API tools faq
paste
Advertisement
Guest User

herrwuetent_OLT_current

a guest
Aug 20th, 2013
151
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 86.20 KB | None | 0 0
raw download clone embed print report
  1. OTL logfile created on: 20.08.2013 16:46:01 - Run 3
  2. OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Koester\Desktop
  3. 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
  4. Internet Explorer (Version = 9.10.9200.16660)
  5. Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
  6.  
  7. 4,00 Gb Total Physical Memory | 2,24 Gb Available Physical Memory | 56,08% Memory free
  8. 8,00 Gb Paging File | 6,12 Gb Available in Paging File | 76,53% Paging File free
  9. Paging file location(s): ?:\pagefile.sys [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
  12. Drive C: | 160,76 Gb Total Space | 31,17 Gb Free Space | 19,39% Space Free | Partition Type: NTFS
  13. Drive D: | 137,33 Gb Total Space | 24,13 Gb Free Space | 17,57% Space Free | Partition Type: NTFS
  14. Drive K: | 698,64 Gb Total Space | 60,93 Gb Free Space | 8,72% Space Free | Partition Type: NTFS
  15.  
  16. Computer Name: SKY | User Name: Koester | Logged in as Administrator.
  17. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
  18. Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
  19.  
  20. [color=#E56717]========== Processes (SafeList) ==========[/color]
  21.  
  22. PRC - [2013.08.20 10:29:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Koester\Desktop\OTL.exe
  23. PRC - [2013.05.28 15:05:16 | 000,163,328 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
  24. PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
  25. PRC - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
  26. PRC - [2012.06.07 22:42:14 | 000,680,624 | ---- | M] (National Instruments Corporation) -- C:\Program Files (x86)\National Instruments\Shared\Tagger\tagsrv.exe
  27. PRC - [2012.06.05 23:56:56 | 000,169,192 | ---- | M] (National Instruments Corporation) -- C:\Program Files (x86)\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe
  28. PRC - [2012.06.05 14:09:58 | 000,370,328 | ---- | M] (National Instruments Corporation) -- C:\Program Files (x86)\National Instruments\Shared\Security\nidmsrv.exe
  29. PRC - [2012.06.05 14:07:08 | 000,060,568 | ---- | M] (National Instruments Corporation) -- C:\Windows\SysWOW64\lktsrv.exe
  30. PRC - [2012.06.05 13:58:56 | 000,050,328 | ---- | M] (National Instruments Corporation) -- C:\Windows\SysWOW64\lkads.exe
  31. PRC - [2012.05.31 16:51:58 | 000,258,776 | ---- | M] (National Instruments Corporation) -- C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe
  32. PRC - [2012.05.22 23:50:12 | 000,051,360 | ---- | M] (National Instruments Corporation) -- C:\Program Files (x86)\National Instruments\MAX\nimxs.exe
  33. PRC - [2012.05.22 09:39:06 | 000,053,952 | ---- | M] (National Instruments Corporation) -- C:\Program Files (x86)\National Instruments\Shared\NI WebServer\SystemWebServer.exe
  34. PRC - [2012.05.22 09:38:06 | 000,053,960 | ---- | M] (National Instruments Corporation) -- C:\Program Files (x86)\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe
  35. PRC - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
  36. PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
  37. PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
  38. PRC - [2012.05.02 00:31:35 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
  39. PRC - [2011.10.19 17:03:02 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
  40. PRC - [2011.05.06 15:08:28 | 000,695,136 | ---- | M] (National Instruments, Inc.) -- C:\Windows\SysWOW64\lkcitdl.exe
  41. PRC - [2011.03.31 16:08:14 | 000,080,896 | ---- | M] () -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
  42. PRC - [2011.01.31 13:01:28 | 000,068,928 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\SysWOW64\NLSSRV32.EXE
  43. PRC - [2010.11.20 14:17:36 | 000,179,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\schtasks.exe
  44. PRC - [2010.02.05 10:05:08 | 000,182,912 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
  45. PRC - [2010.02.04 14:05:32 | 007,350,912 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
  46. PRC - [2010.01.05 13:59:12 | 000,170,624 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
  47. PRC - [2009.07.24 10:32:50 | 001,593,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
  48. PRC - [2009.06.19 10:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
  49. PRC - [2009.06.19 10:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
  50. PRC - [2009.06.15 17:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe
  51. PRC - [2008.12.22 17:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
  52. PRC - [2008.08.13 21:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
  53. PRC - [2007.08.08 00:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe
  54.  
  55.  
  56. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  57.  
  58. MOD - [2009.07.24 10:32:50 | 001,593,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
  59.  
  60.  
  61. [color=#E56717]========== Services (SafeList) ==========[/color]
  62.  
  63. SRV:[b]64bit:[/b] - [2012.11.29 13:56:56 | 000,230,408 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe -- (NitroDriverReadSpool8)
  64. SRV:[b]64bit:[/b] - [2012.09.15 17:10:54 | 001,432,400 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)
  65. SRV:[b]64bit:[/b] - [2012.05.22 09:38:20 | 000,076,488 | ---- | M] (National Instruments Corporation) [Disabled | Stopped] -- C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe -- (NIApplicationWebServer64)
  66. SRV:[b]64bit:[/b] - [2012.01.31 09:10:36 | 000,339,776 | ---- | M] ( ) [Auto | Running] -- C:\Program Files\Autodesk\Inventor 2013\Moldflow\bin\mitsijm.exe -- (mitsijm2013)
  67. SRV:[b]64bit:[/b] - [2010.05.27 11:44:54 | 002,608,904 | ---- | M] (Raxco Software, Inc.) [Auto | Running] -- C:\Program Files\Raxco\PerfectDisk\PDAgent.exe -- (PDAgent)
  68. SRV:[b]64bit:[/b] - [2010.05.27 11:44:44 | 002,259,208 | ---- | M] (Raxco Software, Inc.) [On_Demand | Stopped] -- C:\Program Files\Raxco\PerfectDisk\PDEngine.exe -- (PDEngine)
  69. SRV:[b]64bit:[/b] - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
  70. SRV:[b]64bit:[/b] - [2007.08.08 00:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
  71. SRV - [2013.05.28 15:05:16 | 000,163,328 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
  72. SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
  73. SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
  74. SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
  75. SRV - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
  76. SRV - [2012.06.07 22:42:14 | 000,680,624 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Program Files (x86)\National Instruments\Shared\Tagger\tagsrv.exe -- (NITaggerService)
  77. SRV - [2012.06.05 23:56:56 | 000,169,192 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Program Files (x86)\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe -- (NINetworkDiscovery)
  78. SRV - [2012.06.05 14:09:58 | 000,370,328 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Program Files (x86)\National Instruments\Shared\Security\nidmsrv.exe -- (NIDomainService)
  79. SRV - [2012.06.05 14:07:08 | 000,060,568 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Windows\SysWOW64\lktsrv.exe -- (lkTimeSync)
  80. SRV - [2012.06.05 13:58:56 | 000,050,328 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Windows\SysWOW64\lkads.exe -- (lkClassAds)
  81. SRV - [2012.05.31 16:51:58 | 000,258,776 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe -- (nimDNSResponder)
  82. SRV - [2012.05.22 23:50:12 | 000,051,360 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Program Files (x86)\National Instruments\MAX\nimxs.exe -- (mxssvr)
  83. SRV - [2012.05.22 09:39:06 | 000,053,952 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Program Files (x86)\National Instruments\Shared\NI WebServer\SystemWebServer.exe -- (niSvcLoc)
  84. SRV - [2012.05.22 09:38:06 | 000,053,960 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Program Files (x86)\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe -- (NIApplicationWebServer)
  85. SRV - [2012.05.18 13:25:58 | 000,139,488 | ---- | M] (OPC Foundation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Opcenum.exe -- (OpcEnum)
  86. SRV - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
  87. SRV - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
  88. SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
  89. SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
  90. SRV - [2011.10.19 17:03:02 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
  91. SRV - [2011.05.06 15:08:28 | 000,695,136 | ---- | M] (National Instruments, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\lkcitdl.exe -- (LkCitadelServer)
  92. SRV - [2011.03.31 16:08:14 | 000,080,896 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
  93. SRV - [2011.01.31 13:01:28 | 000,068,928 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\Windows\SysWOW64\NLSSRV32.EXE -- (nlsX86cc)
  94. SRV - [2010.11.08 23:04:26 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService)
  95. SRV - [2010.08.02 10:00:00 | 001,427,688 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\National Instruments\Shared\License Manager\Bin\lmgrd.exe -- (NILM License Manager)
  96. SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
  97. SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
  98. SRV - [2009.06.15 17:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)
  99. SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
  100.  
