | M] (Portrait Displays, Inc.) -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
PRC - [2010.02.23 10:01:28 | 000,329,168 | ---- | M] () -- C:\Program Files (x86)\Verbindungsassistent\WTGService.exe
PRC - [2010.01.15 13:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2010.01.08 13:15:24 | 001,118,208 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Program Files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtWlan.exe
PRC - [2009.12.07 12:49:24 | 000,040,960 | ---- | M] (Realtek) -- C:\Program Files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe
PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- D:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- D:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2009.01.16 11:12:28 | 000,221,184 | ---- | M] () -- C:\Windows\system\cm106eye.exe
========== Modules (No Company Name) ==========
MOD - [2011.10.29 14:29:11 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b2622080e047040fa044dd21a04ff10d\System.Runtime.Remoting.ni.dll
MOD - [2011.10.29 14:29:11 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\33cecc66284ef59208b639ec72b0f565\IAStorCommon.ni.dll
MOD - [2011.10.29 14:29:10 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsBase.ni.dll
MOD - [2011.10.29 14:29:09 | 000,492,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\e8339b699235ebf2f904ccb8383de342\IAStorUtil.ni.dll
MOD - [2011.10.29 14:29:08 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll
MOD - [2011.10.29 14:29:04 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll
MOD - [2011.10.29 14:28:50 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll
MOD - [2011.10.29 14:28:48 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll
MOD - [2011.10.29 14:28:48 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll
MOD - [2011.10.29 14:28:44 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2011.04.12 08:43:06 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.12.03 15:12:48 | 001,027,072 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Probe_II\ProbeII.dll
MOD - [2010.12.02 16:28:36 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\AssistFunc.dll
MOD - [2010.12.01 11:33:32 | 001,244,672 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\MyLogo\MyLogo.dll
MOD - [2010.11.19 09:55:00 | 001,246,208 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Settings\Settings.dll
MOD - [2010.11.19 09:53:34 | 000,963,584 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\BarGadget.dll
MOD - [2010.11.16 09:37:20 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\AsNetlib.dll
MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.11 02:09:26 | 000,703,488 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\CpuFreq.dll
MOD - [2010.10.15 16:40:30 | 001,031,680 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Update\Update.dll
MOD - [2010.09.27 19:51:16 | 001,607,168 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll
MOD - [2010.09.27 19:51:12 | 000,881,664 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\Sensor.dll
MOD - [2010.09.19 20:52:50 | 000,094,208 | ---- | M] () -- C:\Windows\SysWOW64\IccLibDll.dll
MOD - [2010.08.23 03:17:40 | 000,662,016 | R--- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMLib.dll
MOD - [2010.08.06 17:13:48 | 000,886,272 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\TabGadget.dll
MOD - [2010.08.06 17:11:20 | 000,850,944 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Splitter\Splitter.dll
MOD - [2010.07.30 10:28:32 | 000,670,208 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\asacpiEx.dll
MOD - [2010.07.15 19:04:40 | 000,661,504 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\aaHMLib.dll
MOD - [2010.07.15 19:04:40 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\pngio.dll
MOD - [2010.07.15 19:04:40 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\ImageHelper.dll
MOD - [2010.06.30 15:46:26 | 000,084,592 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\CC\gui.dll
MOD - [2010.06.30 15:37:38 | 000,172,032 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Shared\PresetsCOM.dll
MOD - [2010.06.23 04:54:36 | 000,114,688 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AssistFunc.dll
MOD - [2010.06.21 14:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\ImageHelper.dll
MOD - [2010.06.21 14:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ImageHelper.dll
MOD - [2010.05.13 15:34:48 | 000,711,792 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe
MOD - [2010.05.13 15:34:42 | 000,674,928 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe
MOD - [2010.02.24 09:56:40 | 000,661,504 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\aaHMLib.dll
MOD - [2009.08.12 19:15:52 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\pngio.dll
MOD - [2009.05.21 09:14:14 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\pngio.dll
MOD - [2009.05.21 03:14:14 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\HookKey32.dll
MOD - [2009.01.16 11:12:28 | 000,221,184 | ---- | M] () -- C:\Windows\system\cm106eye.exe
MOD - [2007.10.31 10:51:00 | 000,061,440 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsMultiLang.dll
MOD - [2006.09.13 06:08:00 | 000,491,520 | ---- | M] () -- C:\Windows\system\cmau106.dll
========== Win32 Services (SafeList) ==========
SRV:64bit: - [2011.10.26 03:00:58 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2011.10.18 17:01:08 | 000,502,032 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV:64bit: - [2011.10.18 14:32:28 | 000,161,168 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Windows\SysNative\mfevtps.exe -- (mfevtp)
SRV:64bit: - [2011.10.18 14:23:24 | 000,208,536 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV:64bit: - [2011.10.18 14:23:06 | 000,199,272 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McProxy)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV - [2011.12.08 18:39:32 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.11.03 19:25:09 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2011.10.28 19:35:26 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto | Running] -- D:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.06.08 12:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.04.29 23:32:54 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2011.03.21 16:19:16 | 001,845,248 | ---- | M] (Locktime Software) [Auto | Running] -- D:\Program Files\NetLimiter 3\nlsvc.exe -- (nlsvc)
