Window 7 / Firefox stürzt seit Tagen ständig ab, Verdacht auf Malware?
 

Hallo,

ich hoffe Ihr könnte mir helfen. Wenn ja und dauerhaft ohne kompletten systemreset werde ich einen 2-3stelligen Betrag an Euch spenden da (verlorene) Zeit Geld ist. Nach dem ich alles was rund um Firefox möglich ist getan habe, fällt der Verdacht auf Malware. Faktenlage:

- Rechner W7, Firefox stürzt nach wenigen Minuten bis Stunden Betrieb ab
- Crash-Report verfügbar, Situation so seit mehreren Tagen ohne erinnerbaren Anlass
- sämtliche Fehlerbehebungsmassnahmen der Mozillapage wurden abgearbeitet:
- starten in save modus, refresh und ohne add-ons usw.
- kompletter deinstall, re-install und neustart clean ohne Altlasten

Kein Erfolg. FFox stürzt immer wieder ab. Betreibe Vollversion Symantec Endpoint Protection sowie Malwarebytes seit Jahren immer aktuell. Full-scans heute morgen ohne Erfolg.

Habe defogger gemacht. OTL hat aber nur OTL.txt ausgeworfen, keine Extra.txt. Gmer läuft nicht durch und wird unter Fehlermeldung beendet. Ich habe nach Neustart keine Prg. laufen, alles wie in eurer Anleitung und berühre den Rechner nicht. Nach 5-10 Minuten fullscan kommt die Fehlermeldung "Programm wird beendet". Habe es 3x probiert und vorher jegliches ausschaltbares Programm ausgeschaltet.

Die einzige Auffälligkeit für mich als Laie ist: im Task Manager ist der Firefox Prozess der einzige der keine "Description" ganz rechts im Task Manager hat. Dort ist blank, statt wie sonst eben "Firefox". Viell. hängt dies auch damit zusammen, dass im OTL.txt unten bei den Mozilla logs auch "no name found" steht ?

Danke für eine baldige Hilfe. Auch wie ich den gmer und das extra.txt produzieren kann für Euch.

Hier die Anhänge:

************************************
OTL logfile created on: 04.06.2013 19:01:46 - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\IBM_ADMIN\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy

7,89 Gb Total Physical Memory | 2,95 Gb Available Physical Memory | 37,46% Memory free
15,77 Gb Paging File | 12,29 Gb Available in Paging File | 77,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 298,09 Gb Total Space | 69,81 Gb Free Space | 23,42% Space Free | Partition Type: NTFS
Drive G: | 298,06 Gb Total Space | 176,83 Gb Free Space | 59,33% Space Free | Partition Type: NTFS

Computer Name: IBM-IF34NF70CTV | User Name: xxxxxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.06.04 18:56:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe
PRC - [2013.06.04 18:24:53 | 000,917,400 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013.04.04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013.01.15 19:46:09 | 000,184,528 | ---- | M] (IBM Corp.) -- c:\sdwork\issimsvc.exe
PRC - [2012.11.07 18:28:31 | 000,326,968 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\C4ebreg\isamtray.exe
PRC - [2012.11.07 18:27:16 | 000,511,288 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\C4ebreg\c4ebreg.exe
PRC - [2012.07.21 16:05:20 | 001,588,544 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe
PRC - [2012.07.21 16:05:14 | 003,935,944 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\PGPtray.exe
PRC - [2011.12.05 20:49:22 | 004,678,552 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
PRC - [2011.12.05 20:49:22 | 001,471,896 | ---- | M] (IBM Corp.) -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe
PRC - [2011.12.01 04:05:00 | 000,064,576 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
PRC - [2011.11.17 02:36:22 | 001,231,472 | ---- | M] (ACD Systems) -- C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe
PRC - [2011.11.14 00:43:12 | 000,180,848 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-unity-helper.exe
PRC - [2011.11.14 00:43:10 | 004,118,128 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmplayer.exe
PRC - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe
PRC - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe
PRC - [2011.11.13 23:36:38 | 000,011,264 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vprintproxy.exe
PRC - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
PRC - [2011.09.16 09:31:34 | 000,189,832 | ---- | M] (IBM Corp) -- c:\notes\SUService.exe
PRC - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe
PRC - [2011.07.22 13:21:34 | 000,060,264 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
PRC - [2011.07.22 13:21:32 | 000,042,344 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
PRC - [2011.07.22 13:21:18 | 000,041,832 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe
PRC - [2011.05.27 02:43:12 | 000,328,040 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2011.05.19 12:00:40 | 002,062,680 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
PRC - [2011.04.19 17:12:22 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2011.04.19 17:12:18 | 000,408,576 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
PRC - [2011.04.14 20:24:26 | 000,410,984 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
PRC - [2011.04.14 20:22:42 | 000,361,832 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
PRC - [2011.04.14 20:22:36 | 000,193,896 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe
PRC - [2011.04.14 20:22:30 | 000,431,464 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe
PRC - [2011.04.14 20:22:28 | 000,263,528 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
PRC - [2011.04.14 20:22:26 | 000,124,264 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
PRC - [2011.04.07 23:41:32 | 000,138,680 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\ZOOM\TpScrex.exe
PRC - [2011.04.04 17:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\micmute.exe
PRC - [2011.03.29 20:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
PRC - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2011.03.24 22:11:32 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe
PRC - [2011.03.24 22:11:30 | 001,839,776 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe
PRC - [2011.03.24 22:11:30 | 000,050,544 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe
PRC - [2011.02.18 12:47:12 | 000,079,192 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2011.02.17 22:49:12 | 000,577,536 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
PRC - [2010.09.09 19:40:38 | 000,079,200 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe
PRC - [2010.09.09 19:40:24 | 000,476,000 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe
PRC - [2010.09.09 19:40:02 | 000,349,536 | ---- | M] (AT&T) -- C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe
PRC - [2010.04.07 21:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
PRC - [2010.04.01 21:50:44 | 000,043,960 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
PRC - [2009.06.18 16:19:30 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2009.04.27 14:37:18 | 000,025,256 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe
PRC - [2008.09.18 09:30:54 | 000,122,880 | ---- | M] () -- C:\Windows\wrtService.exe
PRC - [2006.11.22 11:11:24 | 000,082,864 | ---- | M] (Lexmark International Inc.) -- C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe
PRC - [2006.11.22 11:11:22 | 000,291,760 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe


========== Modules (No Company Name) ==========

MOD - [2013.06.04 18:24:53 | 002,401,688 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2013.05.27 08:09:32 | 002,297,856 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\3c2ed368e1f3889997dfb42a5ca77284\System.Core.ni.dll
MOD - [2013.05.27 08:09:18 | 000,181,248 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Common\087705bc24370a204f2c6255fc68ad0e\Vodafone.Common.ni.dll
MOD - [2013.05.27 08:09:17 | 000,673,280 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Data\d509111dd6accedf8942eb2b6b83fec6\Vodafone.Data.ni.dll
MOD - [2013.05.26 20:24:57 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5dabd015d753b028750e4853dde12178\System.Windows.Forms.ni.dll
MOD - [2013.05.26 20:24:49 | 003,347,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll
MOD - [2013.05.26 20:24:45 | 000,687,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\23673bbebe3c0ca7c894e614bb3ffd1a\System.Security.ni.dll
MOD - [2013.05.26 20:24:40 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013.02.18 12:00:50 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Manag#\6c4e587713b061a12ee470864ca4fb97\Vodafone.View.ManagedToolTip.ni.dll
MOD - [2013.02.18 12:00:49 | 000,876,544 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Shared\0e762a83572c331f3475b6c20722f4fb\Vodafone.View.Shared.ni.dll
MOD - [2013.02.18 12:00:45 | 000,606,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Secon#\32cf63de2f013751cd1874dc1fd9debf\Vodafone.View.SecondaryWindows.ni.dll
MOD - [2013.02.18 12:00:43 | 000,031,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\cc6f7fbebb0748b98dfce775d95005c6\Vodafone.DeviceAccess.Factory.ni.dll
MOD - [2013.02.18 12:00:42 | 000,499,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\fd8de9d227b25a729338f4fdca7571b0\Vodafone.DeviceAccess.Internals.ni.dll
MOD - [2013.02.18 12:00:40 | 000,674,304 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\b53a516b601a9dc1c183a48339e7a92e\Vodafone.ConnectionServices.ni.dll
MOD - [2013.02.18 12:00:37 | 000,050,176 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\c3058f2d5d8b4717e85d530f54463e0d\Vodafone.Contracts.Adapter.ni.dll
MOD - [2013.02.18 12:00:32 | 001,304,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\eb027595e692626525390ae831f4934e\Infragistics2.Win.UltraWinEditors.v9.2.ni.dll
MOD - [2013.02.18 12:00:29 | 003,348,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.M#\2a1a484a011c63a38d01cba92f641890\Infragistics2.Win.Misc.v9.2.ni.dll
MOD - [2013.02.18 12:00:22 | 011,053,056 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.v#\9c3e7a0a80452bab80237eafcc576389\Infragistics2.Win.v9.2.ni.dll
MOD - [2013.02.18 12:00:02 | 000,871,424 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Share#\8edb485e7273579bb217330f8ba7fb98\Infragistics2.Shared.v9.2.ni.dll
MOD - [2013.02.18 11:59:59 | 007,137,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Infragistics2.Win.U#\4c43791aeb4aede26a3bd89d86bc89b5\Infragistics2.Win.UltraWinToolbars.v9.2.ni.dll
MOD - [2013.02.18 11:59:46 | 000,037,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\74f8482ed000aed6d9057d4f2d5dc2f3\Vodafone.Contracts.Presenter.ni.dll
MOD - [2013.02.18 11:59:45 | 000,132,608 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\5f8ef1464fd770130f9715f485bf94bc\Vodafone.Contracts.Model.ni.dll
MOD - [2013.02.18 11:59:44 | 000,105,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\acb2ca5e34236615024edcdcc4fa6b2b\Vodafone.Contracts.View.ni.dll
MOD - [2013.02.18 11:59:43 | 000,094,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\9ec5cec32e8e823f78144fcb9a47fb64\Vodafone.Contracts.Common.ni.dll
MOD - [2013.02.18 11:59:39 | 000,342,016 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.CommonDial#\30b0a9cd1f814f94fa0de09349a7e4d7\Vodafone.CommonDialogs.ni.dll
MOD - [2013.02.18 11:59:37 | 000,947,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Applicatio#\6a874bbee313ab4f3ab630a2e6855d58\Vodafone.ApplicationHost.Impl.ni.dll
MOD - [2013.02.18 11:59:34 | 000,326,656 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DataAccess#\d9173324d53199cabf7f663060356804\Vodafone.DataAccessor.ni.dll
MOD - [2013.02.18 11:59:16 | 000,158,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Contr#\0a6abb05d1f030b0aca6c78857f130ae\Vodafone.Base.Contracts.ni.dll
MOD - [2013.02.18 11:59:13 | 001,368,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Platform\7ee6c9cdec2c6eee428213bb5646b97c\Vodafone.Platform.ni.dll
MOD - [2013.02.18 11:59:09 | 000,283,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\MobileBroadband\e6c36364416e40614eac2b777471961d\MobileBroadband.ni.exe
MOD - [2013.02.17 17:50:08 | 000,212,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\7ff638de44686eab4afaa8b3c8a9cfca\System.ServiceProcess.ni.dll
MOD - [2013.01.16 14:13:48 | 001,065,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\d602f7a5bbd392dddbc07c2f5f083a11\System.Management.ni.dll
MOD - [2013.01.16 14:13:43 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d908c91e24616e6b8d38c9da61038b25\Accessibility.ni.dll
MOD - [2013.01.16 14:13:32 | 005,459,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\fa022967bdd1030211f9cadcab797520\System.Xml.ni.dll
MOD - [2013.01.16 14:13:27 | 007,989,760 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.16 14:13:08 | 000,774,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\83265111769de5cd294df17e6d762958\System.Runtime.Remoting.ni.dll
MOD - [2013.01.16 14:13:07 | 000,627,712 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\7e584aeb8aa941f7f9bce2a31ea750f0\System.Transactions.ni.dll
MOD - [2013.01.16 14:13:06 | 006,638,592 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\81f61d2c8af0d34385679aa2465c609a\System.Data.ni.dll
MOD - [2013.01.16 14:12:40 | 012,678,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\09594e500a32cd9a1e4ddf33b45b4e44\PresentationCore.ni.dll
MOD - [2013.01.16 10:25:55 | 000,080,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsProfile#\037db27d8cacfabe7ed7b999e14552c4\Vodafone.SmsProfileManager.ni.dll
MOD - [2013.01.16 10:25:55 | 000,031,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.OutlookCon#\8c256f277b654a2421f817711d72a72f\Vodafone.OutlookConnector.ni.dll
MOD - [2013.01.16 10:25:45 | 000,321,536 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Win32\4fc713e9bd132a9c0e0b177b9eceddf3\Vodafone.Base.Win32.ni.dll
MOD - [2013.01.16 10:25:45 | 000,197,120 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsContact#\2e27dae10259458ed19ab28802d6d435\Vodafone.SmsContactManager.ni.dll
MOD - [2013.01.15 22:16:27 | 000,252,928 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.FNCClient11#\fd734656ee66b5253483a686d6d679d8\Interop.FNCClient11Lib.ni.dll
MOD - [2013.01.15 22:16:26 | 000,219,648 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Conn#\9365c6b816ac5d118accc3e870ec8759\Vodafone.Model.Connection.ni.dll
MOD - [2013.01.15 22:16:26 | 000,033,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.UpdateMana#\ec56e9bcdd353278994778ebfa8f5aab\Vodafone.UpdateManager.ni.dll
MOD - [2013.01.15 22:16:23 | 000,082,432 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Remot#\552e346f1bc27fa324a710072104ab0f\Vodafone.Core.Remoting.ni.dll
MOD - [2013.01.15 22:16:23 | 000,054,784 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.TrafficOpt#\f6bb1fbd008e4be503a15a0633fa694b\Vodafone.TrafficOptimiser.ni.dll
MOD - [2013.01.15 22:16:23 | 000,024,064 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.CoreI#\06cf2695acff680bd5008e4bd1cb5375\Vodafone.Core.CoreInstanceProvider.ni.dll
MOD - [2013.01.15 22:16:22 | 000,119,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\d65e3892ff3bfd90b6b37f7ef0c8761c\Interop.Shell32.ni.dll
MOD - [2013.01.15 22:16:22 | 000,106,496 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LanWlanMan#\c1a004ae9c01857bccbdaa343e885422\Vodafone.LanWlanManager.ni.dll
MOD - [2013.01.15 22:16:22 | 000,072,704 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Vpn\1f2f44b9c1e6f8d028b5005fc7658972\Vodafone.Vpn.ni.dll
MOD - [2013.01.15 22:16:21 | 000,393,728 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MbbManagem#\64bd72f4e684ee7fd460fe4c65f2bc0d\Vodafone.MbbManagement.ni.dll
MOD - [2013.01.15 22:16:21 | 000,081,408 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Interop.MbnApi\f450d8d019b097372ed1dea56de0e5a2\Interop.MbnApi.ni.dll
MOD - [2013.01.15 22:16:21 | 000,039,936 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\e3be5dd41dd4f191b99353a091afbb2f\Vodafone.DeviceAccess.Interfaces.ni.dll
MOD - [2013.01.15 22:16:20 | 000,733,696 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.WwanWrapper\657dd7faab285319de359b2fa0706558\Vodafone.WwanWrapper.ni.dll
MOD - [2013.01.15 22:16:19 | 000,020,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Inter#\f70562c22e9a0d5d45171b13d6c56b7f\Vodafone.Core.Interfaces.ni.dll
MOD - [2013.01.15 22:16:18 | 000,942,080 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.BusinessLo#\02c5bea3c3542435991367afd45d0ae9\Vodafone.BusinessLogic.ni.dll
MOD - [2013.01.15 22:16:17 | 002,110,976 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Spring.Core\b559dd7a2b0f458d9e89412c4728b824\Spring.Core.ni.dll
MOD - [2013.01.15 22:16:17 | 000,047,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Common.Logging\e1f5430a5664ac36d30136ffe1339bc2\Common.Logging.ni.dll
MOD - [2013.01.15 22:16:15 | 000,042,496 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.InstancePr#\eb9e8b0000726b973085e44c1e8e3ec8\Vodafone.InstanceProvider.Impl.ni.dll
MOD - [2013.01.15 22:15:59 | 000,098,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Core.Contr#\4648622b8786e9df320724f55d507421\Vodafone.Core.Contracts.ni.dll
MOD - [2013.01.15 22:15:59 | 000,026,112 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceAcce#\e5f971684a0cfdbade27c8a77b94c1dc\Vodafone.DeviceAccess.Contracts.ni.dll
MOD - [2013.01.15 22:15:58 | 000,089,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Inter#\cce3a30a9dc0d6b0d0817ac8c539cb1c\Vodafone.Base.Internals.ni.dll
MOD - [2013.01.15 22:15:58 | 000,017,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Facto#\5ea47d1f504e95a19ea37b2d56bb32bd\Vodafone.Base.Factory.ni.dll
MOD - [2013.01.15 22:15:57 | 000,153,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\014e1457c2135de51d117bb23bde328c\Vodafone.ConnectionManagement.ni.dll
MOD - [2013.01.15 22:15:55 | 000,350,208 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.ReportingM#\8e36bfb3548a969d0431c4c7f6d273e9\Vodafone.ReportingManager.ni.dll
MOD - [2013.01.15 22:15:53 | 000,055,296 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SettingsMa#\378a6b2759e2c491e34cc6cfef7a46d6\Vodafone.SettingsManager.ni.dll
MOD - [2013.01.15 22:15:52 | 000,074,240 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.NtServiceM#\7bebcfbb3c250b011b8b5e70a3e15cba\Vodafone.NtServiceMessaging.ni.dll
MOD - [2013.01.15 22:15:51 | 002,003,456 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\MobileBroadbandReso#\36c482b2fb56d28a66adf894213b43df\MobileBroadbandResources.ni.dll
MOD - [2013.01.15 22:15:31 | 000,019,456 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MobileBroa#\a898a34cb3613fe42c5a502f01773c2e\Vodafone.MobileBroadband.CallbackHandler.ni.dll
MOD - [2013.01.15 22:15:26 | 000,096,256 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LogEngine\a455bcf66b06fd85fd03f7560979b37f\Vodafone.LogEngine.ni.dll
MOD - [2013.01.15 19:06:15 | 001,597,440 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\229b5280b4e310f5e83657abbf257632\System.Drawing.ni.dll
MOD - [2013.01.15 19:05:50 | 011,493,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2012.12.12 07:32:26 | 005,025,792 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2012.10.05 12:53:24 | 003,198,976 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2012.10.05 12:53:24 | 000,630,784 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2012.08.31 12:59:19 | 004,550,656 | ---- | M] () -- C:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
MOD - [2011.11.14 00:43:22 | 000,329,328 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libcurl.dll
MOD - [2011.11.14 00:43:18 | 000,144,496 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\liblber.dll
MOD - [2011.11.14 00:43:18 | 000,122,992 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libcds.dll
MOD - [2011.11.14 00:43:16 | 001,229,424 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
MOD - [2011.11.14 00:43:06 | 000,317,552 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\libldap_r.dll
MOD - [2011.11.14 00:43:00 | 000,069,232 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\zlib1.dll
MOD - [2011.11.14 00:42:44 | 000,644,720 | ---- | M] () -- C:\Program Files (x86)\VMware\VMware Player\glibmm-2.4.dll
MOD - [2011.04.19 17:12:12 | 000,308,736 | ---- | M] () -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\Vodafone.View.Taskbar.dll
MOD - [2011.04.14 19:15:52 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
MOD - [2010.11.05 03:58:14 | 002,048,000 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2010.11.05 03:58:10 | 000,303,104 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2010.11.05 03:58:04 | 000,425,984 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
MOD - [2009.07.14 03:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\SysWOW64\msjetoledb40.dll
MOD - [2009.06.10 23:23:19 | 000,261,632 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2009.06.10 23:22:40 | 000,010,752 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
MOD - [2009.04.27 14:37:18 | 000,025,256 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe
MOD - [2008.05.16 13:35:22 | 000,040,960 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.Monitor.Core.dll
MOD - [2008.05.16 13:35:22 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.Monitor.Common.dll
MOD - [2008.05.16 13:34:18 | 000,057,344 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.MCMDevMon.dll
MOD - [2007.04.30 09:20:26 | 000,011,776 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.MCMDevMon.AutoPlayUtil.dll
MOD - [2007.04.30 09:19:52 | 000,020,480 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.ScanDevMon.dll
MOD - [2007.04.30 09:19:48 | 000,020,480 | ---- | M] () -- C:\Program Files (x86)\Lexmark 2500 Series\App4R.DevMons.NetworkCardDevMon.dll
MOD - [2006.11.22 11:11:22 | 000,291,760 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe
MOD - [2006.08.08 17:54:18 | 000,278,528 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctscw.dll
MOD - [2006.06.09 04:39:54 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\lxctdrec.dll
MOD - [2006.05.25 18:20:44 | 000,241,664 | ---- | M] () -- C:\Program Files (x86)\Lexmark 5400 Series\iptk.dll