  101.  
  102. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  103.  
  104. DRV:[b]64bit:[/b] - [2013.04.04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
  105. DRV:[b]64bit:[/b] - [2013.04.03 09:58:08 | 000,188,232 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm)
  106. DRV:[b]64bit:[/b] - [2013.04.03 09:58:08 | 000,169,288 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus)
  107. DRV:[b]64bit:[/b] - [2013.04.03 09:58:08 | 000,158,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadserd.sys -- (ssadserd)
  108. DRV:[b]64bit:[/b] - [2013.04.03 09:58:08 | 000,038,080 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadadb.sys -- (androidusb)
  109. DRV:[b]64bit:[/b] - [2013.04.03 09:58:08 | 000,021,320 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl)
  110. DRV:[b]64bit:[/b] - [2013.02.18 10:22:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
  111. DRV:[b]64bit:[/b] - [2013.02.12 06:12:06 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
  112. DRV:[b]64bit:[/b] - [2013.01.08 11:21:28 | 000,031,080 | ---- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VirtualAudio.sys -- (WsAudio_Device)
  113. DRV:[b]64bit:[/b] - [2012.11.06 00:46:30 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)
  114. DRV:[b]64bit:[/b] - [2012.11.06 00:46:30 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
  115. DRV:[b]64bit:[/b] - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
  116. DRV:[b]64bit:[/b] - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
  117. DRV:[b]64bit:[/b] - [2012.05.02 15:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
  118. DRV:[b]64bit:[/b] - [2012.04.27 10:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
  119. DRV:[b]64bit:[/b] - [2012.04.25 00:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
  120. DRV:[b]64bit:[/b] - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
  121. DRV:[b]64bit:[/b] - [2011.09.06 01:19:54 | 000,031,744 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandnetadb.sys -- (andnetadb)
  122. DRV:[b]64bit:[/b] - [2011.08.02 18:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
  123. DRV:[b]64bit:[/b] - [2011.06.27 02:37:00 | 002,753,536 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
  124. DRV:[b]64bit:[/b] - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
  125. DRV:[b]64bit:[/b] - [2011.04.27 11:08:12 | 000,034,816 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem)
  126. DRV:[b]64bit:[/b] - [2011.04.27 11:08:10 | 000,028,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag)
  127. DRV:[b]64bit:[/b] - [2011.04.27 11:08:10 | 000,017,920 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus)
  128. DRV:[b]64bit:[/b] - [2011.04.13 15:04:38 | 000,045,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
  129. DRV:[b]64bit:[/b] - [2011.03.22 07:27:46 | 000,028,264 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ITECIRfilter.sys -- (ITECIRfilter)
  130. DRV:[b]64bit:[/b] - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
  131. DRV:[b]64bit:[/b] - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
  132. DRV:[b]64bit:[/b] - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
  133. DRV:[b]64bit:[/b] - [2010.12.23 17:35:02 | 000,034,304 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandmodem64.sys -- (ANDModem)
  134. DRV:[b]64bit:[/b] - [2010.12.23 17:35:02 | 000,027,136 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandgps64.sys -- (AndGps)
  135. DRV:[b]64bit:[/b] - [2010.12.23 17:35:00 | 000,027,648 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lganddiag64.sys -- (AndDiag)
  136. DRV:[b]64bit:[/b] - [2010.12.23 17:35:00 | 000,019,456 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandbus64.sys -- (Andbus)
  137. DRV:[b]64bit:[/b] - [2010.12.17 00:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
  138. DRV:[b]64bit:[/b] - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
  139. DRV:[b]64bit:[/b] - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
  140. DRV:[b]64bit:[/b] - [2010.11.08 23:04:26 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)
  141. DRV:[b]64bit:[/b] - [2010.07.15 09:44:20 | 000,016,776 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\epmntdrv.sys -- (epmntdrv)
  142. DRV:[b]64bit:[/b] - [2010.07.15 09:44:20 | 000,009,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\EuGdiDrv.sys -- (EuGdiDrv)
  143. DRV:[b]64bit:[/b] - [2010.07.13 10:57:08 | 000,069,736 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\itecir.sys -- (itecir)
  144. DRV:[b]64bit:[/b] - [2010.06.25 17:08:10 | 000,036,928 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\htcnprot.sys -- (htcnprot)
  145. DRV:[b]64bit:[/b] - [2010.06.19 00:36:04 | 000,017,920 | ---- | M] (Siliten) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\InputFilter_FlexDef2b.sys -- (InputFilter_Hid_FlexDef2b)
  146. DRV:[b]64bit:[/b] - [2010.06.15 17:15:46 | 000,038,064 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\niede.sys -- (NIEthernetDeviceEnumerator)
  147. DRV:[b]64bit:[/b] - [2010.06.09 11:54:32 | 000,082,816 | ---- | M] (VSO Software) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\pcouffin.sys -- (pcouffin)
  148. DRV:[b]64bit:[/b] - [2010.04.14 01:01:44 | 000,054,824 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btusbflt.sys -- (btusbflt)
  149. DRV:[b]64bit:[/b] - [2010.04.11 21:58:43 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
  150. DRV:[b]64bit:[/b] - [2010.04.07 06:22:04 | 000,138,256 | ---- | M] (Raxco Software, Inc.) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\DefragFs.sys -- (DefragFS)
  151. DRV:[b]64bit:[/b] - [2010.03.10 08:16:36 | 000,029,720 | ---- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ivusb.sys -- (ivusb)
  152. DRV:[b]64bit:[/b] - [2009.11.01 19:16:50 | 000,033,736 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys -- (HTCAND64)
  153. DRV:[b]64bit:[/b] - [2009.09.29 08:15:02 | 000,016,384 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lgbtpt64.sys -- (LgBttPort)
  154. DRV:[b]64bit:[/b] - [2009.09.29 08:15:00 | 000,017,408 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lgvmdm64.sys -- (LGVMODEM)
  155. DRV:[b]64bit:[/b] - [2009.09.29 08:15:00 | 000,014,848 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lgbtbs64.sys -- (lgbusenum)
  156. DRV:[b]64bit:[/b] - [2009.08.06 23:24:14 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
  157. DRV:[b]64bit:[/b] - [2009.07.24 08:55:10 | 000,011,264 | ---- | M] (Primax Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NMgamingms.sys -- (NMgamingmsFltr)
  158. DRV:[b]64bit:[/b] - [2009.07.20 19:29:40 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
  159. DRV:[b]64bit:[/b] - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
  160. DRV:[b]64bit:[/b] - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
  161. DRV:[b]64bit:[/b] - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
  162. DRV:[b]64bit:[/b] - [2009.07.14 02:06:32 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
  163. DRV:[b]64bit:[/b] - [2009.06.25 17:04:20 | 000,067,584 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk)
  164. DRV:[b]64bit:[/b] - [2009.06.25 16:38:52 | 000,057,856 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp)
  165. DRV:[b]64bit:[/b] - [2009.06.25 16:13:44 | 000,055,296 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk)
  166. DRV:[b]64bit:[/b] - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
  167. DRV:[b]64bit:[/b] - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
  168. DRV:[b]64bit:[/b] - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
  169. DRV:[b]64bit:[/b] - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
  170. DRV:[b]64bit:[/b] - [2009.05.13 11:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
  171. DRV:[b]64bit:[/b] - [2007.07.24 11:11:32 | 000,014,904 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)
  172. DRV - [2010.07.15 09:44:20 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\epmntdrv.sys -- (epmntdrv)
  173. DRV - [2010.07.15 09:44:20 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\EuGdiDrv.sys -- (EuGdiDrv)
  174. DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
  175. DRV - [2006.07.24 16:05:00 | 000,005,632 | ---- | M] () [File_System | System | Stopped] -- C:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen)
  176.  
  177.  