SRV - [2010.12.02 03:15:14 | 000,915,584 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe -- (asHmComSvc)
SRV - [2010.11.03 10:30:14 | 000,918,144 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe -- (asComSvc)
SRV - [2010.10.27 15:18:52 | 000,052,896 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe -- (AtherosSvc)
SRV - [2010.10.21 10:52:26 | 000,586,880 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2010.06.30 15:46:32 | 000,121,456 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe -- (DTSRVC)
SRV - [2010.06.30 15:46:08 | 000,129,648 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe -- (Asset Management Daemon)
SRV - [2010.06.25 18:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2010.04.16 14:34:34 | 000,109,168 | ---- | M] (Portrait Displays, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe -- (PdiService)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.23 10:01:28 | 000,329,168 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Verbindungsassistent\WTGService.exe -- (WTGService)
SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.12.07 12:49:24 | 000,040,960 | ---- | M] (Realtek) [Auto | Running] -- C:\Program Files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe -- (Realtek87B)
SRV - [2009.07.13 18:15:38 | 000,093,848 | ---- | M] (SiSoftware) [On_Demand | Stopped] -- d:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP4\RpcAgentSrv.exe -- (SandraAgentSrv)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- D:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2011.12.06 11:40:33 | 000,230,864 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2011.10.28 19:35:28 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
DRV:64bit: - [2011.10.26 04:05:10 | 010,496,512 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.10.26 02:21:58 | 000,326,656 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.10.15 13:16:16 | 000,647,080 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)
DRV:64bit: - [2011.10.15 13:16:16 | 000,481,768 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek)
DRV:64bit: - [2011.10.15 13:16:16 | 000,284,648 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk)
DRV:64bit: - [2011.10.15 13:16:16 | 000,229,528 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)
DRV:64bit: - [2011.10.15 13:16:16 | 000,160,280 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk)
DRV:64bit: - [2011.10.15 13:16:16 | 000,100,912 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Stopped] -- C:\Windows\SysNative\drivers\mferkdet.sys -- (mferkdet)
DRV:64bit: - [2011.10.15 13:16:16 | 000,075,808 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfenlfk.sys -- (mfenlfk)
DRV:64bit: - [2011.10.15 13:16:16 | 000,065,264 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids)
DRV:64bit: - [2011.08.31 17:00:50 | 000,025,416 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011.08.01 14:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011.07.19 09:39:45 | 000,116,864 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2011.07.19 09:39:45 | 000,116,224 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbfake.sys -- (hwusbfake)
DRV:64bit: - [2011.07.19 09:39:45 | 000,112,896 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewsercd.sys -- (ewsercd)
DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.06.06 23:07:00 | 000,231,440 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2011.04.26 10:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.03.21 16:44:30 | 000,033,416 | ---- | M] (Locktime Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nlndis.sys -- (NLNdisPT)
DRV:64bit: - [2011.03.21 16:44:30 | 000,033,416 | ---- | M] (Locktime Software) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nlndis.sys -- (NLNdisMP)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.12.10 06:50:36 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.12.10 06:50:36 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.11.22 08:09:06 | 000,303,408 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv91xx.sys -- (mv91xx)
DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 04:23:48 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.10.27 14:50:28 | 000,301,680 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV:64bit: - [2010.10.27 14:50:28 | 000,279,152 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter)
DRV:64bit: - [2010.10.27 14:50:28 | 000,203,624 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV:64bit: - [2010.10.27 14:50:28 | 000,156,520 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV:64bit: - [2010.10.27 14:50:28 | 000,058,992 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV:64bit: - [2010.10.27 14:50:28 | 000,055,336 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AthDfu.sys -- (ATHDFU)
DRV:64bit: - [2010.10.27 14:50:28 | 000,038,248 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort)
DRV:64bit: - [2010.10.27 14:50:28 | 000,031,080 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS)
DRV:64bit: - [2010.10.19 15:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2010.08.17 18:28:32 | 000,026,136 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ICCWDT.sys -- (ICCWDT) Intel(R) Watchdog Timer Driver (Intel(R) WDT)
DRV:64bit: - [2010.06.25 18:07:26 | 000,035,344 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF)
DRV:64bit: - [2010.04.16 14:34:06 | 000,020,592 | ---- | M] (Portrait Displays, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PdiPorts.sys -- (PdiPorts)
DRV:64bit: - [2010.01.07 10:20:22 | 000,448,512 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8187.sys -- (RTL8187)
DRV:64bit: - [2009.10.01 11:04:54 | 001,307,648 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CM10664.sys -- (USBMULCD)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.08.28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV - [2011.12.03 14:37:48 | 000,017,152 | ---- | M] () [Kernel | On_Demand | Running] -- D:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys -- (Lavasoft Kernexplorer)
DRV - [2011.07.22 09:43:25 | 000,116,224 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ewusbfake.sys -- (hwusbfake)
DRV - [2011.07.22 09:43:25 | 000,112,896 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ewsercd.sys -- (ewsercd)
DRV - [2011.03.21 16:44:28 | 000,088,200 | ---- | M] (Locktime Software) [Kernel | System | Running] -- D:\Program Files\NetLimiter 3\nltdi.sys -- (nltdi)