========== Services (SafeList) ==========

SRV:64bit: - [2013.05.01 17:02:26 | 002,280,960 | ---- | M] (Proxy Labs) [Auto | Running] -- C:\Program Files\Proxy Labs\ProxyCap\pcapsvc.exe -- (pcapsvc)
SRV:64bit: - [2012.12.11 07:22:08 | 000,060,272 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC)
SRV:64bit: - [2011.10.17 16:48:24 | 000,970,016 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2011.08.08 08:39:18 | 001,166,848 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3)
SRV:64bit: - [2011.07.27 22:04:48 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2011.07.27 21:44:18 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2011.07.22 13:21:34 | 000,060,264 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe -- (LENOVO.TPKNRSVC)
SRV:64bit: - [2011.07.22 13:21:18 | 000,041,832 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\Communications Utility\CamMute.exe -- (LENOVO.CAMMUTE)
SRV:64bit: - [2011.06.03 13:51:38 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr)
SRV:64bit: - [2011.04.20 17:04:38 | 000,144,232 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD)
SRV:64bit: - [2011.04.04 17:27:20 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)
SRV:64bit: - [2011.03.29 20:41:08 | 000,064,952 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)
SRV:64bit: - [2011.03.29 20:15:36 | 000,047,728 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Windows\SysNative\TPHDEXLG64.exe -- (TPHDEXLGSVC)
SRV:64bit: - [2010.04.07 21:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2007.05.25 10:42:22 | 000,034,224 | ---- | M] () [Auto | Stopped] -- C:\windows\SysNative\spool\DRIVERS\x64\3\\lxddserv.exe -- (lxddCATSCustConnectService)
SRV:64bit: - [2007.05.25 10:42:12 | 000,567,216 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxddcoms.exe -- (lxdd_device)
SRV:64bit: - [2006.11.22 11:11:54 | 000,566,192 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxctcoms.exe -- (lxct_device)
SRV - [2013.06.04 18:24:53 | 000,116,632 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.28 08:45:11 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013.01.15 19:46:09 | 000,184,528 | ---- | M] (IBM Corp.) [Auto | Running] -- c:\sdwork\issimsvc.exe -- (ISSIMon)
SRV - [2012.11.07 18:27:16 | 000,511,288 | ---- | M] (IBM Corp.) [Auto | Running] -- C:\Program Files (x86)\C4ebreg\c4ebreg.exe -- (ISAMSvc)
SRV - [2012.07.21 16:05:20 | 001,588,544 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\PGP Corporation\PGP Desktop\RDDService.exe -- (PGP RDD Service)
SRV - [2012.07.19 14:38:28 | 004,448,256 | ---- | M] (IBM) [Auto | Stopped] -- c:\notes\nsd.exe -- (Lotus Notes Diagnostics)
SRV - [2012.02.09 16:30:04 | 000,745,472 | ---- | M] (IBM Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\IBM\Tivoli\Remote Control\Target\trc_base.exe -- (TRCTARGET)
SRV - [2011.12.05 20:49:22 | 004,678,552 | ---- | M] (IBM Corp.) [Auto | Running] -- C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe -- (BESClient)
SRV - [2011.12.01 04:05:00 | 000,478,056 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE -- (DozeSvc)
SRV - [2011.12.01 04:05:00 | 000,175,168 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe -- (PwmEWSvc)
SRV - [2011.12.01 04:05:00 | 000,089,152 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)
SRV - [2011.11.14 00:42:54 | 000,354,416 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2011.11.14 00:42:52 | 000,433,264 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service)
SRV - [2011.11.13 22:49:40 | 000,079,872 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2011.09.16 09:31:34 | 000,189,832 | ---- | M] (IBM Corp) [Auto | Running] -- c:\notes\SUService.exe -- (LNSUSvc)
SRV - [2011.09.16 09:29:18 | 000,071,048 | ---- | M] (IBM Corp) [Auto | Stopped] -- c:\notes\ntmulti.exe -- (Multi-user Cleanup Service)
SRV - [2011.08.29 23:11:04 | 000,846,448 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe -- (VMUSBArbService)
SRV - [2011.07.26 00:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService)
SRV - [2011.04.19 17:12:22 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2011.04.14 20:22:28 | 000,263,528 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe -- (AcSvc)
SRV - [2011.04.14 20:22:26 | 000,124,264 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe -- (AcPrfMgrSvc)
SRV - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2011.03.24 22:11:34 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2011.03.24 22:11:32 | 000,428,912 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE -- (SNAC)
SRV - [2011.03.24 22:11:30 | 003,249,768 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)
SRV - [2011.03.24 22:11:30 | 001,839,776 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2010.09.09 19:40:38 | 000,079,200 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\NetLogSvc.exe -- (NetLogSvc)
SRV - [2010.09.09 19:40:24 | 000,476,000 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\netcfgsvr.exe -- (netcfgsvr)
SRV - [2010.09.09 19:40:02 | 000,349,536 | ---- | M] (AT&T) [Auto | Running] -- C:\Program Files (x86)\AT&T Network Client\NetClientSvc.exe -- (NetClientSvc)
SRV - [2010.09.07 22:05:51 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.18 16:19:30 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.04.29 02:00:00 | 000,436,736 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\XAudio64.dll -- (HsfXAudioService)
SRV - [2008.09.18 09:30:54 | 000,122,880 | ---- | M] () [Auto | Running] -- C:\Windows\wrtService.exe -- (WRTService)
SRV - [2007.05.25 10:42:22 | 000,034,224 | ---- | M] () [Auto | Stopped] -- C:\windows\system32\spool\DRIVERS\x64\3\\lxddserv.exe -- (lxddCATSCustConnectService)
SRV - [2007.05.25 10:41:38 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxddcoms.exe -- (lxdd_device)
SRV - [2006.11.22 11:11:36 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxctcoms.exe -- (lxct_device)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AnyDVD.sys -- (AnyDVD)
DRV:64bit: - [2013.04.04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013.03.04 14:24:27 | 000,040,344 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2012.12.11 07:22:08 | 000,042,824 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV)
DRV:64bit: - [2012.09.30 18:05:08 | 000,233,120 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wpshelper.sys -- (WpsHelper)
DRV:64bit: - [2012.09.27 07:00:40 | 000,052,320 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0)
DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.07.21 16:05:34 | 000,015,848 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\PGPwdefs.sys -- (Pgpwdefs)
DRV:64bit: - [2012.07.21 16:05:32 | 000,372,704 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\PGPwded.sys -- (PGPwded)
DRV:64bit: - [2012.07.21 16:05:30 | 000,051,856 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\PGPsdk.sys -- (PGPsdkDriver)
DRV:64bit: - [2012.07.21 16:05:22 | 000,273,848 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\windows\SysNative\drivers\PGPdisk.sys -- (PGPdisk)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.20 15:28:25 | 000,039,552 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tcpipBM.sys -- (tcpipBM)
DRV:64bit: - [2012.02.20 15:28:25 | 000,016,512 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BMLoad.sys -- (BMLoad)
DRV:64bit: - [2011.12.01 04:05:00 | 000,031,344 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\DZHDD64.SYS -- (DzHDD64)
DRV:64bit: - [2011.12.01 04:05:00 | 000,014,960 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\TPPWR64V.SYS -- (TPPWRIF)
DRV:64bit: - [2011.11.14 00:43:36 | 000,063,088 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86)
DRV:64bit: - [2011.11.14 00:42:40 | 000,032,880 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd)
DRV:64bit: - [2011.11.14 00:42:12 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV:64bit: - [2011.11.13 22:33:56 | 000,045,680 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV:64bit: - [2011.11.13 22:33:56 | 000,020,080 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV:64bit: - [2011.10.17 17:24:50 | 000,437,288 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (BTWAMPFL)
DRV:64bit: - [2011.10.17 17:24:44 | 000,164,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2011.10.17 17:24:44 | 000,146,984 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2011.10.17 17:24:44 | 000,039,976 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2011.10.17 17:24:44 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2011.10.03 23:46:40 | 001,577,088 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2011.09.26 03:40:28 | 012,309,440 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011.08.29 23:11:04 | 000,039,024 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon)
DRV:64bit: - [2011.08.29 23:01:10 | 000,037,680 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmusb.sys -- (vmusb)
DRV:64bit: - [2011.08.23 07:12:56 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2011.08.08 15:59:12 | 000,116,336 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci)
DRV:64bit: - [2011.08.08 08:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP)
DRV:64bit: - [2011.08.08 08:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL)
DRV:64bit: - [2011.08.04 16:45:24 | 000,341,680 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress)
DRV:64bit: - [2011.08.03 18:28:32 | 008,604,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64)
DRV:64bit: - [2011.05.25 18:23:00 | 000,101,888 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdxc64.sys -- (risdxc)
DRV:64bit: - [2011.04.18 16:43:30 | 000,086,528 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gt72ubus.sys -- (GT72UBUS)
DRV:64bit: - [2011.04.18 16:43:28 | 000,130,048 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Gt51Ip.sys -- (GT72NDISIPXP)
DRV:64bit: - [2011.04.18 16:43:28 | 000,010,496 | ---- | M] (Option N.V.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gtptser.sys -- (GTPTSER)
DRV:64bit: - [2011.04.18 16:43:26 | 000,085,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:64bit: - [2011.03.29 20:13:40 | 000,139,888 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsX64.sys -- (Shockprf)
DRV:64bit: - [2011.03.29 20:11:48 | 000,023,664 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ApsHM64.sys -- (TPDIGIMN)
DRV:64bit: - [2011.03.28 21:52:12 | 000,173,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2011.03.25 02:00:00 | 001,423,408 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011.03.24 22:11:36 | 000,053,808 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\WPSDRVnt.sys -- (WPS)
DRV:64bit: - [2011.03.24 22:11:34 | 000,482,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\srtspl64.sys -- (SRTSPL)
DRV:64bit: - [2011.03.24 22:11:34 | 000,449,072 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2011.03.24 22:11:34 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\srtspx64.sys -- (SRTSPX)
DRV:64bit: - [2011.03.24 22:11:32 | 000,064,048 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Teefer2.sys -- (Teefer2)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.05 02:00:00 | 000,166,016 | ---- | M] (Ricoh co.,Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\5U877.sys -- (5U877)
DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2011.02.16 19:23:46 | 000,074,240 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.10 02:00:00 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.12.10 02:00:00 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.12.02 02:00:00 | 000,101,416 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\l36wgps64.sys -- (l36wgps)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 11:57:43 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.05 02:00:00 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iastor)
DRV:64bit: - [2010.10.31 02:00:00 | 000,419,912 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Mbm3DevMt.sys -- (Mbm3DevMt)
DRV:64bit: - [2010.10.31 02:00:00 | 000,411,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Mbm3CBus.sys -- (Mbm3CBus)
DRV:64bit: - [2010.10.19 02:00:00 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.10.19 02:00:00 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2010.09.09 22:24:04 | 000,190,464 | R--- | M] (AT&T) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\agnfilt.sys -- (agnfilt)
DRV:64bit: - [2010.09.07 21:09:34 | 000,015,472 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\smiifx64.sys -- (lenovo.smi)
DRV:64bit: - [2010.09.01 15:33:12 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K3805-z_dc_enum.sys -- (vodafone_K3805-z_dc_enum)
DRV:64bit: - [2010.08.24 02:00:00 | 000,091,648 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_jucdcacm.sys -- (huawei_cdcacm)
DRV:64bit: - [2010.08.07 02:00:00 | 000,121,600 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2010.07.27 02:00:00 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:64bit: - [2010.07.27 02:00:00 | 000,029,696 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_juextctrl.sys -- (huawei_ext_ctrl)
DRV:64bit: - [2010.06.30 01:22:50 | 000,014,848 | ---- | M] (AT&T) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avpnnic.sys -- (avpnnic)
DRV:64bit: - [2010.05.04 02:00:00 | 000,022,528 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwupgrade.sys -- (huawei_update)
DRV:64bit: - [2010.03.20 02:00:00 | 000,013,952 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter)
DRV:64bit: - [2010.03.03 02:00:00 | 000,030,248 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wwussf64.sys -- (ecnssndisfltr)
DRV:64bit: - [2010.03.03 02:00:00 | 000,026,664 | ---- | M] (Ericsson AB) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wwuss64.sys -- (ecnssndis)
DRV:64bit: - [2009.10.26 02:00:00 | 000,061,952 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimspe64.sys -- (rimspci)
DRV:64bit: - [2009.09.28 02:00:00 | 000,055,808 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rixdpe64.sys -- (rixdpcie)
DRV:64bit: - [2009.09.04 02:00:00 | 000,067,072 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk)
DRV:64bit: - [2009.09.04 02:00:00 | 000,057,856 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp)
DRV:64bit: - [2009.09.04 02:00:00 | 000,054,784 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.30 02:00:00 | 001,486,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV)
DRV:64bit: - [2009.06.30 02:00:00 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf)
DRV:64bit: - [2009.06.30 02:00:00 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL)
DRV:64bit: - [2009.06.10 22:35:02 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\e1k60x64.sys -- (e1kexpress)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.11 02:00:00 | 000,118,016 | ---- | M] (Lenovo) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LenovoRd.sys -- (LenovoRd)
DRV:64bit: - [2009.04.29 02:00:00 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio)
DRV:64bit: - [2009.01.09 16:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2008.05.06 17:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:64bit: - [2007.02.19 07:56:38 | 000,027,136 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\psadd.sys -- (psadd)
DRV:64bit: - [2006.06.19 02:00:00 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk)
DRV - [2013.05.24 10:00:00 | 002,098,776 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130603.023\ex64.sys -- (NAVEX15)
DRV - [2013.05.24 10:00:00 | 000,126,040 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130603.023\eng64.sys -- (NAVENG)
DRV - [2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2012.08.09 09:46:25 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2012.08.09 09:46:25 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011.03.24 22:11:34 | 000,482,352 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\srtspl64.sys -- (SRTSPL)
DRV - [2011.03.24 22:11:34 | 000,449,072 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysWOW64\drivers\srtsp64.sys -- (SRTSP)
DRV - [2011.03.24 22:11:34 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysWOW64\drivers\srtspx64.sys -- (SRTSPX)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2002.07.18 06:00:00 | 000,007,012 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\PMEMNT.SYS -- (PMEM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [String data over 1000 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C ED 65 D5 DD 17 CB 01 [binary data]
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = w3-501.ibm.com;<local>

