| TommyParavi | 24.03.2012 23:11 |
(2x) Gema Virus 2.05 OTL!
Hallo, habe den Gema virus auch und habe mein pc mit OTL gescannt aber brauche das neue Script was ich in das Custom scans/Fixes einfügen muss.
Hier die Extras.Txt und OTL.Txt Code:
OTL Extras logfile created on: 24.03.2012 21:29:12 - Run 2
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Divan\Desktop
Enterprise Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,93 Gb Total Physical Memory | 1,79 Gb Available Physical Memory | 61,07% Memory free
5,86 Gb Paging File | 4,50 Gb Available in Paging File | 76,79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,79 Gb Total Space | 100,37 Gb Free Space | 43,12% Space Free | Partition Type: NTFS
Drive D: | 100,00 Mb Total Space | 71,70 Mb Free Space | 71,70% Space Free | Partition Type: NTFS
Computer Name: TOMMY-PC | User Name: Tommy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83217002FF}" = Java(TM) 7 Update 2
"{2F603A45-D956-496B-81B5-50D782424976}" = SweetPacks Toolbar for Internet Explorer 4.4
"{37476589-E48E-439E-A706-56189E2ED4C4}" = TheBflix
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5EBAC9CB-97D7-44CD-A82D-4FCB37F582AC}" = World Racing 2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{782AE8DA-30DA-44bd-BA9A-9F23B8A4AC79}" = pdfforge Toolbar v5.1
"{80304C76-723D-4472-B0E8-4094624566A3}_is1" = Counter-Strike Source 4426
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{943A8D28-80D6-41DC-AE94-81FEB42041BF}" = System Requirements Lab CYRI
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{B85C4CB2-B352-4BD8-818C-BCE353599107}" = SweetIM for Messenger 3.6
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"Azureus" = Azureus
"BabylonToolbar" = Babylon toolbar on IE
"BitTorrent" = BitTorrent
"BittorrentBar_DE Toolbar" = BittorrentBar_DE Toolbar
"Counter-Strike 1.6 V40.1" = Counter-Strike 1.6 V40.1
"DAEMON Tools Lite" = DAEMON Tools Lite
"Empire - Total War (RePack by spider91)_is1" = Empire - Total War
"Fraps" = Fraps (remove only)
"Free Screen Video Recorder_is1" = Free Screen Video Recorder version 2.5.19.1228
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.15.1228
"incredibar" = Incredibar Toolbar on IE and Chrome
"InstallShield_{5EBAC9CB-97D7-44CD-A82D-4FCB37F582AC}" = World Racing 2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"PriceGong" = PriceGong 2.5.4
"San Andreas Mod Installer1.1" = San Andreas Mod Installer
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"uTorrent" = µTorrent
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"RedLight Evolution" = RedLight Evolution
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1386417269-986701621-1243459835-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ExpressFiles" = ExpressFiles
"Google Chrome" = Google Chrome
"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.02.4
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 12.03.2012 19:11:09 | Computer Name = Tommy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: MP Lounge 2.exe, Version: 0.0.0.0,
Zeitstempel: 0x4370bfda Name des fehlerhaften Moduls: MP Lounge 2.exe, Version:
0.0.0.0, Zeitstempel: 0x4370bfda Ausnahmecode: 0xc0000005 Fehleroffset: 0x00014b90
ID
des fehlerhaften Prozesses: 0x9c8 Startzeit der fehlerhaften Anwendung: 0x01cd00a5381fc244
Pfad
der fehlerhaften Anwendung: C:\Program Files\Playlogic\World Racing 2\MP Lounge
2.exe Pfad des fehlerhaften Moduls: C:\Program Files\Playlogic\World Racing 2\MP
Lounge 2.exe Berichtskennung: a664247c-6c98-11e1-a531-001f16b24209
Error - 14.03.2012 20:21:44 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm engine.exe, Version 0.0.0.0 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 3a0 Startzeit:
01cd023f01c26851 Endzeit: 109 Anwendungspfad: C:\Program Files\RedLight Evolution21-10-2011\engine.exe
Berichts-ID:
d4a28155-6e34-11e1-bf4f-001f16b24209
Error - 17.03.2012 18:35:42 | Computer Name = Tommy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: MP Lounge 2.exe, Version: 0.0.0.0,
Zeitstempel: 0x4370bfda Name des fehlerhaften Moduls: MP Lounge 2.exe, Version:
0.0.0.0, Zeitstempel: 0x4370bfda Ausnahmecode: 0xc0000005 Fehleroffset: 0x00014b90
ID
des fehlerhaften Prozesses: 0x544 Startzeit der fehlerhaften Anwendung: 0x01cd048dd960d685
Pfad
der fehlerhaften Anwendung: C:\Program Files\Playlogic\World Racing 2\MP Lounge
2.exe Pfad des fehlerhaften Moduls: C:\Program Files\Playlogic\World Racing 2\MP
Lounge 2.exe Berichtskennung: 86ed43fc-7081-11e1-8365-001f16b24209
Error - 17.03.2012 18:53:04 | Computer Name = Tommy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: MP Lounge 2.exe, Version: 0.0.0.0,
Zeitstempel: 0x4370bfda Name des fehlerhaften Moduls: MP Lounge 2.exe, Version:
0.0.0.0, Zeitstempel: 0x4370bfda Ausnahmecode: 0xc0000005 Fehleroffset: 0x00014b90
ID
des fehlerhaften Prozesses: 0xbb0 Startzeit der fehlerhaften Anwendung: 0x01cd048e63391c79
Pfad
der fehlerhaften Anwendung: C:\Program Files\Playlogic\World Racing 2\MP Lounge
2.exe Pfad des fehlerhaften Moduls: C:\Program Files\Playlogic\World Racing 2\MP
Lounge 2.exe Berichtskennung: f3fab738-7083-11e1-8365-001f16b24209
Error - 18.03.2012 17:40:33 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm samp.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt
werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: cb8 Startzeit:
01cd054fb4aee316 Endzeit: 0 Anwendungspfad: C:\Users\Tommy\Documents\Games\Grand Theft
Auto San Andreas\samp.exe Berichts-ID: f889d59a-7142-11e1-8087-001f16b24209
Error - 18.03.2012 17:41:59 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16421 kann nicht mehr unter
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
zu suchen. Prozess-ID: 848 Startzeit: 01cd054fa6e27768 Endzeit: 30 Anwendungspfad:
C:\Program Files\Internet Explorer\iexplore.exe Berichts-ID:
Error - 19.03.2012 21:47:50 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 10.0.1.4421 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: da4 Startzeit:
01cd063b63fbbc62 Endzeit: 40 Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe
Berichts-ID:
b1a054c9-722e-11e1-a674-001f16b24209
Error - 19.03.2012 22:17:54 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 10.0.1.4421 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 9c8 Startzeit:
01cd063fa137994d Endzeit: 60 Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe
Berichts-ID:
e4507428-7232-11e1-a674-001f16b24209
Error - 23.03.2012 22:53:58 | Computer Name = Tommy-PC | Source = EventSystem | ID = 4621
Description =
Error - 23.03.2012 22:56:58 | Computer Name = Tommy-PC | Source = Application Hang | ID = 1002
Description = Programm gema.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt
werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 134 Startzeit:
01cd09699a682cb5 Endzeit: 16 Anwendungspfad: C:\Users\Tommy\AppData\Roaming\gema\gema.exe
Berichts-ID:
fe593e40-755c-11e1-90c6-001f16b24209
[ System Events ]
Error - 24.03.2012 15:19:33 | Computer Name = Tommy-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?24.?03.?2012 um 20:18:49 unerwartet heruntergefahren.
Error - 24.03.2012 15:19:48 | Computer Name = Tommy-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
sfdrv01 sfsync02 sfvfs02
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = atapi | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.
Error - 24.03.2012 15:26:41 | Computer Name = Tommy-PC | Source = cdrom | ID = 262159
Description = Das Gerät \Device\CdRom0 ist für den Zugriff noch nicht bereit.