DRV - [2009.08.07 22:46:56 | 000,023,112 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- d:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP4\WNt500x64\sandra.sys -- (SANDRA)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008.12.13 10:28:20 | 000,116,864 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ewusbmdm.sys -- (hwdatacard)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5C 38 7E 4F A1 6C CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultengine: "Search-Results"
FF - prefs.js..browser.search.defaultenginename: "Search-Results"
FF - prefs.js..browser.search.order.1: "Search-Results"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..keyword.URL: "hxxp://websearch.search-results.com/redirect?client=ff&src=kw&tb=STC-SRS&o=41648033&locale=de_DE&apn_uid=27585E9B-37D2-4465-BA12-110E4DBA700F&apn_ptnrs=96&apn_sauid=C6E5D6B3-9E65-46E4-9D52-6E7458A9F170&apn_dtid=YYYYYYYYDE&q="
FF - prefs.js..network.proxy.ftp: "46.249.35.176"
FF - prefs.js..network.proxy.ftp_port: 80
FF - prefs.js..network.proxy.http: "46.249.35.176"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.socks: "46.249.35.176"
FF - prefs.js..network.proxy.socks_port: 80
FF - prefs.js..network.proxy.ssl: "46.249.35.176"
FF - prefs.js..network.proxy.ssl_port: 80
FF - prefs.js..network.proxy.type: 1
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~2\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MVT: C:\Program Files (x86)\McAfee\Supportability\MVT\npmvtplugin.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Ghost\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Ghost\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore [2011.11.22 20:20:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.12.12 08:16:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.09 18:06:36 | 000,000,000 | ---D | M]
[2011.12.04 16:10:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ghost\AppData\Roaming\mozilla\Extensions
[2011.12.11 17:27:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions
[2011.10.24 21:23:31 | 000,000,000 | ---D | M] (Screenshot Pimp) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{056d0610-e44d-11df-bccf-0800200c9a66}
[2011.11.25 22:43:52 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2011.12.08 23:04:46 | 000,000,000 | ---D | M] (Personas Rotator) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{6e73f6b7-b9ab-44b8-b744-6393e3c2e351}
[2011.11.19 09:42:32 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011.11.20 15:41:38 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.12.03 20:48:36 | 000,000,000 | ---D | M] (BitDefender QuickScan) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011.11.05 12:53:06 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\firefox@ghostery.com
[2011.11.26 22:22:36 | 000,000,000 | ---D | M] (Low Quality Flash) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\low_quality_flash@pie2k.com
[2011.12.07 22:55:27 | 000,000,000 | ---D | M] (samfind Bookmarks Bar) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\sam@samfind.com
[2011.07.27 14:46:02 | 000,000,000 | ---D | M] (startup.service) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\startup.service@mozilla.com
[2011.12.12 08:16:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.11.13 18:37:08 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.10.06 15:38:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011.12.09 17:46:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011.11.22 20:20:50 | 000,000,000 | ---D | M] (McAfee ScriptScan for Firefox) -- C:\PROGRAM FILES (X86)\COMMON FILES\MCAFEE\SYSTEMCORE
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{1A2D0EC4-75F5-4C91-89C4-3656F6E44B68}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{37E4D8EA-8BDA-4831-8EA1-89053939A250}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{3D7EB24F-2740-49DF-8937-200B1CC08F8A}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{477C4C36-24EB-11DA-94D4-00E08161165F}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{7C9AE782-DB21-4E40-81FB-AD8A53A6233A}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{CE6E6E3B-84DD-4CAC-9F63-8D2AE4F30A4B}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{E10A6337-382E-4FE6-96DE-936ADC34DD04}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ADDON@MUSIC-CLIPS.NET.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ADONIS.CUHK@GMAIL.COM.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ANTICONTAINER@DOWNTHEMALL.NET.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\AUTOPAGER@MOZILLA.ORG.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\INFO@CONVERT2MP3.NET.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\INFO@YOUTUBE-MP3.ORG.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\PERSONAS@CHRISTOPHER.BEARD.XPI
[2011.11.21 05:21:43 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.04.14 13:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
[2011.12.09 17:46:17 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.07.11 22:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2011.11.21 02:17:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.21 02:09:48 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.11.21 02:17:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.21 02:17:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.11 11:28:14 | 000,002,503 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SearchResults.xml
[2011.11.21 02:17:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.21 02:17:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Disabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: BitDefender QuickScan (Enabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.100_0\npqscan.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: McAfee Virtual Technician (Enabled) = C:\Program Files (x86)\McAfee\Supportability\MVT\npmvtplugin.dll
CHR - plugin: McAfee SecurityCenter (Enabled) = c:\progra~2\mcafee\msc\npmcsn~1.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: WOT = C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp\1.2.9_0\
CHR - Extension: BitDefender QuickScan = C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.100_0\
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (no name) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No CLSID value found.