  178. [color=#E56717]========== Standard Registry (SafeList) ==========[/color]
  179.  
  180.  
  181. [color=#E56717]========== Internet Explorer ==========[/color]
  182.  
  183. IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  184. IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  185. IE - HKLM\..\SearchScopes,DefaultScope =
  186. IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  187.  
  188.  
  189. IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
  190. IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  191.  
  192. IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
  193. IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  194.  
  195. IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
  196.  
  197. IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
  198.  
  199. IE - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
  200. IE - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
  201. IE - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
  202. IE - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 51 BC 96 98 66 14 CD 01 [binary data]
  203. IE - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\..\SearchScopes,DefaultScope =
  204. IE - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
  205. IE - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\..\SearchScopes\{F7C7A225-4F75-4291-9DA0-09ACC5116F97}: "URL" = http://www.mysearchresults.com/search?c=4005&t=14&q={searchTerms}
  206. IE - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  207.  
  208. [color=#E56717]========== FireFox ==========[/color]
  209.  
  210. FF - prefs.js..browser.search.useDBForOrder: true
  211. FF - prefs.js..browser.startup.homepage: "www.heise.de"
  212. FF - prefs.js..extensions.enabledAddons: %7B09408840-3f84-11dd-ae16-0800200c9a66%7D:0.1.2
  213. FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.9.1
  214. FF - prefs.js..extensions.enabledAddons: printedit%40DW-dev:10.0
  215. FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
  216. FF - prefs.js..extensions.enabledItems: {7E77F5DF-8022-40e3-9122-F03DEBEFC43B}:1.0.24
  217. FF - prefs.js..extensions.enabledItems: {9d1f059c-cada-4111-9696-41a62d64e3ba}:0.6.2
  218. FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
  219. FF - prefs.js..extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:3.0.0.2
  220. FF - prefs.js..extensions.enabledItems: {99999999-73df-4e76-b66c-87d3db104b03}:1.3.5
  221. FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
  222. FF - prefs.js..network.proxy.type: 0
  223. FF - user.js - File not found
  224.  
  225. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_149.dll File not found
  226. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
  227. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
  228. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
  229. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
  230. FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll ()
  231. FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
  232. FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
  233. FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
  234. FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
  235. FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
  236. FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll File not found
  237. FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
  238. FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
  239. FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
  240. FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
  241. FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF)
  242. FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
  243. FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
  244. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
  245. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
  246. FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
  247. FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
  248. FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
  249. FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\The Settlers 7 - Paths to a Kingdom\Data\Base\_Dbg\Bin\Release\orbit\npuplaypc.dll (Ubisoft)
  250.  
  251. FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013.02.19 22:25:37 | 000,000,000 | ---D | M]
  252. FF - HKEY_LOCAL_MACHINE\software\mozilla\Waterfox 18.0.1\extensions\\Components: C:\Program Files\\Waterfox\components [2013.03.08 21:10:13 | 000,000,000 | ---D | M]
  253. FF - HKEY_LOCAL_MACHINE\software\mozilla\Waterfox 18.0.1\extensions\\Plugins: C:\Program Files\\Waterfox\plugins
  254.  
  255. [2013.03.30 02:08:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Koester\AppData\Roaming\mozilla\Extensions
  256. [2013.08.20 13:18:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Koester\AppData\Roaming\mozilla\Firefox\Profiles\0uwboc2e.default\extensions
  257. [2013.08.16 20:34:11 | 000,000,000 | ---D | M] (Adblock Plus Pop-up Addon) -- C:\Users\Koester\AppData\Roaming\mozilla\Firefox\Profiles\0uwboc2e.default\extensions\[email protected]
  258. [2013.08.19 13:32:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Koester\AppData\Roaming\mozilla\Firefox\Profiles\0uwboc2e.default\extensions\staged
  259. [2013.08.16 20:34:08 | 000,128,676 | ---- | M] () (No name found) -- C:\Users\Koester\AppData\Roaming\mozilla\firefox\profiles\0uwboc2e.default\extensions\[email protected]
  260. [2012.07.05 17:11:12 | 000,123,385 | ---- | M] () (No name found) -- C:\Users\Koester\AppData\Roaming\mozilla\firefox\profiles\0uwboc2e.default\extensions\[email protected]
  261. [2013.04.30 21:35:22 | 000,216,582 | ---- | M] () (No name found) -- C:\Users\Koester\AppData\Roaming\mozilla\firefox\profiles\0uwboc2e.default\extensions\[email protected]
  262. [2013.08.19 13:32:26 | 000,098,081 | ---- | M] () (No name found) -- C:\Users\Koester\AppData\Roaming\mozilla\firefox\profiles\0uwboc2e.default\extensions\[email protected]
  263. [2012.08.02 19:45:42 | 000,002,720 | ---- | M] () (No name found) -- C:\Users\Koester\AppData\Roaming\mozilla\firefox\profiles\0uwboc2e.default\extensions\{09408840-3f84-11dd-ae16-0800200c9a66}.xpi
  264. [2013.07.31 11:47:19 | 000,824,302 | ---- | M] () (No name found) -- C:\Users\Koester\AppData\Roaming\mozilla\firefox\profiles\0uwboc2e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
  265.  
  266. O1 HOSTS File: ([2011.06.26 23:03:32 | 000,000,864 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
  267. O1 - Hosts: 127.0.0.1 validation.sls.microsoft.com
  268. O2:[b]64bit:[/b] - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
  269. O2:[b]64bit:[/b] - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
  270. O2 - BHO: (HistoryTriggerBHO Class) - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Program Files (x86)\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics)
  271. O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
  272. O3 - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
  273. O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
  274. O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
  275. O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
  276. O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
  277. O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  278. O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  279. O4 - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001..\Run: [Google Update] Reg Error: Value error. File not found
  280. O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
  281. O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
  282. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  283. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
  284. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
  285. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
  286. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
  287. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
  288. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisplayLastLogonInfo = 1
  289. O7 - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
  290. O7 - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionName =
  291. O7 - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionAction =
  292. O8:[b]64bit:[/b] - Extra context menu item: E&xport to Microsoft Excel - Reg Error: Value error. File not found
  293. O8 - Extra context menu item: E&xport to Microsoft Excel - Reg Error: Value error. File not found
  294. O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll (National Instruments Corporation)
  295. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
  296. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
  297. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
  298. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
  299. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
  300. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
  301. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
  302. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
  303. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
  304. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
  305. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000011 - mmswsock.dll File not found
  306. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000012 - CC:\Program Files (x86)\VMware\VMware Player\x64\vsocklib.dll File not found
  307. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000013 - CC:\Program Files (x86)\VMware\VMware Player\x64\vsocklib.dll File not found
  308. O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll (National Instruments Corporation)
  309. O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll File not found
  310. O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll File not found
  311. O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll File not found
  312. O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll File not found
  313. O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll File not found
  314. O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll File not found
  315. O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll File not found
  316. O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll File not found
  317. O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll File not found
  318. O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll File not found
  319. O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll File not found
  320. O13[b]64bit:[/b] - gopher Prefix: missing
  321. O13 - gopher Prefix: missing
  322. O15 - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\..Trusted Domains: microsoft.com ([]* in Trusted sites)
  323. O15 - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\..Trusted Domains: microsoft.com ([*.update] * in Trusted sites)
  324. O15 - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\..Trusted Domains: microsoft.com ([*.windowsupdate] * in Trusted sites)
  325. O15 - HKU\S-1-5-21-2304036826-2203788415-1893340992-1001\..Trusted Domains: windowsupdate.com ([]* in Trusted sites)
  326. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 10.9.2)
  327. O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 1.7.0_09)
  328. O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 1.7.0_09)
  329. O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
  330. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B38ADB6-9DC6-4185-A10C-276649B00D29}: DhcpNameServer = 192.168.2.1
  331. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4C88984E-F713-433A-A8F9-50460E991565}: DhcpNameServer = 134.245.10.7 134.245.1.36
  332. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9CE0379B-4CA7-4C25-9584-4D4B7128D699}: DhcpNameServer = 192.168.2.1
  333. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FBE1388C-34E6-4445-9292-3F27A54F1D67}: DhcpNameServer = 192.168.42.129
  334. O18:[b]64bit:[/b] - Protocol\Handler\skype4com - No CLSID value found
  335. O18 - Protocol\Handler\ms-help - No CLSID value found
  336. O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
  337. O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
  338. O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
  339. O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
  340. O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
  341. O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  342. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  343. O28:[b]64bit:[/b] - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
  344. O32 - HKLM CDRom: AutoRun - 1
  345. O34 - HKLM BootExecute: (PDBoot.exe)
  346. O34 - HKLM BootExecute: (autocheck autochk *)
  347. O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
  348. O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
  349. O35 - HKLM\..comfile [open] -- "%1" %*
  350. O35 - HKLM\..exefile [open] -- "%1" %*
  351. O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
  352. O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
  353. O37 - HKLM\...com [@ = comfile] -- "%1" %*
  354. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  355. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  356. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  357. O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
  358.  