< End of report >
Code:
OTL logfile created on: 24.03.2012 21:29:12 - Run 2
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Divan\Desktop
Enterprise Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,93 Gb Total Physical Memory | 1,79 Gb Available Physical Memory | 61,07% Memory free
5,86 Gb Paging File | 4,50 Gb Available in Paging File | 76,79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,79 Gb Total Space | 100,37 Gb Free Space | 43,12% Space Free | Partition Type: NTFS
Drive D: | 100,00 Mb Total Space | 71,70 Mb Free Space | 71,70% Space Free | Partition Type: NTFS
Computer Name: TOMMY-PC | User Name: Tommy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012.03.24 20:44:47 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Divan\Desktop\OTL (2).exe
PRC - [2012.03.24 03:42:38 | 000,243,712 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\gema\gema.exe
PRC - [2012.03.12 20:27:48 | 000,250,528 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil11g_ActiveX.exe
PRC - [2012.03.07 22:34:50 | 000,741,240 | ---- | M] (BitTorrent, Inc.) -- C:\Programme\uTorrent\uTorrent.exe
PRC - [2012.03.04 22:48:40 | 000,934,752 | ---- | M] (Spigot, Inc.) -- C:\Programme\Common Files\Spigot\Search Settings\SearchSettings.exe
PRC - [2012.03.04 22:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe
PRC - [2012.02.13 09:06:52 | 002,602,304 | ---- | M] (DT Soft Ltd) -- C:\Programme\DAEMON Tools Lite\DTShellHlp.exe
PRC - [2012.01.31 20:38:51 | 000,424,568 | ---- | M] (hxxp://www.express-files.com/) -- C:\Programme\ExpressFiles\ExpressFiles.exe
PRC - [2012.01.19 12:30:04 | 000,114,992 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Messenger\SweetIM.exe
PRC - [2012.01.12 00:49:38 | 006,054,256 | ---- | M] (BitTorrent, Inc.) -- C:\Programme\BitTorrent\BitTorrent.exe
PRC - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.01.01 02:11:05 | 000,748,336 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2011.12.23 15:28:00 | 000,041,472 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\phonostarTimer.exe
PRC - [2011.12.15 15:00:00 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.12.15 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.07.16 05:31:12 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.16 05:25:09 | 000,717,824 | ---- | M] (Bliz0R) -- C:\Programme\RedLight Evolution21-10-2011\RedLight Evolution.exe
PRC - [2009.07.14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009.07.14 02:14:38 | 001,173,504 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
========== Modules (No Company Name) ==========
MOD - [2012.03.24 03:42:38 | 000,243,712 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\gema\gema.exe
MOD - [2012.02.17 09:57:46 | 001,670,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\4745cd79cd87ef98af5163b152088e28\Microsoft.VisualBasic.ni.dll
MOD - [2012.02.17 03:48:51 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0a894f77b9aa64acbd3ce791916357d8\System.Runtime.Remoting.ni.dll
MOD - [2012.02.17 03:48:07 | 012,431,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ff30db6905f8ec024fc808ed8779c0f3\System.Windows.Forms.ni.dll
MOD - [2012.02.17 03:47:53 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a09ee392fa90849f2e9313a1ebbe0279\System.Drawing.ni.dll
MOD - [2012.02.17 03:47:00 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll
MOD - [2012.02.17 03:46:54 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\15742b3597258ce67cbe219005c197e5\System.Configuration.ni.dll
MOD - [2012.02.17 03:46:50 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll
MOD - [2012.01.03 15:00:36 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll
MOD - [2011.12.23 15:28:00 | 000,041,472 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\phonostarTimer.exe
MOD - [2011.06.15 13:07:10 | 002,293,248 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\QtCore4.dll
MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2011.03.30 10:46:40 | 000,416,256 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\plugins\sqldrivers\qsqlite4.dll
MOD - [2011.03.30 07:16:34 | 008,173,568 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\QtGui4.dll
MOD - [2011.03.30 06:59:40 | 000,191,488 | ---- | M] () -- C:\Users\Divan\Documents\phonostar-Player\QtSql4.dll
MOD - [2009.07.14 09:54:34 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.07.14 09:54:32 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.07.14 09:54:32 | 000,208,896 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
========== Win32 Services (SafeList) ==========
SRV - [2012.03.04 22:40:10 | 000,748,440 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Programme\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.07.14 09:56:28 | 000,017,920 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\System32\wlms\wlms.exe -- (WLMS)
SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.14 02:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (amifqqre)
DRV - [2012.03.07 22:51:34 | 000,473,656 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2012.03.07 22:46:50 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2012.02.15 17:57:51 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.12.15 15:00:00 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.10.07 10:24:36 | 000,126,976 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.07.14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009.07.14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.07.14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2009.07.13 23:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009.07.13 23:02:49 | 000,229,888 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) Broadcom NetLink (TM)