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Common Files\McAfee\SystemCore\ScriptSn.20111122201814.dll (McAfee, Inc.)
O2:64bit: - BHO: (no name) - {9D717F81-9148-4f12-8568-69135F087DB0} - No CLSID value found.
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files (x86)\AutocompletePro\AutocompletePro.dll (SimplyGen)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Programme\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20111122201814.dll (McAfee, Inc.)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (no name) - {9D717F81-9148-4f12-8568-69135F087DB0} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Cm106Sound] C:\Windows\Syswow64\cm106.dll (C-Media Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ASUS ShellProcess Execute] C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsShellProcess.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [DT ACR] C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [PivotSoftware] C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [ccleaner] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd)
O4 - HKCU..\Run: [NetLimiter] D:\Program Files\NetLimiter 3\NLClientApp.exe (Locktime Software)
O4 - HKCU..\Run: [SpybotSD TeaTimer] d:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6C802738-AE9D-4E6D-A478-99D6D0B66991}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll) - File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll) - File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (C:\Windows\SYSTEM32\RtlGina\RtlGina.DLL) - File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.02.09 14:59:36 | 000,000,000 | RH-D | M] - G:\autorun -- [ FAT32 ]
O32 - AutoRun File - [2002.10.17 09:56:50 | 000,000,036 | RH-- | M] () - G:\Autorun.inf.bak -- [ FAT32 ]
O33 - MountPoints2\{80b033ea-b1e1-11e0-909f-f46d049c99d9}\Shell - "" = AutoRun
O33 - MountPoints2\{80b033ea-b1e1-11e0-909f-f46d049c99d9}\Shell\AutoRun\command - "" = H:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{fb99ba64-b1d1-11e0-9f0c-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fb99ba64-b1d1-11e0-9f0c-806e6f6e6963}\Shell\AutoRun\command - "" = F:\.\Bin\ASSETUP.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
MsConfig:64bit - StartUpFolder: C:^Users^Ghost^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk - D:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig:64bit - StartUpFolder: C:^Users^Ghost^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^WISO Mein Steuer-Sparbuch heute.lnk - C:\PROGRA~2\WISO\STEUER~1\MSHAKT~1.EXE - ()
MsConfig:64bit - StartUpReg: *D7 - hkey= - key= - C:\Windows\SysNative\cmd.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: AthBtTray - hkey= - key= - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
MsConfig:64bit - StartUpReg: AtherosBtStack - hkey= - key= - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications)
MsConfig:64bit - StartUpReg: BCSSync - hkey= - key= - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: d: - hkey= - key= - Reg Error: Value error. File not found
MsConfig:64bit - StartUpReg: Google Update - hkey= - key= - C:\Users\Ghost\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
MsConfig:64bit - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard)
MsConfig:64bit - StartUpReg: Malwarebytes' Anti-Malware - hkey= - key= - d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
MsConfig:64bit - StartUpReg: OfficeSyncProcess - hkey= - key= - C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE (Microsoft Corporation)
MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
MsConfig:64bit - StartUpReg: StartCCC - hkey= - key= - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
MsConfig:64bit - StartUpReg: WinampAgent - hkey= - key= - D:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
MsConfig:64bit - State: "services" - Reg Error: Key error.