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: ietab%40ip.cn:2.04.20110724.3ibm
FF - prefs.js..extensions.enabledAddons: langpack-en-US%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-fr%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-ja%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-ko%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-zh-CN%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: langpack-zh-TW%40firefox.mozilla.org:17.0.5
FF - prefs.js..extensions.enabledAddons: %7B25A1388B-6B18-46c3-BEBA-A81915D0DE8F%7D:1.7.8.3
FF - prefs.js..extensions.enabledAddons: IBM-cck%40firefox-extensions.ibm.com:2.1.11
FF - prefs.js..extensions.enabledAddons: bpaddtonab%40firefox-extensions.ibm.com:1.1.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.6
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@IBM.com/Java60: C:\Program Files\IBM\Java60\jre\bin\new_plugin\npjp2.dll (IBM)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@IBM.com/Java,version=1.6.0: C:\Program Files (x86)\IBM\Java60\jre\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@IBM.com/JavaPlugin: C:\Program Files (x86)\IBM\Java60\jre\bin\plugin2\npjp2.dll (IBM)
FF - HKLM\Software\MozillaPlugins\@IBM.com/WDPlugin,version=1: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@rim.com/npappworld: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll ()
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@IBM.com/WDPlugin,version=1: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\ [2012.02.20 15:27:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [2012.12.27 10:31:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.04 18:24:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.04 18:24:53 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.04 18:24:46 | 000,000,000 | ---D | M]