  359. NetSvcs:[b]64bit:[/b] AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
  360.  
  361. CREATERESTOREPOINT
  362. Restore point Set: OTL Restore Point
  363.  
  364. [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
  365.  
  366. [2013.08.20 13:09:13 | 000,000,000 | ---D | C] -- C:\AdwCleaner
  367. [2013.08.20 13:02:58 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\Koester\Desktop\aswMBR-1.exe
  368. [2013.08.20 10:32:02 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Koester\Desktop\OTL.exe
  369. [2013.08.20 09:53:26 | 000,000,000 | ---D | C] -- C:\Users\Koester\AppData\Roaming\Avira
  370. [2013.08.20 09:48:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
  371. [2013.08.20 09:48:38 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
  372. [2013.08.20 09:48:38 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
  373. [2013.08.20 09:48:38 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
  374. [2013.08.20 09:48:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
  375. [2013.08.20 09:48:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
  376. [2013.08.19 14:04:16 | 000,000,000 | ---D | C] -- C:\Users\Koester\AppData\Roaming\Malwarebytes
  377. [2013.08.19 14:03:47 | 000,000,000 | ---D | C] -- C:\Users\Koester\Desktop\Malwarebytes.Anti-Malware.v1.50.MULTILINGUAL.WORKING-CRD
  378. [2013.08.19 12:57:05 | 000,000,000 | ---D | C] -- C:\Users\Koester\AppData\Local\Google
  379. [2013.08.17 06:44:05 | 003,913,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
  380. [2013.08.17 06:44:04 | 005,550,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
  381. [2013.08.17 06:44:04 | 003,968,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
  382. [2013.08.17 06:44:04 | 001,732,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
  383. [2013.08.17 06:44:03 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
  384. [2013.08.17 06:44:03 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
  385. [2013.08.17 06:44:03 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
  386. [2013.08.17 06:44:03 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
  387. [2013.08.17 06:44:03 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
  388. [2013.08.17 06:44:02 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
  389. [2013.08.16 19:44:24 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
  390. [2013.08.16 19:44:23 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
  391. [2013.08.16 19:44:22 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
  392. [2013.08.16 19:44:22 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
  393. [2013.08.16 19:44:22 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
  394. [2013.08.16 19:44:22 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
  395. [2013.08.16 19:44:22 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
  396. [2013.08.16 19:44:22 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
  397. [2013.08.16 19:44:22 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
  398. [2013.08.16 19:44:22 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
  399. [2013.08.16 19:44:22 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
  400. [2013.08.16 19:44:20 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
  401. [2013.08.16 19:44:19 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
  402. [2013.08.16 19:44:19 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
  403. [2013.08.16 19:44:19 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
  404. [2013.08.16 19:30:29 | 001,472,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
  405. [2013.08.16 19:30:29 | 000,224,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
  406. [2013.08.16 19:30:26 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
  407. [2013.08.16 19:30:18 | 001,888,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL
  408. [2013.08.16 19:30:18 | 001,620,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMVDECOD.DLL
  409. [2013.08.16 19:29:33 | 001,217,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll
  410. [2013.08.12 07:58:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\EPSON
  411. [2013.08.12 07:58:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
  412. [2013.08.12 07:56:31 | 000,010,752 | ---- | C] (SEIKO EPSON CORP.) -- C:\Windows\SysNative\E_GCINST.DLL
  413. [2013.08.12 07:56:30 | 000,118,784 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_ILMGCE.DLL
  414. [2013.08.12 07:56:29 | 000,088,064 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\Windows\SysNative\E_IBCBGCE.DLL
  415. [2013.08.12 07:55:55 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON
  416. [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
  417.  
  418. [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
  419.  
  420. [2013.08.20 16:27:38 | 000,023,280 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  421. [2013.08.20 16:27:38 | 000,023,280 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  422. [2013.08.20 16:22:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
  423. [2013.08.20 16:22:00 | 3220,525,056 | -HS- | M] () -- C:\hiberfil.sys
  424. [2013.08.20 13:13:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\DealPlyLiveUpdateTaskMachineUA.job
  425. [2013.08.20 13:06:32 | 000,584,600 | ---- | M] () -- C:\Users\Koester\Desktop\cbsidlm-tr1_14-AdwCleaner-ORG-75851221.exe
  426. [2013.08.20 13:02:28 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\Koester\Desktop\aswMBR-1.exe
  427. [2013.08.20 13:02:18 | 000,666,633 | ---- | M] () -- C:\Users\Koester\Desktop\2-adwcleaner.bin
  428. [2013.08.20 10:29:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Koester\Desktop\OTL.exe
  429. [2013.08.20 09:48:45 | 000,002,036 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
  430. [2013.08.19 17:54:24 | 000,001,079 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  431. [2013.08.19 13:02:47 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
  432. [2013.08.19 13:02:47 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
  433. [2013.08.16 19:38:57 | 001,640,804 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
  434. [2013.08.16 19:38:57 | 000,697,842 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
  435. [2013.08.16 19:38:57 | 000,655,280 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
  436. [2013.08.16 19:38:57 | 000,148,874 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
  437. [2013.08.16 19:38:57 | 000,122,152 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
  438. [2013.08.03 18:22:23 | 1992,904,476 | ---- | M] () -- C:\Users\Koester\Desktop\ddlsource.com_Red 2.2013.TS.Xvid-EXTRA.avi
  439. [2013.07.26 07:13:58 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
  440. [2013.07.26 07:12:27 | 000,603,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
  441. [2013.07.26 07:12:08 | 003,958,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
  442. [2013.07.26 07:12:08 | 000,855,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
  443. [2013.07.26 07:12:04 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
  444. [2013.07.26 07:12:04 | 000,136,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
  445. [2013.07.26 07:12:03 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
  446. [2013.07.26 07:12:03 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
  447. [2013.07.26 05:12:04 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
  448. [2013.07.26 05:12:00 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
  449. [2013.07.26 05:12:00 | 000,109,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
  450. [2013.07.26 05:12:00 | 000,061,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
  451. [2013.07.26 05:11:59 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
  452. [2013.07.26 04:39:38 | 000,089,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
  453. [2013.07.26 03:59:38 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
  454. [2013.07.25 11:25:54 | 001,888,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL
  455. [2013.07.25 10:57:27 | 001,620,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\WMVDECOD.DLL
  456. [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
  457.  
  458. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  459.  