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011.12.12 20:51:50 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Ghost\Desktop\OTL.exe
[2011.12.12 20:07:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2011.12.12 07:34:21 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011.12.12 07:33:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2011.12.11 21:54:10 | 000,000,000 | ---D | C] -- C:\Program Files\HashTab Shell Extension
[2011.12.10 20:45:16 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EVEMon
[2011.12.10 12:43:56 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2011.12.10 12:36:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2011.12.10 12:36:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2011.12.10 12:25:54 | 000,000,000 | ---D | C] -- C:\ATI
[2011.12.10 12:10:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakNow PowerPack 2011
[2011.12.10 12:08:43 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\TweakNow PowerPack 2011
[2011.12.09 21:39:31 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\Locktime
[2011.12.09 21:36:46 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Wireshark
[2011.12.09 21:24:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
[2011.12.09 21:24:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinPcap
[2011.12.09 21:12:34 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NetLimiter 3
[2011.12.09 21:10:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Locktime
[2011.12.09 18:06:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2011.12.09 18:06:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2011.12.09 17:46:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2011.12.09 16:56:48 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2011.12.07 19:27:15 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Audials USB 8
[2011.12.07 18:51:02 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\CrashRpt
[2011.12.07 18:50:58 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Audials USB 9
[2011.12.07 18:36:54 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\RapidSolution
[2011.12.06 11:41:11 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\TrueCrypt
[2011.12.06 11:40:33 | 000,230,864 | ---- | C] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2011.12.06 11:40:24 | 000,000,000 | ---D | C] -- C:\Program Files\TrueCrypt
[2011.12.04 16:22:25 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Malwarebytes
[2011.12.04 16:21:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.12.04 16:21:00 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.12.04 12:21:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011.12.03 23:40:19 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\QuickScan
[2011.12.03 23:32:40 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Opera
[2011.12.03 23:32:40 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\Opera
[2011.12.03 23:32:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Opera
[2011.12.03 15:06:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safer Networking
[2011.12.03 14:37:48 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011.12.03 14:36:18 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys
[2011.12.03 14:35:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2011.11.30 19:13:46 | 000,000,000 | ---D | C] -- C:\Users\Ghost\Documents\EVEMon_3264_2011-11-30
[2011.11.27 20:49:26 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\NetSpeedMonitor
[2011.11.27 20:32:05 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\NetMeter
[2011.11.27 20:31:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetMeter
[2011.11.22 18:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011.11.20 15:44:25 | 000,000,000 | ---D | C] -- C:\Users\Ghost\dwhelper
[2011.11.18 18:31:31 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011.11.18 18:12:37 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\TeamViewer
[2011.11.18 18:11:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer
[2011.11.18 16:44:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.11.18 16:44:38 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.11.18 16:39:54 | 000,131,072 | ---- | C] (FoolishIT.com) -- C:\Windows\goog.exe
[2011.11.18 16:22:55 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Booster
[2011.07.19 15:18:48 | 001,802,976 | ---- | C] (CCP hf.) -- C:\Program Files (x86)\EVE_Premium_Setup_246350.exe
[2011.07.19 15:13:16 | 003,504,060 | ---- | C] (battleclinic.com) -- C:\Program Files (x86)\EVEMon-install-1.3.4.2523.exe
========== Files - Modified Within 30 Days ==========
[2011.12.12 21:04:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000UA.job
[2011.12.12 20:19:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.12 20:19:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.12 20:11:05 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.12 20:11:05 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.12 20:09:18 | 001,621,744 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.12 20:09:18 | 000,700,278 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.12 20:09:18 | 000,654,990 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.12 20:09:18 | 000,149,074 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.12 20:09:18 | 000,121,862 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.12 20:03:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.12 20:03:51 | 2129,297,407 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.12 19:34:38 | 000,437,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.12 19:06:54 | 000,000,000 | ---- | M] () -- C:\Users\Ghost\defogger_reenable