[2010.07.14 01:32:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Extensions
[2013.06.04 09:09:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions
[2013.06.04 09:09:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2013.06.04 09:09:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
[2013.06.04 09:08:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-en-US@firefox.mozilla.org
[2013.06.04 09:08:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-fr@firefox.mozilla.org
[2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-ja@firefox.mozilla.org
[2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 09:08:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\2ziq4yrx.default\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.06.04 18:49:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions
[2013.06.04 18:36:30 | 000,000,000 | ---D | M] (Quick Locale Switcher) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}
[2013.06.04 18:36:51 | 000,000,000 | ---D | M] (IBM Add To Notes Address Book BluePages Plugin) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com
[2013.06.04 18:36:48 | 000,000,000 | ---D | M] (IBM CCK) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com
[2013.06.04 18:36:19 | 000,000,000 | ---D | M] (IE Tab + (IBM Edition)) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\ietab@ip.cn
[2013.06.04 18:36:20 | 000,000,000 | ---D | M] ("English (US) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org
[2013.06.04 18:36:21 | 000,000,000 | ---D | M] ("Français Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org
[2013.06.04 18:36:22 | 000,000,000 | ---D | M] ("Japanese Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org
[2013.06.04 18:36:23 | 000,000,000 | ---D | M] ("Korean (KR) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org
[2013.06.04 18:36:24 | 000,000,000 | ---D | M] ("Chinese Simplified (zh-CN) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 18:36:26 | 000,000,000 | ---D | M] ("Traditional Chinese (zh-TW) Language Pack") -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.06.04 18:49:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\staged
[2013.06.04 18:36:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com\defaults
[2013.06.04 18:36:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\bpaddtonab@firefox-extensions.ibm.com\plugins
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\chrome
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\components
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\defaults
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\modules
[2013.06.04 18:36:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\IBM-cck@firefox-extensions.ibm.com\searchplugins
[2013.06.04 18:36:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\extensions
[2013.06.04 18:36:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\extensions
[2013.06.04 18:36:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\extensions
[2013.06.04 18:36:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\extensions
[2013.06.04 18:36:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\extensions
[2013.06.04 18:36:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\extensions
[2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions
[2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 18:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\Firefox\Profiles\hbr2sxao.default-1370329629699\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.03.28 22:01:51 | 000,002,906 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\global\xpinstall\xpinstall.properties
[2013.03.28 22:01:51 | 000,000,580 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.28 22:01:51 | 000,000,639 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 01:22:59 | 000,003,417 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\global\xpinstall\xpinstall.properties
[2013.03.29 01:22:59 | 000,000,623 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 01:22:59 | 000,000,706 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 00:24:11 | 000,004,294 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\global\xpinstall\xpinstall.properties
[2013.03.29 00:24:11 | 000,000,726 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 00:24:11 | 000,000,842 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 00:51:01 | 000,002,817 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\global\xpinstall\xpinstall.properties
[2013.03.29 00:51:01 | 000,000,642 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 00:51:01 | 000,000,642 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 02:03:55 | 000,002,927 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\global\xpinstall\xpinstall.properties
[2013.03.29 02:03:55 | 000,000,575 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 02:03:55 | 000,000,584 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\xpinstall\xpinstallConfirm.properties
[2013.03.29 02:10:39 | 000,002,948 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\global\xpinstall\xpinstall.properties
[2013.03.29 02:10:40 | 000,000,588 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\xpinstall\xpinstallConfirm.dtd
[2013.03.29 02:10:40 | 000,000,541 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\xpinstall\xpinstallConfirm.properties
[2013.06.04 18:49:14 | 000,504,298 | ---- | M] () (No name found) -- C:\Users\IBM_ADMIN\AppData\Roaming\mozilla\firefox\profiles\h5duqfoz.default-1370363726298\extensions\staged\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}.xpi
[2013.06.04 18:24:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013.06.04 18:24:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2013.06.04 18:24:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2013.06.04 18:24:44 | 000,000,000 | ---D | M] (Quick Locale Switcher) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (IBM CCK) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (IE Tab + (IBM Edition)) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\ietab@ip.cn
[2013.06.04 18:24:23 | 000,000,000 | ---D | M] ("English (US) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org
[2013.06.04 18:24:24 | 000,000,000 | ---D | M] ("Français Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-fr@firefox.mozilla.org
[2013.06.04 18:24:26 | 000,000,000 | ---D | M] ("Japanese Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ja@firefox.mozilla.org
[2013.06.04 18:24:28 | 000,000,000 | ---D | M] ("Korean (KR) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ko@firefox.mozilla.org
[2013.06.04 18:24:32 | 000,000,000 | ---D | M] ("Chinese Simplified (zh-CN) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-CN@firefox.mozilla.org
[2013.06.04 18:24:39 | 000,000,000 | ---D | M] ("Traditional Chinese (zh-TW) Language Pack") -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-TW@firefox.mozilla.org
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\chrome
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\components
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\defaults
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\modules
[2013.06.04 18:24:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\IBM-cck@firefox-extensions.ibm.com\searchplugins
[2013.06.04 18:24:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-en-US@firefox.mozilla.org\chrome\en-US\locale\en-US\mozapps\extensions
[2013.06.04 18:24:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-fr@firefox.mozilla.org\chrome\fr\locale\fr\mozapps\extensions
[2013.06.04 18:24:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ja@firefox.mozilla.org\chrome\ja\locale\ja\mozapps\extensions
[2013.06.04 18:24:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-ko@firefox.mozilla.org\chrome\ko\locale\ko\mozapps\extensions
[2013.06.04 18:24:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-CN@firefox.mozilla.org\chrome\zh-CN\locale\zh-CN\mozapps\extensions
[2013.06.04 18:24:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\langpack-zh-TW@firefox.mozilla.org\chrome\zh-TW\locale\zh-TW\mozapps\extensions
[2013.06.04 18:24:53 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.08.02 19:01:32 | 000,122,880 | ---- | M] (IBM ) -- C:\Program Files (x86)\mozilla firefox\plugins\npcpsweb.dll