  460. [2013.08.20 13:08:43 | 000,000,908 | ---- | C] () -- C:\Windows\tasks\DealPlyLiveUpdateTaskMachineUA.job
  461. [2013.08.20 13:06:46 | 000,584,600 | ---- | C] () -- C:\Users\Koester\Desktop\cbsidlm-tr1_14-AdwCleaner-ORG-75851221.exe
  462. [2013.08.20 13:02:55 | 000,666,633 | ---- | C] () -- C:\Users\Koester\Desktop\2-adwcleaner.bin
  463. [2013.08.20 09:48:45 | 000,002,036 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
  464. [2013.08.19 17:54:24 | 000,001,079 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  465. [2013.08.04 00:04:30 | 1992,904,476 | ---- | C] () -- C:\Users\Koester\Desktop\ddlsource.com_Red 2.2013.TS.Xvid-EXTRA.avi
  466. [2013.07.14 01:03:33 | 000,007,605 | ---- | C] () -- C:\Users\Koester\AppData\Local\Resmon.ResmonCfg
  467. [2013.05.16 18:34:38 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
  468. [2013.05.16 18:33:17 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
  469. [2013.04.18 19:06:46 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
  470. [2013.04.18 19:06:46 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
  471. [2013.04.18 19:06:46 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
  472. [2013.04.18 19:06:46 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
  473. [2013.04.14 11:54:43 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll
  474. [2013.04.14 11:54:43 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini
  475. [2013.03.30 01:39:34 | 000,000,932 | RHS- | C] () -- C:\Users\Koester\ntuser.pol
  476. [2012.12.17 16:26:46 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini
  477. [2012.05.23 14:50:42 | 000,000,244 | ---- | C] () -- C:\Windows\SysWow64\nirpc.ini
  478. [2012.05.15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
  479. [2012.02.12 16:39:19 | 000,410,942 | ---- | C] () -- C:\Windows\adb.exe
  480. [2012.02.12 16:39:19 | 000,401,408 | ---- | C] () -- C:\Windows\wget.exe
  481. [2012.02.12 16:39:19 | 000,356,009 | ---- | C] () -- C:\Windows\fastboot.exe
  482. [2012.02.12 16:39:19 | 000,063,488 | ---- | C] () -- C:\Windows\md5sum.exe
  483. [2011.10.19 17:03:02 | 000,075,064 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
  484. [2011.06.29 18:50:49 | 000,000,096 | ---- | C] () -- C:\Users\Koester\.asadminpass
  485.  
  486. [color=#E56717]========== ZeroAccess Check ==========[/color]
  487.  
  488. [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
  489.  
  490. [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  491.  
  492. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  493.  
  494. [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
  495.  
  496. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  497.  
  498. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  499. "" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
  500. "ThreadingModel" = Apartment
  501.  
  502. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  503. "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
  504. "ThreadingModel" = Apartment
  505.  
  506. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
  507. "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
  508. "ThreadingModel" = Free
  509.  
  510. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
  511. "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
  512. "ThreadingModel" = Free
  513.  
  514. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
  515. "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
  516. "ThreadingModel" = Both
  517.  
  518. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
  519.  
  520. [color=#E56717]========== LOP Check ==========[/color]
  521.  
  522. [2013.02.03 15:14:09 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\Aimersoft Video Converter Ultimate
  523. [2013.02.07 04:47:00 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\Autodesk
  524. [2012.12.03 11:57:42 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\Downloaded Installations
  525. [2013.08.20 13:36:52 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\Dropbox
  526. [2013.02.18 08:49:31 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\Gmote
  527. [2013.01.05 14:12:59 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\IMSIDesign
  528. [2013.01.28 00:43:36 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\Jubler
  529. [2013.07.21 21:26:13 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\MediaMonkey
  530. [2013.04.14 11:17:31 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\MyPhoneExplorer
  531. [2012.12.03 11:58:50 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\Nitro
  532. [2013.03.29 14:23:23 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\Nitro PDF
  533. [2013.05.17 14:18:00 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\Samsung
  534. [2011.10.31 08:12:32 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\Sports Interactive
  535. [2013.07.18 15:03:41 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\uTorrent
  536. [2013.03.08 21:09:47 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\Waterfox Limited
  537. [2013.02.03 15:14:09 | 000,000,000 | ---D | M] -- C:\Users\Koester\AppData\Roaming\{950EB46C-6AC7-4ACC-AB36-9A6A77C08B6A}
  538.  
  539. [color=#E56717]========== Purity Check ==========[/color]
  540.  
  541.  
  542.  
  543. [color=#E56717]========== Custom Scans ==========[/color]
  544.  
  545. [color=#E56717]========== Base Services ==========[/color]
  546. SRV:[b]64bit:[/b] - [2009.07.14 03:40:01 | 000,072,192 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\aelupsvc.dll -- (AeLookupSvc)
  547. SRV:[b]64bit:[/b] - [2013.02.27 07:47:10 | 000,070,144 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appinfo.dll -- (Appinfo)
  548. SRV:[b]64bit:[/b] - [2009.07.14 03:38:55 | 000,079,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\alg.exe -- (ALG)
  549. No service found with a name of BITS
  550. No service found with a name of BFE
  551. SRV:[b]64bit:[/b] - [2011.11.17 08:33:55 | 000,031,232 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\lsass.exe -- (KeyIso)
  552. SRV:[b]64bit:[/b] - [2009.07.14 03:40:50 | 000,402,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\es.dll -- (EventSystem)
  553. SRV - [2009.07.14 03:15:19 | 000,271,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\es.dll -- (EventSystem)
  554. SRV:[b]64bit:[/b] - [2012.07.05 00:13:27 | 000,136,704 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\browser.dll -- (Browser)
  555. SRV:[b]64bit:[/b] - [2013.07.09 07:46:20 | 000,184,320 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\cryptsvc.dll -- (CryptSvc)
  556. SRV - [2013.07.09 06:46:31 | 000,140,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\cryptsvc.dll -- (CryptSvc)
  557. SRV:[b]64bit:[/b] - [2010.11.20 15:27:24 | 000,512,000 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (DcomLaunch)
  558. SRV:[b]64bit:[/b] - [2010.11.20 15:26:04 | 000,317,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpcore.dll -- (Dhcp)
  559. SRV - [2010.11.20 14:18:30 | 000,254,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\dhcpcore.dll -- (Dhcp)
  560. SRV:[b]64bit:[/b] - [2011.03.03 08:24:16 | 000,183,296 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dnsrslvr.dll -- (Dnscache)
  561. SRV:[b]64bit:[/b] - [2009.07.14 03:40:35 | 000,111,104 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\eapsvc.dll -- (EapHost)
  562. SRV:[b]64bit:[/b] - [2009.07.14 03:41:00 | 000,038,912 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\hidserv.dll -- (hidserv)