[2011.12.12 19:04:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000Core.job
[2011.12.12 16:47:13 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Ghost\Desktop\OTL.exe
[2011.12.12 08:16:13 | 000,001,138 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.12.12 07:53:34 | 000,003,288 | ---- | M] () -- C:\bootsqm.dat
[2011.12.12 07:34:21 | 000,002,975 | ---- | M] () -- C:\Users\Ghost\Desktop\HiJackThis.lnk
[2011.12.11 17:00:08 | 000,000,440 | ---- | M] () -- C:\Windows\tasks\vtscheduletask.job
[2011.12.10 22:45:08 | 000,000,353 | ---- | M] () -- C:\Users\Ghost\AppData\Roaming\Network Meter_Settings.ini
[2011.12.10 21:30:05 | 000,071,786 | ---- | M] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3290.xml.bak
[2011.12.10 20:45:11 | 000,071,849 | ---- | M] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3289.xml.bak
[2011.12.10 14:38:58 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2011.12.10 14:38:58 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2011.12.10 12:10:45 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\TweakNow PowerPack 2011.lnk
[2011.12.10 12:04:02 | 000,011,296 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111210_120359.reg
[2011.12.10 11:17:44 | 000,001,476 | ---- | M] () -- C:\Users\Ghost\Desktop\AudialsOne 8 USB starten.lnk
[2011.12.10 10:46:48 | 000,000,000 | ---- | M] () -- C:\Windows\Path.idx
[2011.12.10 10:45:16 | 001,025,648 | ---- | M] () -- C:\Windows\PE_Rom.dll
[2011.12.10 10:33:07 | 000,000,128 | ---- | M] () -- C:\Users\Ghost\AppData\Roaming\Sandra.ldb
[2011.12.09 21:36:46 | 000,000,218 | ---- | M] () -- C:\Users\Ghost\.recently-used.xbel
[2011.12.09 21:31:04 | 000,000,164 | ---- | M] () -- C:\Users\Ghost\Documents\Whiresark_00001_20111209213058
[2011.12.09 21:30:50 | 000,000,033 | ---- | M] () -- C:\Users\Ghost\.gtk-bookmarks
[2011.12.09 18:06:36 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011.12.09 17:34:10 | 000,000,035 | ---- | M] () -- C:\Users\Public\Documents\AtherosServiceConfig.ini
[2011.12.09 16:58:44 | 000,002,183 | ---- | M] () -- C:\Users\Ghost\Documents\Antwort auf Chip.com
[2011.12.07 18:50:59 | 000,001,476 | ---- | M] () -- C:\Users\Ghost\Desktop\AudialsOne 9 USB starten.lnk
[2011.12.06 11:40:33 | 000,230,864 | ---- | M] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2011.12.06 11:40:33 | 000,000,875 | ---- | M] () -- C:\Users\Ghost\Desktop\TrueCrypt.lnk
[2011.12.04 16:22:04 | 000,000,786 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.04 12:22:53 | 000,000,929 | ---- | M] () -- C:\Users\Ghost\Desktop\Spybot - Search & Destroy.lnk
[2011.12.04 11:08:20 | 000,039,344 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111204_110817.reg
[2011.12.03 23:32:35 | 000,001,829 | ---- | M] () -- C:\Users\Public\Desktop\Opera.lnk
[2011.12.03 23:30:40 | 000,881,077 | ---- | M] () -- C:\Users\Ghost\AppData\Local\census.cache
[2011.12.03 23:30:18 | 000,140,117 | ---- | M] () -- C:\Users\Ghost\AppData\Local\ars.cache
[2011.12.03 23:10:30 | 000,000,036 | ---- | M] () -- C:\Users\Ghost\AppData\Local\housecall.guid.cache
[2011.12.03 14:37:31 | 000,016,432 | ---- | M] () -- C:\Windows\SysNative\lsdelete.exe
[2011.12.03 14:37:27 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011.12.03 14:36:19 | 000,000,819 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2011.11.27 21:06:08 | 000,001,308 | ---- | M] () -- C:\Users\Ghost\Desktop\Tcpview - Verknüpfung.lnk
[2011.11.27 20:42:23 | 000,000,648 | ---- | M] () -- C:\Users\Public\Desktop\NetMeter.lnk
[2011.11.27 12:18:20 | 000,001,591 | ---- | M] () -- C:\Users\Ghost\Desktop\eve - Testserver.lnk
[2011.11.26 22:35:09 | 000,341,193 | ---- | M] () -- C:\Users\Ghost\Eve_PI_Diagrams_v1_4.pdf
[2011.11.26 20:58:22 | 000,005,168 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111126_205818.reg
[2011.11.25 20:32:10 | 000,121,331 | ---- | M] () -- C:\Users\Ghost\Anomalien_Eve.pdf
[2011.11.22 18:20:37 | 000,002,212 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011.11.19 11:10:05 | 000,000,744 | ---- | M] () -- C:\Users\Ghost\Documents\Der ist es jetzt aber.trs
[2011.11.19 09:41:20 | 000,009,202 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111119_094117.reg
[2011.11.18 18:12:16 | 000,001,162 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.11.18 17:51:22 | 000,000,942 | ---- | M] () -- C:\Windows\wiso.ini
[2011.11.18 17:15:33 | 000,100,352 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111118_171527.reg
[2011.11.18 16:44:41 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.11.18 16:39:41 | 000,131,072 | ---- | M] (FoolishIT.com) -- C:\Windows\goog.exe
[2011.11.18 16:39:20 | 000,024,576 | ---- | M] () -- C:\Windows\SysNative\FoolishEventLogMsgHelper.dll
========== Files Created - No Company Name ==========
[2011.12.12 19:34:33 | 000,437,312 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.12 19:06:54 | 000,000,000 | ---- | C] () -- C:\Users\Ghost\defogger_reenable
[2011.12.12 11:27:21 | 001,624,553 | ---- | C] () -- C:\img35.jpg
[2011.12.12 08:16:13 | 000,001,150 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.12.12 08:16:13 | 000,001,138 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.12.12 07:53:34 | 000,003,288 | ---- | C] () -- C:\bootsqm.dat
[2011.12.12 07:34:21 | 000,002,975 | ---- | C] () -- C:\Users\Ghost\Desktop\HiJackThis.lnk
[2011.12.10 21:30:36 | 000,071,786 | ---- | C] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3290.xml.bak
[2011.12.10 21:27:40 | 000,071,849 | ---- | C] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3289.xml.bak
[2011.12.10 12:10:45 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\TweakNow PowerPack 2011.lnk
[2011.12.10 12:04:01 | 000,011,296 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111210_120359.reg