[2011.12.09 19:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2011.11.11 15:10:34 | 000,297,864 | ---- | M] (IBM ) -- C:\Program Files (x86)\mozilla firefox\plugins\npwdplugin821.dll
[2013.03.28 23:50:17 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.03.28 23:50:17 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012.03.19 00:21:52 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\IBM\Java60\jre\bin\ssv.dll (IBM)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\IBM\Java60\jre\bin\jp2ssv.dll (IBM)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [AcWin7Hlpr] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe (Lenovo)
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe (Lexmark International Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe (Lenovo Group Limited)
O4:64bit: - HKLM..\Run: [LXCTCATS] C:\windows\SysNative\spool\DRIVERS\x64\3\LXCTtime.DLL (Lexmark International Inc.)
O4:64bit: - HKLM..\Run: [lxctmon.exe] C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe ()
O4:64bit: - HKLM..\Run: [lxddamon] C:\Program Files (x86)\Lexmark 2500 Series\lxddamon.exe ()
O4:64bit: - HKLM..\Run: [lxddmon.exe] C:\Program Files (x86)\Lexmark 2500 Series\lxddmon.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [ProxyCap] C:\Program Files\Proxy Labs\ProxyCap\pcapui.exe (Proxy Labs)
O4:64bit: - HKLM..\Run: [TpShocks] C:\windows\SysNative\TpShocks.exe (Lenovo.)
O4 - HKLM..\Run: [ACSW14DE] C:\Program Files (x86)\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (ACD Systems)
O4 - HKLM..\Run: [ACTray] C:\Program Files (x86)\Lenovo\Access Connections\ACTray.exe (Lenovo)
O4 - HKLM..\Run: [ACWLIcon] C:\Program Files (x86)\Lenovo\Access Connections\ACWLIcon.exe (Lenovo)
O4 - HKLM..\Run: [ALTOOLS] AccessL.exe File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [C4EBReg] C:\Program Files (x86)\C4ebreg\c4ebreg.exe (IBM Corp.)
O4 - HKLM..\Run: [ccApp] C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [Isamtray] C:\Program Files (x86)\C4ebreg\isamtray.exe (IBM Corp.)
O4 - HKLM..\Run: [Lexmark 5400 Series] C:\Program Files (x86)\Lexmark 5400 Series\fm3032.exe ()
O4 - HKLM..\Run: [lxddamon] C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddamon.exe ()
O4 - HKLM..\Run: [lxddmon.exe] C:\Program Files (x86) (x86)\Lexmark 2500 Series\lxddmon.exe ()
O4 - HKLM..\Run: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
O4 - HKLM..\Run: [PWMTRV] C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [stgclean] c:\sdwork\w32maing.exe (IBM Corp.)
O4 - HKCU..\Run: [NetSP - restore settings on power failure] C:\Program Files (x86)\AT&T Network Client\NetSP.exe (AT&T)
O4 - HKCU..\Run: [SymphonyPreLoad] "C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.standard.launcher.win32.x86_3.0.1.20120110-2000\IBM Lotus Symphony" -nogui -nosplash File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Activities present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Safety present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\windows\SysNative\pcapwsp.dll (Proxy Labs)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - ppcapwsp.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - ppcapwsp.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\windows\SysWow64\pcapwsp.dll (Proxy Labs)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - pcapwsp.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - pcapwsp.dll File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: ibm.com ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: ibm.com ([w3-03] http in Local intranet)
O15 - HKCU\..Trusted Domains: ibm.com ([w3-03] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1ACECAFE-0016-0000-0000-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp:// (Java Plug-in 1.6.0)
O16 - DPF: {8B8A0588-356B-431E-A4C3-A56553266DAA} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Smartscript.cab (Siebel SmartScript)
O16 - DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_Desktop_Integration.cab (Siebel Desktop Integration)
O16 - DPF: {A6F9E1F5-780D-42F6-9644-3FC630A7AB39} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_HI_Client.cab (Siebel High Interactivity Framework)
O16 - DPF: {AD4EA0DC-8CC7-4F7B-B730-267823DCE9B7} https://w3-501.ibm.com/transform/crm/europe/de/sales/21219/applets/SiebelAx_OutBound_mail.cab (Siebel Email Support for Microsoft Outlook and Lotus Notes)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp:// (Java Plug-in 1.6.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0169DF91-D033-43F4-A7DA-F04CD0C87DA4}: DhcpNameServer = 9.0.136.50 9.0.138.50
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: DhcpNameServer = 139.7.30.125 139.7.30.126
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C6A483A-E3D3-4D82-A958-1C447680D2C5}: NameServer = 127.0.0.1,139.7.30.125,139.7.30.126
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: Domain = ibm.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76DE3338-45F2-47E1-9A5C-F1D6D963EB23}: NameServer = 9.64.163.21,9.64.162.21
O18:64bit: - Protocol\Handler\gopher - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~1\GO36F4~1.DLL) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013.06.04 18:56:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe
[2013.06.04 18:35:32 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Desktop\Old Firefox Data-1
[2013.06.04 18:24:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.06.04 16:02:08 | 000,000,000 | ---D | C] -- C:\swd
[2013.06.04 15:59:53 | 000,000,000 | ---D | C] -- C:\sdwork
[2013.06.04 12:40:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2013.06.04 09:07:19 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Desktop\Old Firefox Data
[2013.06.03 19:09:00 | 000,000,000 | ---D | C] -- C:\Users\IBM_ADMIN\Documents\S
[2013.05.28 16:20:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Workstation Security Tool
[2013.05.28 15:41:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\C4ebreg
[2013.05.28 14:31:36 | 000,158,016 | ---- | C] (IBM) -- C:\windows\SysWow64\javaws.exe
[2013.05.28 14:31:35 | 000,149,824 | ---- | C] (IBM) -- C:\windows\SysWow64\javaw.exe
[2013.05.28 14:31:35 | 000,149,824 | ---- | C] (IBM) -- C:\windows\SysWow64\java.exe
[2013.05.28 14:31:33 | 000,084,288 | ---- | C] (IBM) -- C:\windows\SysWow64\javacplIBM60.cpl
[2013.05.28 14:09:42 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.05.26 18:01:24 | 038,944,576 | ---- | C] (Atomix Productions) -- C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe
[2013.05.19 13:04:48 | 000,142,424 | ---- | C] (SlySoft, Inc.) -- C:\windows\SysWow64\drivers\AnyDVD.sys
[2013.05.19 13:04:48 | 000,142,424 | ---- | C] (SlySoft, Inc.) -- C:\windows\SysNative\drivers\AnyDVD.sys
[2013.05.19 12:54:27 | 000,097,176 | ---- | C] (Elaborate Bytes AG) -- C:\windows\SysWow64\ElbyCDIO.dll
[2012.07.12 10:28:44 | 002,174,976 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Program Files (x86)\Common Files\atimpenc.dll
[8 C:\Users\IBM_ADMIN\Documents\*.tmp files -> C:\Users\IBM_ADMIN\Documents\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.06.04 19:12:00 | 000,783,562 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2013.06.04 19:12:00 | 000,663,252 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2013.06.04 19:12:00 | 000,122,674 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2013.06.04 18:58:15 | 000,000,000 | ---- | M] () -- C:\Users\IBM_ADMIN\defogger_reenable
[2013.06.04 18:56:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\IBM_ADMIN\Desktop\OTL.exe
[2013.06.04 18:56:34 | 000,050,477 | ---- | M] () -- C:\Users\IBM_ADMIN\Desktop\Defogger.exe
[2013.06.04 18:36:50 | 000,001,151 | ---- | M] () -- C:\Users\IBM_ADMIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013.06.04 18:23:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2013.06.04 16:01:15 | 000,000,134 | ---- | M] () -- C:\windows\issiunin.bat
[2013.06.04 16:01:13 | 000,000,590 | ---- | M] () -- C:\Users\Public\Desktop\ISSI EZUpdate.lnk
[2013.06.04 16:01:02 | 000,000,112 | ---- | M] () -- C:\Users\Public\Desktop\IBM Standard Software Installer.url
[2013.06.04 12:40:39 | 000,001,151 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.06.04 08:31:46 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2013.06.03 23:05:02 | 000,016,528 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.03 23:05:02 | 000,016,528 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.03 15:48:42 | 000,316,215 | ---- | M] () -- C:\Users\IBM_ADMIN\Documents\ANGEBOT 13000238.pdf