  563. SRV - [2009.07.14 03:15:24 | 000,049,152 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\hidserv.dll -- (hidserv)
  564. No service found with a name of SharedAccess
  565. SRV:[b]64bit:[/b] - [2010.11.20 15:26:39 | 000,501,248 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\IPSECSVC.DLL -- (PolicyAgent)
  566. No service found with a name of MsMpSvc
  567. No service found with a name of NisSrv
  568. SRV:[b]64bit:[/b] - [2009.07.14 03:41:54 | 000,524,288 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\swprv.dll -- (swprv)
  569. SRV:[b]64bit:[/b] - [2009.07.14 03:41:26 | 000,067,584 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\mmcss.dll -- (MMCSS)
  570. SRV:[b]64bit:[/b] - [2009.07.14 03:41:52 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netman.dll -- (Netman)
  571. SRV:[b]64bit:[/b] - [2009.07.14 03:41:52 | 000,459,776 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofm.dll -- (netprofm)
  572. SRV - [2009.07.14 03:16:03 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\netprofm.dll -- (netprofm)
  573. SRV:[b]64bit:[/b] - [2012.10.03 19:44:21 | 000,303,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nlasvc.dll -- (NlaSvc)
  574. SRV:[b]64bit:[/b] - [2009.07.14 03:41:53 | 000,025,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nsisvc.dll -- (nsi)
  575. SRV:[b]64bit:[/b] - [2011.05.24 13:42:55 | 000,404,480 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\umpnpmgr.dll -- (PlugPlay)
  576. SRV:[b]64bit:[/b] - [2012.02.11 08:36:02 | 000,559,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\spoolsv.exe -- (Spooler)
  577. SRV:[b]64bit:[/b] - [2011.11.17 08:33:55 | 000,031,232 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\lsass.exe -- (ProtectedStorage)
  578. No service found with a name of EMDMgmt
  579. SRV:[b]64bit:[/b] - [2009.07.14 03:41:53 | 000,099,328 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rasauto.dll -- (RasAuto)
  580. SRV:[b]64bit:[/b] - [2010.11.20 15:27:24 | 000,344,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rasmans.dll -- (RasMan)
  581. SRV:[b]64bit:[/b] - [2010.11.20 15:27:24 | 000,512,000 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (RpcSs)
  582. SRV:[b]64bit:[/b] - [2010.11.20 15:27:25 | 000,030,720 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\seclogon.dll -- (seclogon)
  583. SRV:[b]64bit:[/b] - [2011.11.17 08:33:55 | 000,031,232 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsass.exe -- (SamSs)
  584. No service found with a name of wscsvc
  585. SRV:[b]64bit:[/b] - [2010.11.20 15:27:26 | 000,236,032 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\srvsvc.dll -- (LanmanServer)
  586. SRV:[b]64bit:[/b] - [2010.11.20 15:27:25 | 000,370,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\shsvcs.dll -- (ShellHWDetection)
  587. SRV - [2010.11.20 14:21:19 | 000,328,192 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\shsvcs.dll -- (ShellHWDetection)
  588. No service found with a name of slsvc
  589. SRV:[b]64bit:[/b] - [2010.11.20 15:27:25 | 001,110,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\schedsvc.dll -- (Schedule)
  590. SRV:[b]64bit:[/b] - [2010.11.20 15:27:26 | 000,316,928 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\tapisrv.dll -- (TapiSrv)
  591. SRV - [2010.11.20 14:21:28 | 000,242,176 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\tapisrv.dll -- (TapiSrv)
  592. SRV:[b]64bit:[/b] - [2009.07.14 03:41:55 | 000,044,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\themeservice.dll -- (Themes)
  593. SRV:[b]64bit:[/b] - [2012.05.01 07:40:20 | 000,209,920 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\profsvc.dll -- (ProfSvc)
  594. SRV:[b]64bit:[/b] - [2010.11.20 15:25:27 | 001,600,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\VSSVC.exe -- (VSS)
  595. SRV:[b]64bit:[/b] - [2010.11.20 15:25:42 | 000,679,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (AudioSrv)
  596. SRV:[b]64bit:[/b] - [2010.11.20 15:25:42 | 000,679,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (AudioEndpointBuilder)
  597. SRV:[b]64bit:[/b] - [2010.11.20 15:27:25 | 000,170,496 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sdrsvc.dll -- (SDRSVC)
  598. No service found with a name of WinDefend
  599. SRV:[b]64bit:[/b] - [2010.11.20 15:27:28 | 001,646,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wevtsvc.dll -- (eventlog)
  600. No service found with a name of MpsSvc
  601. SRV:[b]64bit:[/b] - [2010.11.20 15:27:28 | 000,580,096 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wiaservc.dll -- (stisvc)
  602. SRV:[b]64bit:[/b] - [2010.11.20 15:24:58 | 000,128,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\msiexec.exe -- (msiserver)
  603. SRV - [2010.11.20 14:17:22 | 000,073,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWow64\msiexec.exe -- (msiserver)
  604. SRV:[b]64bit:[/b] - [2009.07.14 03:41:56 | 000,242,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wbem\WMIsvc.dll -- (Winmgmt)
  605. No service found with a name of wuauserv
  606. SRV:[b]64bit:[/b] - [2010.11.20 15:26:07 | 000,252,416 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\dot3svc.dll -- (dot3svc)
  607. SRV:[b]64bit:[/b] - [2009.07.14 03:41:56 | 000,886,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wlansvc.dll -- (Wlansvc)
  608. SRV:[b]64bit:[/b] - [2010.11.20 15:27:28 | 000,118,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wkssvc.dll -- (LanmanWorkstation)
  609.  
  610. [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]
  611.  
  612. [color=#A23BEC]< c:\program files (x86)\Google\Desktop /s >[/color]
  613. [2009.07.14 07:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
  614. [2009.07.14 07:08:49 | 000,032,620 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
  615. [2013.08.20 13:08:43 | 000,000,908 | ---- | C] () -- C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
  616.  
  617. [color=#A23BEC]< c:\program files\Google\Desktop /s >[/color]
  618.  
  619. [color=#A23BEC]< dir "%systemdrive%\*" /S /A:L /C >[/color]
  620. Datentr„ger in Laufwerk C: ist SYSTEM
  621. Volumeseriennummer: 6AAC-3DBA
  622. Verzeichnis von C:\
  623. 11.04.2010 19:00 <VERBINDUNG> Documents and Settings [C:\Users]
  624. 0 Datei(en), 0 Bytes
  625. Verzeichnis von C:\Program Files\Windows Defender
  626. 12.04.2010 01:56 <SYMLINKD> de-DE [c:\windows\system32\config]
  627. 14.07.2009 07:37 <SYMLINKD> en-US [c:\windows\system32\config]
  628. 14.07.2009 03:41 <SYMLINK> MpAsDesc.dll [c:\windows\system32\config]
  629. 27.05.2013 07:50 <SYMLINK> MpClient.dll [c:\windows\system32\config]
  630. 14.07.2009 03:39 <SYMLINK> MpCmdRun.exe [c:\windows\system32\config]
  631. 27.05.2013 07:50 <SYMLINK> MpCommu.dll [c:\windows\system32\config]
  632. 14.07.2009 03:29 <SYMLINK> MpEvMsg.dll [c:\windows\system32\config]
  633. 14.07.2009 03:41 <SYMLINK> MpOAV.dll [c:\windows\system32\config]
  634. 14.07.2009 03:41 <SYMLINK> MpRTP.dll [c:\windows\system32\config]
  635. 27.05.2013 07:50 <SYMLINK> MpSvc.dll [c:\windows\system32\config]
  636. 14.07.2009 03:39 <SYMLINK> MSASCui.exe [c:\windows\system32\config]
  637. 20.11.2010 15:27 <SYMLINK> MsMpCom.dll [c:\windows\system32\config]
  638. 14.07.2009 03:29 <SYMLINK> MsMpLics.dll [c:\windows\system32\config]
  639. 14.07.2009 03:41 <SYMLINK> MsMpRes.dll [c:\windows\system32\config]
  640. 12 Datei(en), 3.919.360 Bytes
  641. Verzeichnis von C:\ProgramData
  642. 11.04.2010 19:00 <VERBINDUNG> Application Data [C:\ProgramData]
  643. 11.04.2010 19:00 <VERBINDUNG> Desktop [C:\Users\Public\Desktop]
  644. 11.04.2010 19:00 <VERBINDUNG> Documents [C:\Users\Public\Documents]