[2011.12.10 10:46:48 | 000,000,000 | ---- | C] () -- C:\Windows\Path.idx
[2011.12.10 10:33:05 | 000,000,128 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\Sandra.ldb
[2011.12.09 21:36:46 | 000,000,218 | ---- | C] () -- C:\Users\Ghost\.recently-used.xbel
[2011.12.09 21:30:58 | 000,000,164 | ---- | C] () -- C:\Users\Ghost\Documents\Whiresark_00001_20111209213058
[2011.12.09 21:30:50 | 000,000,033 | ---- | C] () -- C:\Users\Ghost\.gtk-bookmarks
[2011.12.09 21:23:05 | 000,000,679 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
[2011.12.09 20:38:27 | 000,016,432 | ---- | C] () -- C:\Windows\SysNative\lsdelete.exe
[2011.12.09 18:06:36 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011.12.09 18:06:36 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011.12.09 17:03:33 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011.12.09 17:03:33 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011.12.09 16:23:14 | 000,002,183 | ---- | C] () -- C:\Users\Ghost\Documents\Antwort auf Chip.com
[2011.12.07 19:27:16 | 000,001,476 | ---- | C] () -- C:\Users\Ghost\Desktop\AudialsOne 8 USB starten.lnk
[2011.12.07 18:50:59 | 000,001,476 | ---- | C] () -- C:\Users\Ghost\Desktop\AudialsOne 9 USB starten.lnk
[2011.12.06 11:40:33 | 000,000,875 | ---- | C] () -- C:\Users\Ghost\Desktop\TrueCrypt.lnk
[2011.12.04 16:22:04 | 000,000,786 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.04 12:22:53 | 000,000,929 | ---- | C] () -- C:\Users\Ghost\Desktop\Spybot - Search & Destroy.lnk
[2011.12.04 11:08:18 | 000,039,344 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111204_110817.reg
[2011.12.03 23:32:35 | 000,001,841 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
[2011.12.03 23:32:35 | 000,001,829 | ---- | C] () -- C:\Users\Public\Desktop\Opera.lnk
[2011.12.03 23:30:40 | 000,881,077 | ---- | C] () -- C:\Users\Ghost\AppData\Local\census.cache
[2011.12.03 23:30:18 | 000,140,117 | ---- | C] () -- C:\Users\Ghost\AppData\Local\ars.cache
[2011.12.03 23:10:30 | 000,000,036 | ---- | C] () -- C:\Users\Ghost\AppData\Local\housecall.guid.cache
[2011.12.03 14:36:19 | 000,000,819 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2011.11.27 21:06:30 | 000,001,308 | ---- | C] () -- C:\Users\Ghost\Desktop\Tcpview - Verknüpfung.lnk
[2011.11.27 20:42:23 | 000,000,648 | ---- | C] () -- C:\Users\Public\Desktop\NetMeter.lnk
[2011.11.27 12:17:13 | 000,001,591 | ---- | C] () -- C:\Users\Ghost\Desktop\eve - Testserver.lnk
[2011.11.26 22:35:09 | 000,341,193 | ---- | C] () -- C:\Users\Ghost\Eve_PI_Diagrams_v1_4.pdf
[2011.11.26 20:58:20 | 000,005,168 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111126_205818.reg
[2011.11.25 20:32:51 | 000,121,331 | ---- | C] () -- C:\Users\Ghost\Anomalien_Eve.pdf
[2011.11.22 18:20:37 | 000,002,212 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011.11.19 09:41:18 | 000,009,202 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111119_094117.reg
[2011.11.18 18:12:16 | 000,001,174 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk
[2011.11.18 18:12:16 | 000,001,162 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.11.18 17:15:30 | 000,100,352 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111118_171527.reg
[2011.11.18 16:44:41 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.11.18 16:39:20 | 000,024,576 | ---- | C] () -- C:\Windows\SysNative\FoolishEventLogMsgHelper.dll
[2011.10.26 02:38:38 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2011.10.26 02:38:38 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.10.25 21:21:48 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.16 21:27:56 | 000,000,275 | ---- | C] () -- C:\Users\Ghost\AppData\Local\HamsterVideoConverterSettings.cfg
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.08.08 18:53:05 | 001,598,638 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.07.28 18:22:32 | 000,000,412 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\All CPU Meter_Settings.ini
[2011.07.28 17:42:14 | 000,000,353 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\Network Meter_Settings.ini
[2011.07.28 12:19:46 | 001,025,648 | ---- | C] () -- C:\Windows\PE_Rom.dll
[2011.07.28 12:10:12 | 000,094,208 | ---- | C] () -- C:\Windows\SysWow64\IccLibDll.dll
[2011.07.28 12:07:32 | 000,030,436 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2011.07.28 12:07:12 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2011.07.28 12:07:11 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2011.07.23 20:25:01 | 000,143,360 | ---- | C] () -- C:\Windows\Vmix106.dll
[2011.07.23 20:24:45 | 000,000,604 | ---- | C] () -- C:\Windows\Cm106.ini.cfl
[2011.07.23 20:20:05 | 000,003,059 | ---- | C] () -- C:\Windows\Cm106.ini.cfg
[2011.07.23 20:20:05 | 000,001,085 | ---- | C] () -- C:\Windows\Cm106.ini.imi
[2011.07.22 13:31:56 | 000,000,942 | ---- | C] () -- C:\Windows\wiso.ini
[2011.07.20 20:40:34 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.07.19 21:25:56 | 000,005,120 | ---- | C] () -- C:\Users\Ghost\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.07.19 16:50:27 | 011,137,024 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\Sandra.mdb
[2011.07.19 15:13:16 | 014,521,609 | ---- | C] () -- C:\Program Files (x86)\evepremiumpatch264377-267203_m.exe
[2011.07.19 09:49:05 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2011.07.19 09:31:35 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.07.19 08:47:02 | 000,007,432 | ---- | C] () -- C:\Windows\SysWow64\Machnm32.sys
[2011.07.19 07:50:37 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011.07.19 07:50:32 | 000,027,946 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2010.08.03 06:21:24 | 000,014,464 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsUpIO.sys