[2013.06.03 09:55:36 | 2055,655,423 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.28 15:22:52 | 000,373,888 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2013.05.28 13:43:50 | 000,002,116 | ---- | M] () -- C:\Users\Public\Desktop\IBM Lotus Symphony.lnk
[2013.05.27 17:10:40 | 000,000,160 | ---- | M] () -- C:\Users\IBM_ADMIN\AppData\Roaming\default.rss
[2013.05.26 18:01:54 | 038,944,576 | ---- | M] (Atomix Productions) -- C:\Users\IBM_ADMIN\Documents\install_virtualdj_home_v7.4.exe
[2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) -- C:\windows\SysWow64\drivers\AnyDVD.sys
[2013.05.19 13:04:48 | 000,142,424 | ---- | M] (SlySoft, Inc.) -- C:\windows\SysNative\drivers\AnyDVD.sys
[2013.05.19 12:54:27 | 000,097,176 | ---- | M] (Elaborate Bytes AG) -- C:\windows\SysWow64\ElbyCDIO.dll
[8 C:\Users\IBM_ADMIN\Documents\*.tmp files -> C:\Users\IBM_ADMIN\Documents\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.06.04 18:58:15 | 000,000,000 | ---- | C] () -- C:\Users\IBM_ADMIN\defogger_reenable
[2013.06.04 18:56:34 | 000,050,477 | ---- | C] () -- C:\Users\IBM_ADMIN\Desktop\Defogger.exe
[2013.06.04 16:03:55 | 000,001,151 | ---- | C] () -- C:\Users\IBM_ADMIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013.06.04 12:40:39 | 000,001,163 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.06.04 12:40:39 | 000,001,151 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.06.03 15:48:41 | 000,316,215 | ---- | C] () -- C:\Users\IBM_ADMIN\Documents\ANGEBOT 13000238.pdf
[2013.05.31 15:08:46 | 000,002,601 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ProxyCap.lnk
[2013.05.28 08:45:11 | 000,000,830 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2013.05.01 17:08:02 | 000,331,776 | ---- | C] ( ) -- C:\windows\SysWow64\sbcrreag.dll
[2012.12.27 13:35:03 | 000,000,000 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\downloads.m3u
[2012.12.04 22:39:57 | 000,413,696 | ---- | C] ( ) -- C:\windows\SysWow64\lxddinpa.dll
[2012.12.04 22:39:57 | 000,397,312 | ---- | C] ( ) -- C:\windows\SysWow64\lxddiesc.dll
[2012.12.04 22:39:57 | 000,385,024 | ---- | C] () -- C:\windows\SysWow64\lxddcomx.dll
[2012.12.04 22:39:57 | 000,286,720 | ---- | C] () -- C:\windows\SysWow64\LXDDinst.dll
[2012.12.04 22:39:56 | 001,232,896 | ---- | C] ( ) -- C:\windows\SysWow64\lxddserv.dll
[2012.12.04 22:39:56 | 000,999,424 | ---- | C] ( ) -- C:\windows\SysWow64\lxddusb1.dll
[2012.12.04 22:39:56 | 000,643,072 | ---- | C] ( ) -- C:\windows\SysWow64\lxddpmui.dll
[2012.12.04 22:39:56 | 000,163,840 | ---- | C] ( ) -- C:\windows\SysWow64\lxddprox.dll
[2012.12.04 22:39:55 | 000,700,416 | ---- | C] ( ) -- C:\windows\SysWow64\lxddhbn3.dll
[2012.12.04 22:39:55 | 000,684,032 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcomc.dll
[2012.12.04 22:39:55 | 000,585,728 | ---- | C] ( ) -- C:\windows\SysWow64\lxddlmpm.dll
[2012.12.04 22:39:55 | 000,537,520 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcoms.exe
[2012.12.04 22:39:55 | 000,425,984 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcomm.dll
[2012.12.04 22:39:55 | 000,394,160 | ---- | C] ( ) -- C:\windows\SysWow64\lxddcfg.exe
[2012.12.04 22:39:55 | 000,385,968 | ---- | C] ( ) -- C:\windows\SysWow64\lxddih.exe
[2012.12.04 22:39:55 | 000,181,168 | ---- | C] ( ) -- C:\windows\SysWow64\lxddppls.exe
[2012.12.04 22:39:55 | 000,094,208 | ---- | C] ( ) -- C:\windows\SysWow64\lxddpplc.dll
[2012.11.20 15:57:53 | 000,059,487 | ---- | C] () -- C:\Users\IBM_ADMIN\install.xml
[2012.10.17 18:37:16 | 000,000,600 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\PUTTY.RND
[2012.10.09 15:35:25 | 000,000,600 | ---- | C] () -- C:\Users\IBM_ADMIN\PUTTY.RND
[2012.07.21 16:07:34 | 000,000,280 | ---- | C] () -- C:\windows\SysWow64\PGPsdk.dll.sig
[2012.06.01 13:36:53 | 000,001,057 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\vso_ts_preview.xml
[2012.04.05 10:20:35 | 000,007,600 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\Resmon.ResmonCfg
[2012.03.20 16:11:35 | 000,000,632 | RHS- | C] () -- C:\Users\IBM_ADMIN\ntuser.pol
[2012.03.18 21:24:10 | 000,000,460 | ---- | C] () -- C:\windows\win_bak.ini
[2012.03.01 14:22:44 | 000,000,160 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Roaming\default.rss
[2012.02.21 14:50:01 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.02.20 17:06:15 | 000,005,120 | ---- | C] () -- C:\Users\IBM_ADMIN\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.20 12:08:51 | 000,122,880 | ---- | C] () -- C:\windows\wrtService.exe
[2012.02.20 12:08:51 | 000,000,156 | ---- | C] () -- C:\windows\SysWow64\wrtservice.ini
[2012.02.18 20:15:49 | 000,274,432 | ---- | C] () -- C:\windows\SysWow64\LXCTinst.dll
[2012.02.18 20:15:48 | 000,413,696 | ---- | C] ( ) -- C:\windows\SysWow64\lxctinpa.dll
[2012.02.18 20:15:48 | 000,397,312 | ---- | C] ( ) -- C:\windows\SysWow64\lxctiesc.dll
[2012.02.18 20:15:46 | 000,643,072 | ---- | C] ( ) -- C:\windows\SysWow64\lxctpmui.dll
[2012.02.18 20:15:44 | 000,991,232 | ---- | C] ( ) -- C:\windows\SysWow64\lxctusb1.dll
[2012.02.18 20:15:43 | 001,224,704 | ---- | C] ( ) -- C:\windows\SysWow64\lxctserv.dll
[2012.02.18 20:15:42 | 000,163,840 | ---- | C] ( ) -- C:\windows\SysWow64\lxctprox.dll
[2012.02.18 20:15:41 | 000,585,728 | ---- | C] ( ) -- C:\windows\SysWow64\lxctlmpm.dll
[2012.02.18 20:15:41 | 000,181,168 | ---- | C] ( ) -- C:\windows\SysWow64\lxctppls.exe
[2012.02.18 20:15:41 | 000,094,208 | ---- | C] ( ) -- C:\windows\SysWow64\lxctpplc.dll
[2012.02.18 20:15:40 | 000,696,320 | ---- | C] ( ) -- C:\windows\SysWow64\lxcthbn3.dll
[2012.02.18 20:15:40 | 000,385,968 | ---- | C] ( ) -- C:\windows\SysWow64\lxctih.exe
[2012.02.18 20:15:39 | 000,537,520 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcoms.exe
[2012.02.18 20:15:39 | 000,421,888 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcomm.dll
[2012.02.18 20:15:38 | 000,684,032 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcomc.dll
[2012.02.18 20:15:37 | 000,381,872 | ---- | C] ( ) -- C:\windows\SysWow64\lxctcfg.exe
[2012.02.18 14:08:24 | 000,004,767 | ---- | C] () -- C:\windows\Irremote.ini
[2012.02.18 10:27:46 | 000,204,800 | ---- | C] () -- C:\windows\SysWow64\IVIresizeW7.dll
[2012.02.18 10:27:46 | 000,200,704 | ---- | C] () -- C:\windows\SysWow64\IVIresizeA6.dll
[2012.02.18 10:27:46 | 000,192,512 | ---- | C] () -- C:\windows\SysWow64\IVIresizeP6.dll
[2012.02.18 10:27:46 | 000,192,512 | ---- | C] () -- C:\windows\SysWow64\IVIresizeM6.dll
[2012.02.18 10:27:46 | 000,188,416 | ---- | C] () -- C:\windows\SysWow64\IVIresizePX.dll
[2012.02.18 10:27:46 | 000,020,480 | ---- | C] () -- C:\windows\SysWow64\IVIresize.dll
[2012.02.18 10:25:57 | 000,831,600 | ---- | C] () -- C:\windows\SysWow64\Ctaa1.dat
[2012.02.18 10:25:52 | 000,122,880 | ---- | C] () -- C:\windows\SysWow64\cddvdint.dll
[2012.02.15 17:47:03 | 000,000,376 | ---- | C] () -- C:\windows\ODBC.INI
[2012.02.15 16:21:38 | 000,216,000 | ---- | C] () -- C:\windows\SysWow64\igfcg600m.bin
[2012.02.15 16:21:37 | 000,056,832 | ---- | C] () -- C:\windows\SysWow64\igdde32.dll
[2012.02.15 16:21:35 | 013,903,360 | ---- | C] () -- C:\windows\SysWow64\ig4icd32.dll
[2012.02.15 16:20:56 | 000,777,778 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2011.12.09 22:41:04 | 000,000,033 | ---- | C] () -- C:\windows\Uninst.ini
[2011.12.09 22:35:14 | 000,039,424 | ---- | C] () -- C:\windows\SysWow64\pdresrc.dll
[2011.12.09 22:35:07 | 000,786,432 | ---- | C] () -- C:\windows\SysWow64\pdclntif.dll
[2011.12.09 22:35:07 | 000,270,336 | ---- | C] () -- C:\windows\SysWow64\pdprDlg.dll
[2011.12.09 22:35:07 | 000,208,896 | ---- | C] () -- C:\windows\SysWow64\selpms.dll
[2011.12.09 22:35:07 | 000,106,496 | ---- | C] () -- C:\windows\SysWow64\IBMMenu.dll
[2011.12.09 22:35:07 | 000,086,016 | ---- | C] () -- C:\windows\SysWow64\selpmcui.dll
[2011.12.09 14:24:23 | 000,066,856 | ---- | C] () -- C:\windows\SysWow64\SynTPEnhPS.dll
[2011.12.09 14:23:48 | 000,963,116 | ---- | C] () -- C:\windows\SysWow64\igkrng600.bin
[2011.12.09 14:23:46 | 000,145,804 | ---- | C] () -- C:\windows\SysWow64\igcompkrng600.bin
[2011.04.18 16:39:56 | 000,226,364 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
[2010.07.03 01:50:13 | 000,000,566 | RHS- | C] () -- C:\ProgramData\ntuser.pol