  645. 11.04.2010 19:00 <VERBINDUNG> Favorites [C:\Users\Public\Favorites]
  646. 11.04.2010 19:00 <VERBINDUNG> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
  647. 11.04.2010 19:00 <VERBINDUNG> Templates [C:\ProgramData\Microsoft\Windows\Templates]
  648. 0 Datei(en), 0 Bytes
  649. Verzeichnis von C:\Users
  650. 11.04.2010 19:00 <SYMLINKD> All Users [C:\ProgramData]
  651. 11.04.2010 19:00 <VERBINDUNG> Default User [C:\Users\Default]
  652. 0 Datei(en), 0 Bytes
  653. Verzeichnis von C:\Users\All Users
  654. 11.04.2010 19:00 <VERBINDUNG> Application Data [C:\ProgramData]
  655. 11.04.2010 19:00 <VERBINDUNG> Desktop [C:\Users\Public\Desktop]
  656. 11.04.2010 19:00 <VERBINDUNG> Documents [C:\Users\Public\Documents]
  657. 11.04.2010 19:00 <VERBINDUNG> Favorites [C:\Users\Public\Favorites]
  658. 11.04.2010 19:00 <VERBINDUNG> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
  659. 11.04.2010 19:00 <VERBINDUNG> Templates [C:\ProgramData\Microsoft\Windows\Templates]
  660. 0 Datei(en), 0 Bytes
  661. Verzeichnis von C:\Users\Default
  662. 11.04.2010 19:00 <VERBINDUNG> Application Data [C:\Users\Default\AppData\Roaming]
  663. 11.04.2010 19:00 <VERBINDUNG> Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]
  664. 11.04.2010 19:00 <VERBINDUNG> Local Settings [C:\Users\Default\AppData\Local]
  665. 11.04.2010 19:00 <VERBINDUNG> My Documents [C:\Users\Default\Documents]
  666. 11.04.2010 19:00 <VERBINDUNG> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
  667. 11.04.2010 19:00 <VERBINDUNG> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
  668. 11.04.2010 19:00 <VERBINDUNG> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
  669. 11.04.2010 19:00 <VERBINDUNG> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
  670. 11.04.2010 19:00 <VERBINDUNG> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
  671. 11.04.2010 19:00 <VERBINDUNG> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
  672. 0 Datei(en), 0 Bytes
  673. Verzeichnis von C:\Users\Default\AppData\Local
  674. 11.04.2010 19:00 <VERBINDUNG> Application Data [C:\Users\Default\AppData\Local]
  675. 11.04.2010 19:00 <VERBINDUNG> History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
  676. 11.04.2010 19:00 <VERBINDUNG> Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
  677. 0 Datei(en), 0 Bytes
  678. Verzeichnis von C:\Users\Default\Documents
  679. 11.04.2010 19:00 <VERBINDUNG> My Music [C:\Users\Default\Music]
  680. 11.04.2010 19:00 <VERBINDUNG> My Pictures [C:\Users\Default\Pictures]
  681. 11.04.2010 19:00 <VERBINDUNG> My Videos [C:\Users\Default\Videos]
  682. 0 Datei(en), 0 Bytes
  683. Verzeichnis von C:\Users\Koester
  684. 11.04.2010 19:02 <VERBINDUNG> Application Data [C:\Users\Koester\AppData\Roaming]
  685. 11.04.2010 19:02 <VERBINDUNG> Cookies [C:\Users\Koester\AppData\Roaming\Microsoft\Windows\Cookies]
  686. 11.04.2010 19:02 <VERBINDUNG> Local Settings [C:\Users\Koester\AppData\Local]
  687. 11.04.2010 19:02 <VERBINDUNG> My Documents [C:\Users\Koester\Documents]
  688. 11.04.2010 19:02 <VERBINDUNG> NetHood [C:\Users\Koester\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
  689. 11.04.2010 19:02 <VERBINDUNG> PrintHood [C:\Users\Koester\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
  690. 11.04.2010 19:02 <VERBINDUNG> Recent [C:\Users\Koester\AppData\Roaming\Microsoft\Windows\Recent]
  691. 11.04.2010 19:02 <VERBINDUNG> SendTo [C:\Users\Koester\AppData\Roaming\Microsoft\Windows\SendTo]
  692. 11.04.2010 19:02 <VERBINDUNG> Start Menu [C:\Users\Koester\AppData\Roaming\Microsoft\Windows\Start Menu]
  693. 11.04.2010 19:02 <VERBINDUNG> Templates [C:\Users\Koester\AppData\Roaming\Microsoft\Windows\Templates]
  694. 0 Datei(en), 0 Bytes
  695. Verzeichnis von C:\Users\Koester\Documents
  696. 11.04.2010 19:02 <VERBINDUNG> My Music [C:\Users\Koester\Music]
  697. 11.04.2010 19:02 <VERBINDUNG> My Pictures [C:\Users\Koester\Pictures]
  698. 11.04.2010 19:02 <VERBINDUNG> My Videos [C:\Users\Koester\Videos]
  699. 0 Datei(en), 0 Bytes
  700. Verzeichnis von C:\Users\Public\Documents
  701. 11.04.2010 19:00 <VERBINDUNG> My Music [C:\Users\Public\Music]
  702. 11.04.2010 19:00 <VERBINDUNG> My Pictures [C:\Users\Public\Pictures]
  703. 11.04.2010 19:00 <VERBINDUNG> My Videos [C:\Users\Public\Videos]
  704. 0 Datei(en), 0 Bytes
  705. Verzeichnis von C:\Users\UpdatusUser
  706. 26.04.2012 01:38 <VERBINDUNG> Application Data [C:\Users\UpdatusUser\AppData\Roaming]
  707. 26.04.2012 01:38 <VERBINDUNG> Cookies [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Cookies]
  708. 26.04.2012 01:38 <VERBINDUNG> Local Settings [C:\Users\UpdatusUser\AppData\Local]
  709. 26.04.2012 01:38 <VERBINDUNG> My Documents [C:\Users\UpdatusUser\Documents]
  710. 26.04.2012 01:38 <VERBINDUNG> NetHood [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
  711. 26.04.2012 01:38 <VERBINDUNG> PrintHood [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
  712. 26.04.2012 01:38 <VERBINDUNG> Recent [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Recent]
  713. 26.04.2012 01:38 <VERBINDUNG> SendTo [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\SendTo]
  714. 26.04.2012 01:38 <VERBINDUNG> Start Menu [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu]
  715. 26.04.2012 01:38 <VERBINDUNG> Templates [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Templates]
  716. 0 Datei(en), 0 Bytes
  717. Verzeichnis von C:\Users\UpdatusUser\AppData\Local
  718. 26.04.2012 01:38 <VERBINDUNG> Application Data [C:\Users\UpdatusUser\AppData\Local]
  719. 26.04.2012 01:38 <VERBINDUNG> History [C:\Users\UpdatusUser\AppData\Local\Microsoft\Windows\History]
  720. 26.04.2012 01:38 <VERBINDUNG> Temporary Internet Files [C:\Users\UpdatusUser\AppData\Local\Microsoft\Windows\Temporary Internet Files]
  721. 0 Datei(en), 0 Bytes
  722. Verzeichnis von C:\Users\UpdatusUser\Documents
  723. 26.04.2012 01:38 <VERBINDUNG> My Music [C:\Users\UpdatusUser\Music]
  724. 26.04.2012 01:38 <VERBINDUNG> My Pictures [C:\Users\UpdatusUser\Pictures]
  725. 26.04.2012 01:38 <VERBINDUNG> My Videos [C:\Users\UpdatusUser\Videos]
  726. 0 Datei(en), 0 Bytes
  727. Verzeichnis von C:\Windows\winsxs\amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea
  728. 14.07.2009 03:29 <SYMLINK> MpEvMsg.dll [c:\windows\system32\config]
  729. 1 Datei(en), 52.224 Bytes
  730. Verzeichnis von C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c
  731. 14.07.2009 03:41 <SYMLINK> MpAsDesc.dll [c:\windows\system32\config]
  732. 14.07.2009 03:39 <SYMLINK> MpCmdRun.exe [c:\windows\system32\config]
  733. 14.07.2009 03:41 <SYMLINK> MpOAV.dll [c:\windows\system32\config]
  734. 14.07.2009 03:41 <SYMLINK> MpRTP.dll [c:\windows\system32\config]
  735. 14.07.2009 03:39 <SYMLINK> MSASCui.exe [c:\windows\system32\config]
  736. 14.07.2009 03:29 <SYMLINK> MsMpLics.dll [c:\windows\system32\config]
  737. 14.07.2009 03:41 <SYMLINK> MsMpRes.dll [c:\windows\system32\config]
  738. 7 Datei(en), 1.907.712 Bytes
  739. Verzeichnis von C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.17316_none_b3fe3b6771a68ecd
  740. 14.07.2009 03:41 <SYMLINK> MpAsDesc.dll [c:\windows\system32\config]
  741. 14.07.2009 03:39 <SYMLINK> MpCmdRun.exe [c:\windows\system32\config]
  742. 14.07.2009 03:41 <SYMLINK> MpOAV.dll [c:\windows\system32\config]
  743. 14.07.2009 03:41 <SYMLINK> MpRTP.dll [c:\windows\system32\config]
  744. 14.07.2009 03:39 <SYMLINK> MSASCui.exe [c:\windows\system32\config]
  745. 14.07.2009 03:29 <SYMLINK> MsMpLics.dll [c:\windows\system32\config]
  746. 14.07.2009 03:41 <SYMLINK> MsMpRes.dll [c:\windows\system32\config]
  747. 7 Datei(en), 1.907.712 Bytes