DRV - [2009.07.13 23:02:46 | 001,096,704 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2005.08.24 14:55:48 | 000,066,560 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2005.08.10 15:06:28 | 000,019,968 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV - [2005.08.10 13:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005.05.16 14:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\prxtbBit0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 97 19 6D AA 22 C8 CC 01 [binary data]
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\prxtbBit0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes,DefaultScope = {4D632744-B696-48D6-B3AF-B7C0E581C978}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=110482&mntrId=3affef9d00000000000006225fedc958
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{4D632744-B696-48D6-B3AF-B7C0E581C978}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{B1C51B79-9B38-4234-9DD5-B2D24828ED9D}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2849855
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb106/?search={searchTerms}&loc=IB_DS&a=6OyovPlcB2&i=26
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 99 70 6D 72 43 C9 CC 01 [binary data]
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\..\SearchScopes,DefaultScope = {44AD2780-5C97-4FD4-90BB-D9A41D18A4F6}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\..\SearchScopes\{44AD2780-5C97-4FD4-90BB-D9A41D18A4F6}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
IE - HKU\S-1-5-21-1386417269-986701621-1243459835-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultthis.engineName: "BittorrentBar_DE Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316&ilc=12"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://mystart.incredibar.com/mb106?a=6OyovPlcB2&i=26"
FF - prefs.js..keyword.URL: "hxxp://mystart.incredibar.com/mb106/?loc=IB_DS&a=6OyovPlcB2&&i=26&search="
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2849855&SearchSource=3&q={searchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "MyStart Search"
FF - prefs.js..browser.startup.homepage: "hxxp://mystart.incredibar.com/mb106?a=6OyovPlcB2&i=26"
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.23 03:37:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
[2012.02.27 01:22:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tommy\AppData\Roaming\mozilla\Extensions
[2012.03.12 18:13:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions
[2012.03.09 03:02:04 | 000,000,000 | ---D | M] (BittorrentBar_DE Community Toolbar) -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}
[2012.02.27 01:20:18 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
[2012.01.11 03:15:21 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.02.27 01:22:16 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions\ffxtlbr@babylon.com
[2012.03.09 01:45:11 | 000,000,000 | ---D | M] (TheBflix) -- C:\Users\Tommy\AppData\Roaming\mozilla\Firefox\Profiles\9v00ijvq.default\extensions\info@bflix.info
[2011.11.30 21:58:50 | 000,000,935 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\Mozilla\Firefox\Profiles\9v00ijvq.default\searchplugins\conduit.xml
[2012.01.01 23:33:34 | 000,002,203 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\Mozilla\Firefox\Profiles\9v00ijvq.default\searchplugins\MyStart Search.xml
[2012.01.30 16:02:08 | 000,003,915 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\Mozilla\Firefox\Profiles\9v00ijvq.default\searchplugins\SweetIM Search.xml
[2012.02.27 01:20:11 | 000,003,915 | ---- | M] () -- C:\Users\Tommy\AppData\Roaming\Mozilla\Firefox\Profiles\9v00ijvq.default\searchplugins\sweetim.xml
[2012.01.13 21:13:23 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.23 03:37:51 | 000,000,000 | ---D | M] (Widgi Toolbar Platform) -- C:\PROGRAM FILES\COMMON FILES\SPIGOT\WTXPCOM
[2012.03.12 18:13:18 | 000,000,000 | ---D | M] (pdfforge Toolbar) -- C:\PROGRAM FILES\PDFFORGE TOOLBAR\FF
[2012.03.23 03:37:50 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.26 21:39:45 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.29 02:43:10 | 000,002,288 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.02.26 21:39:45 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.26 21:39:45 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.26 21:39:45 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.26 21:39:45 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.26 21:39:45 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2012.03.22 02:13:13 | 000,000,903 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: ::1 www.facebook.com
O1 - Hosts: 173.194.35.184 hxxp://de-de.facebook.com/
O2 - BHO: (Shopping Assistant Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Programme\PriceGong\2.5.4\PriceGongIE.dll (PriceGong)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (TheBflix Class) - {3D568DC4-D0DB-4EC0-BDF6-20BC87C3E0C9} - C:\ProgramData\TheBflix\bhoclass.dll (Injector)
O2 - BHO: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\prxtbBit0.dll (Conduit Ltd.)