[2010.07.08 11:10:32 | 000,000,964 | ---- | C] () -- C:\Windows\cm106.ini
[2010.06.25 18:03:12 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2009.04.02 13:30:14 | 000,010,296 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
[2008.01.04 06:34:42 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
========== LOP Check ==========
[2011.09.16 16:40:00 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Ashampoo
[2011.11.18 16:22:55 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Booster
[2011.07.22 13:31:56 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Buhl Data Service
[2011.11.19 11:01:51 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Buhl Data Service GmbH
[2011.07.20 21:03:51 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\DataDesign
[2011.07.19 08:48:04 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\DisplayTune
[2011.12.02 20:27:45 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\EveHQ
[2011.12.10 21:27:40 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\EVEMon
[2011.11.18 17:13:18 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\FileZilla
[2011.09.16 20:32:02 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\FreeVideoConverter
[2011.11.09 22:26:56 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\GHISLER
[2011.12.09 21:30:53 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\gtk-2.0
[2011.10.16 13:46:54 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Indicium Technologies
[2011.12.02 23:05:55 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\NetMeter
[2011.12.12 21:10:50 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\NetSpeedMonitor
[2011.11.09 23:08:59 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Notepad++
[2011.09.29 16:17:00 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\OpenOffice.org
[2011.12.03 23:32:40 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Opera
[2011.08.27 12:56:06 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\PC Suite
[2011.12.11 23:57:25 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\QuickScan
[2011.11.18 18:36:22 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TeamViewer
[2011.12.06 11:46:14 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TrueCrypt
[2011.11.19 14:43:56 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TS3Client
[2011.07.27 14:45:08 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\ts3overlay
[2011.12.10 12:08:43 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TweakNow PowerPack 2011
[2011.07.31 10:27:53 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Verbindungsassistent
[2011.12.09 21:36:46 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Wireshark
[2011.11.27 12:02:17 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.12.11 17:00:08 | 000,000,440 | ---- | M] () -- C:\Windows\Tasks\vtscheduletask.job
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*. >
[2011.07.19 07:44:59 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.10.19 19:13:32 | 000,000,000 | ---D | M] -- C:\Alexander
[2011.07.19 09:28:41 | 000,000,000 | ---D | M] -- C:\AMD
[2011.12.10 12:25:54 | 000,000,000 | ---D | M] -- C:\ATI
[2011.12.12 18:17:10 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.07.19 07:44:53 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.07.19 07:51:16 | 000,000,000 | ---D | M] -- C:\Intel
[2011.08.08 18:29:25 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.12.11 21:54:10 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.12.12 07:33:32 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2011.12.10 12:43:56 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.07.19 07:44:53 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.07.19 07:44:53 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011.12.12 21:10:32 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.08.01 08:05:07 | 000,000,000 | ---D | M] -- C:\totalcmd
[2011.07.19 07:44:56 | 000,000,000 | R--D | M] -- C:\Users
[2011.12.12 20:03:52 | 000,000,000 | ---D | M] -- C:\Windows
< %PROGRAMFILES%\*.exe >
[2011.04.06 20:31:46 | 003,504,060 | ---- | M] (battleclinic.com) -- C:\Program Files (x86)\EVEMon-install-1.3.4.2523.exe
[2011.06.21 21:32:02 | 014,521,609 | ---- | M] () -- C:\Program Files (x86)\evepremiumpatch264377-267203_m.exe
[2011.04.06 17:48:04 | 001,802,976 | ---- | M] (CCP hf.) -- C:\Program Files (x86)\EVE_Premium_Setup_246350.exe
< %LOCALAPPDATA%\*.exe >
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.manifest /3 >
< MD5 for: AFD.SYS >
[2010.11.21 04:24:08 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=D31DC7A16DEA4A9BAF179F3D6FBDB38C -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys
[2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\SysNative\drivers\afd.sys
[2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys
[2011.04.25 04:09:35 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=F4AD06143EAC303F55D0E86C40802976 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys
< MD5 for: EXPLORER.EXE >
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.21 04:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010.11.21 04:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
< MD5 for: REGEDIT.EXE >
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe
< MD5 for: USERINIT.EXE >
[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
< MD5 for: WININIT.EXE >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
< MD5 for: WINLOGON.EXE >
[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >
--- --- ---
Ich freue mich, wenn mir jemand helfen kann, diesen Knoten zu lösen.
verrant |