========== ZeroAccess Check ==========

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012.02.18 20:30:47 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\5400 Series
[2012.02.24 20:28:04 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\ACD Systems
[2012.10.12 12:35:05 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Azureus
[2013.02.06 12:27:12 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\calibre
[2012.07.05 09:34:15 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\com.unitedinternet.ums.sms-mms-manager
[2013.01.01 18:06:03 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Dropbox
[2012.12.27 10:34:19 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoft
[2012.12.27 10:34:36 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.30 10:59:59 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\IBM
[2012.03.14 10:54:48 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\IBMERS
[2012.11.28 16:38:23 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\JawboneUpdater
[2012.12.04 22:46:28 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Lexmark Productivity Studio
[2011.12.09 22:17:22 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Lotus
[2012.02.16 09:04:43 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\pdfforge
[2012.11.14 18:00:43 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\PGP Corporation
[2012.02.15 17:10:34 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\PwrMgr
[2012.02.20 17:01:05 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Research In Motion
[2010.07.14 01:18:48 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Sierra Wireless
[2012.02.20 15:35:49 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Vodafone
[2013.01.01 18:04:23 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Vso
[2012.12.17 18:13:32 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\WDPlugin
[2010.11.12 02:36:49 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\WinBatch
[2012.12.27 14:10:09 | 000,000,000 | ---D | M] -- C:\Users\IBM_ADMIN\AppData\Roaming\Xilisoft

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\IBM_ADMIN\Documents\Liste 2.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\IBM_ADMIN\Documents\checkliste travel.xls:Roxio EMC Stream

< End of report >

Hi,

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches OTL log. LOgs bitte in Codetags posten.

Hallo Schrauber,

danke für das sehr schnell melden. Ich hoffe Du bist mein Rettungsengel. Habe alles haarklein so gemacht, hier das Ergebnis:

Danke
mailmeback
************************





OTL Logfile:
--- --- ---

Hallo,

siehe bitte meine letzte Antwort mit den logs. Bitte weiterhin um support. Nach den bisherigen Aktionen stürzt FFox erneut wieder ab nach Neustart heute morgen.

Bitte auch um Info ob und wann ich Defogger wieder re-enablen soll. Danke

Hi,

Defogger erst ganz am Schluss wieder aktivieren.


Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32bit oder FRST 64bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Scan.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hallo,

danke. Mache ich gleich, ich habe Malwarebytes Vollversion, soll ich es trotzdem machen ?

bekomme beim Start von rootkit folg. Meldung im Anhang, was tun ?

Klick Yes :)

Hallo,

hier bitte alles wie gefordert, Rootkit kam mit folg. Meldungen:

"Scan finished, no malware found!"
"The system volume seems inaccessable or encrypted. Scan can not continue" (habe PGP Encription laufen ?)

Bitte um rasche Hilfe. Danke !!!

P.S. habe noch meinen Namen in den logs von 21:56 gestern abend gefunden, wie kann ich das editieren?

********************



Habe noch meinen Namen in der Message von gestern 21:56, wie kann ich es editieren oder hiden, oder kannst Du es bitte machen ?

Wo genau steht der Name?

Ist das ein Firmenrechner? Hast du die Proxys und IP's eingetragen?

Firefox hast Du nach AdwCleaner schon wieder versucht? Auch im Safe Mode?

Name ist Rainer usw., steht in AdwareCleaner header und junkware log oben.

Ist Firmenrechner, habe keine Proxys IPs eingetragen. Habe noch Java cleanup gemacht mit support hier und auch im safe mode stürzte der Ffox genau bei aufrufen dieses Link aus der mail wieder ab...

pls. help (wenn malware/virus-relevant), danke

Firmenrechner:

dürfen hier nicht behandelt werden, wenn es um eine Firma mit eigenen IT-Leuten oder Abteilung geht.

Wenn Das ne kleine oder eigene Firma ist kein Problem.

Ich muss es nur wissen, nicht dass ich hier irgendwelche Proxy-Einstellungen kille die (ohne dein Wissen) wichtig sind.

Hallo,

korrekt. Ist größere Firma mit eig. IT-Abteilung. Gibt sicher Proxy-Einstellungen die relevant sind und nicht gekillt werden dürfen. Habe jetzt auch einen klaren Verdächtigen der auch bei einem Kollegen zum gleichen Problem geführt. ProxyCap für ein tunneling, macht statische IPs die sich wohl mit den dynamischen IPs hier nicht vertragen.

Ich teste das gerade und wenn das sich bestätigt, dann melde ich mich zum erfolgreichen zumachen des threats wenn nötig ? Kann ich den defogger wieder anschalten jetzt ?

War denn bei den Aktionen mit Dir bislang überhaupt irgendetwas auffälliges dabei ? Kannst Du noch bitte den Namen, siehe letzte Nachricht, deleted, kann das ja von hier nicht ?

Danke

Defogger kann wieder an, war bissl Adware drauf, aber nichts schlimmes.

Namen ist editiert :).

danke !

dann können wir das hier schließen erstmal, Test bislang 100% positiv.

Lob ist raus, Spende kommt.

Gruss
R

Alles klar, danke :)

Dann entfernen wir noch unsre tools:

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

gerne...

das muss ich echt noch machen in meinem speziellen Falle ??:

Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.
Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte deinen Rechner abschließend neu.

Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Das entfernt eben OTL und FRST restlos :)

einfach Delfix starten und laufen lassen :)