  748. Verzeichnis von C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.21531_none_b46d38ce8ad8e4ed
  749. 14.07.2009 03:41 <SYMLINK> MpAsDesc.dll [c:\windows\system32\config]
  750. 14.07.2009 03:39 <SYMLINK> MpCmdRun.exe [c:\windows\system32\config]
  751. 14.07.2009 03:41 <SYMLINK> MpOAV.dll [c:\windows\system32\config]
  752. 14.07.2009 03:41 <SYMLINK> MpRTP.dll [c:\windows\system32\config]
  753. 14.07.2009 03:39 <SYMLINK> MSASCui.exe [c:\windows\system32\config]
  754. 14.07.2009 03:29 <SYMLINK> MsMpLics.dll [c:\windows\system32\config]
  755. 14.07.2009 03:41 <SYMLINK> MsMpRes.dll [c:\windows\system32\config]
  756. 7 Datei(en), 1.907.712 Bytes
  757. Verzeichnis von C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306
  758. 14.07.2009 03:41 <SYMLINK> MpAsDesc.dll [c:\windows\system32\config]
  759. 14.07.2009 03:39 <SYMLINK> MpCmdRun.exe [c:\windows\system32\config]
  760. 14.07.2009 03:41 <SYMLINK> MpOAV.dll [c:\windows\system32\config]
  761. 14.07.2009 03:41 <SYMLINK> MpRTP.dll [c:\windows\system32\config]
  762. 14.07.2009 03:39 <SYMLINK> MSASCui.exe [c:\windows\system32\config]
  763. 20.11.2010 15:27 <SYMLINK> MsMpCom.dll [c:\windows\system32\config]
  764. 14.07.2009 03:29 <SYMLINK> MsMpLics.dll [c:\windows\system32\config]
  765. 14.07.2009 03:41 <SYMLINK> MsMpRes.dll [c:\windows\system32\config]
  766. 8 Datei(en), 1.968.640 Bytes
  767. Verzeichnis von C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.18170_none_b59db7296f030a55
  768. 14.07.2009 03:41 <SYMLINK> MpAsDesc.dll [c:\windows\system32\config]
  769. 27.05.2013 07:50 <SYMLINK> MpClient.dll [c:\windows\system32\config]
  770. 14.07.2009 03:39 <SYMLINK> MpCmdRun.exe [c:\windows\system32\config]
  771. 27.05.2013 07:50 <SYMLINK> MpCommu.dll [c:\windows\system32\config]
  772. 14.07.2009 03:41 <SYMLINK> MpOAV.dll [c:\windows\system32\config]
  773. 14.07.2009 03:41 <SYMLINK> MpRTP.dll [c:\windows\system32\config]
  774. 27.05.2013 07:50 <SYMLINK> MpSvc.dll [c:\windows\system32\config]
  775. 14.07.2009 03:39 <SYMLINK> MSASCui.exe [c:\windows\system32\config]
  776. 20.11.2010 15:27 <SYMLINK> MsMpCom.dll [c:\windows\system32\config]
  777. 14.07.2009 03:29 <SYMLINK> MsMpLics.dll [c:\windows\system32\config]
  778. 14.07.2009 03:41 <SYMLINK> MsMpRes.dll [c:\windows\system32\config]
  779. 11 Datei(en), 3.867.136 Bytes
  780. Verzeichnis von C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.22341_none_b648c5e888076cca
  781. 14.07.2009 03:41 <SYMLINK> MpAsDesc.dll [c:\windows\system32\config]
  782. 14.07.2009 03:39 <SYMLINK> MpCmdRun.exe [c:\windows\system32\config]
  783. 14.07.2009 03:41 <SYMLINK> MpOAV.dll [c:\windows\system32\config]
  784. 14.07.2009 03:41 <SYMLINK> MpRTP.dll [c:\windows\system32\config]
  785. 14.07.2009 03:39 <SYMLINK> MSASCui.exe [c:\windows\system32\config]
  786. 20.11.2010 15:27 <SYMLINK> MsMpCom.dll [c:\windows\system32\config]
  787. 14.07.2009 03:29 <SYMLINK> MsMpLics.dll [c:\windows\system32\config]
  788. 14.07.2009 03:41 <SYMLINK> MsMpRes.dll [c:\windows\system32\config]
  789. 8 Datei(en), 1.968.640 Bytes
  790. Anzahl der angezeigten Dateien:
  791. 61 Datei(en), 17.499.136 Bytes
  792. 65 Verzeichnis(se), 33.337.266.176 Bytes frei
  793.  
  794. [color=#A23BEC]< hklm\software\clients\startmenuinternet|command /rs >[/color]
  795. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show
  796. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall
  797. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide
  798. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2013.07.26 08:23:39 | 000,775,256 | ---- | M] (Microsoft Corporation)
  799. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2013.07.26 08:23:39 | 000,775,256 | ---- | M] (Microsoft Corporation)
  800. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Waterfox\uninstall\helper.exe" /HideShortcuts [2013.01.20 00:26:16 | 000,844,016 | ---- | M] (waterfoxproject.org)
  801. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Waterfox\uninstall\helper.exe" /ShowShortcuts [2013.01.20 00:26:16 | 000,844,016 | ---- | M] (waterfoxproject.org)
  802. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Waterfox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2013.01.20 00:26:16 | 000,844,016 | ---- | M] (waterfoxproject.org)
  803. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\shell\open\command\\: C:\Program Files\Waterfox\waterfox.exe [2013.01.20 00:26:15 | 000,718,960 | ---- | M] (Mozilla Corporation)
  804. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\shell\properties\command\\: "C:\Program Files\Waterfox\waterfox.exe" -preferences [2013.01.20 00:26:15 | 000,718,960 | ---- | M] (Mozilla Corporation)
  805. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\shell\safemode\command\\: "C:\Program Files\Waterfox\waterfox.exe" -safe-mode [2013.01.20 00:26:15 | 000,718,960 | ---- | M] (Mozilla Corporation)
  806.  
  807. [color=#A23BEC]< hklm\software\clients\startmenuinternet|command /64 /rs >[/color]
  808. 64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\SYSTEM32\IE4UINIT.EXE" -SHOW [2013.07.26 07:13:58 | 000,051,712 | ---- | M] (Microsoft Corporation)
  809. 64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\SYSTEM32\IE4UINIT.EXE" -REINSTALL [2013.07.26 07:13:58 | 000,051,712 | ---- | M] (Microsoft Corporation)
  810. 64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\SYSTEM32\IE4UINIT.EXE" -HIDE [2013.07.26 07:13:58 | 000,051,712 | ---- | M] (Microsoft Corporation)
  811. 64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE" -EXTOFF [2013.07.26 08:23:39 | 000,775,256 | ---- | M] (Microsoft Corporation)
  812. 64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE [2013.07.26 08:23:39 | 000,775,256 | ---- | M] (Microsoft Corporation)
  813. 64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\InstallInfo\\HideIconsCommand: "C:\PROGRAM FILES\WATERFOX\UNINSTALL\HELPER.EXE" /HIDESHORTCUTS [2013.01.20 00:26:16 | 000,844,016 | ---- | M] (waterfoxproject.org)
  814. 64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\PROGRAM FILES\WATERFOX\UNINSTALL\HELPER.EXE" /SHOWSHORTCUTS [2013.01.20 00:26:16 | 000,844,016 | ---- | M] (waterfoxproject.org)
  815. 64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\InstallInfo\\ReinstallCommand: "C:\PROGRAM FILES\WATERFOX\UNINSTALL\HELPER.EXE" /SETASDEFAULTAPPGLOBAL [2013.01.20 00:26:16 | 000,844,016 | ---- | M] (waterfoxproject.org)
  816. 64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\shell\open\command\\: C:\PROGRAM FILES\WATERFOX\WATERFOX.EXE [2013.01.20 00:26:15 | 000,718,960 | ---- | M] (Mozilla Corporation)
  817. 64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\shell\properties\command\\: "C:\PROGRAM FILES\WATERFOX\WATERFOX.EXE" -PREFERENCES [2013.01.20 00:26:15 | 000,718,960 | ---- | M] (Mozilla Corporation)
  818. 64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\WATERFOX.EXE\shell\safemode\command\\: "C:\PROGRAM FILES\WATERFOX\WATERFOX.EXE" -SAFE-MODE [2013.01.20 00:26:15 | 000,718,960 | ---- | M] (Mozilla Corporation)
  819.  
  820. [color=#E56717]========== Alternate Data Streams ==========[/color]
  821.  
  822. @Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:E690114B
  823. @Alternate Data Stream - 174 bytes -> C:\ProgramData\TEMP:73D40B90
  824. @Alternate Data Stream - 159 bytes -> C:\ProgramData\TEMP:F297470E
  825. @Alternate Data Stream - 128 bytes -> C:\Windows:nlsPreferences
  826. @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:A5B56640
  827.  
  828. < End of report >
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!