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Programme\Incredibar.com\incredibar\1.5.3.27\bh\incredibar.dll (Montera Technologeis LTD)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\prxtbBit0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\IE\5.1\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Programme\Incredibar.com\incredibar\1.5.3.27\incredibarTlbr.dll (Montera Technologeis LTD)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000\..\Toolbar\WebBrowser: (BittorrentBar_DE Toolbar) - {64EAD72B-FFD4-4E01-AA3A-4C71665D73E4} - C:\Programme\BittorrentBar_DE\prxtbBit0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ExpressFiles] C:\Program Files\ExpressFiles\ExpressFiles.exe (hxxp://www.express-files.com/)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000..\Run: [BitTorrent] C:\Program Files\BitTorrent\BitTorrent.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000..\Run: [gema] C:\Users\Tommy\AppData\Roaming\gema\gema.exe ()
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000..\Run: [Media Finder] "C:\Program Files\Media Finder\MF.exe" /opentotray File not found
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1001..\Run: [Media Finder] "C:\Program Files\Media Finder\MF.exe" /opentotray File not found
O4 - HKU\S-1-5-21-1386417269-986701621-1243459835-1001..\Run: [phonostarTimer] C:\Users\Divan\Documents\phonostar-Player\phonostarTimer.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Download with &Media Finder - C:\Program Files\Media Finder\hook.html File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Tommy\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5854CD09-C763-4A22-939C-AA9DAF6EFA7D}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9ABCCBBF-F4D0-48C8-8257-76B536D439E2}: DhcpNameServer = 192.168.178.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000 Winlogon: Shell - (C:\Users\Tommy\AppData\Roaming\gema\gema.exe) - C:\Users\Tommy\AppData\Roaming\gema\gema.exe ()
O20 - HKU\S-1-5-21-1386417269-986701621-1243459835-1000 Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012.03.24 03:42:39 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\gema
[2012.03.24 03:42:38 | 000,000,000 | ---D | C] -- C:\ProgramData\gema
[2012.03.20 15:36:21 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\Malwarebytes
[2012.03.20 15:36:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.03.20 15:36:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.03.20 15:36:12 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.03.20 15:36:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.03.14 14:17:14 | 003,957,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012.03.14 14:17:13 | 003,902,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012.03.14 09:57:55 | 002,341,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.03.14 09:57:52 | 001,170,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2012.03.14 09:57:52 | 001,074,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012.03.14 09:57:52 | 000,739,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2012.03.14 09:57:52 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2012.03.14 09:57:52 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2012.03.14 09:57:23 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012.03.14 09:57:23 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012.03.14 09:57:22 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012.03.14 09:57:19 | 000,826,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
[2012.03.12 23:40:01 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RedLight Evolution
[2012.03.12 23:32:35 | 000,000,000 | ---D | C] -- C:\Program Files\RedLight Evolution21-10-2011
[2012.03.12 18:13:16 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater
[2012.03.12 18:13:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot
[2012.03.12 18:13:15 | 000,000,000 | ---D | C] -- C:\Program Files\pdfforge Toolbar
[2012.03.11 16:07:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012.03.11 16:07:17 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2012.03.11 15:49:10 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\Neuer Ordner
[2012.03.11 13:44:34 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\WR2Mods
[2012.03.10 22:23:12 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2012.03.09 03:51:08 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\wr2 edit car
[2012.03.09 03:47:27 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\world racing mods
[2012.03.09 03:47:24 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\KalOnline
[2012.03.09 03:47:04 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\crack wr2
[2012.03.09 03:46:51 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\Backup für crack
[2012.03.09 00:47:12 | 025,037,979 | ---- | C] (InstallShield Software Corporation ) -- C:\Users\Tommy\Desktop\WR2upd_111_133.exe
[2012.03.08 23:55:58 | 000,000,000 | ---D | C] -- C:\Program Files\InstallShield Installation Information
[2012.03.08 23:55:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World Racing 2
[2012.03.08 23:45:52 | 000,000,000 | ---D | C] -- C:\Program Files\Playlogic
[2012.03.08 23:45:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2012.03.08 23:44:12 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\wracing2
[2012.03.08 22:08:18 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\The Creative Assembly
[2012.03.08 22:06:49 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_40.dll
[2012.03.08 22:06:49 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_40.dll
[2012.03.08 22:06:48 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll
[2012.03.08 22:06:48 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll
[2012.03.08 22:06:48 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll
[2012.03.08 22:06:48 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll
[2012.03.08 22:06:48 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll
[2012.03.08 22:06:48 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll
[2012.03.08 22:06:47 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_39.dll
[2012.03.08 22:06:47 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll
[2012.03.08 22:06:47 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll
[2012.03.08 22:06:47 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll
[2012.03.08 22:06:46 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_1.dll
[2012.03.08 22:06:46 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_0.dll
[2012.03.08 22:06:45 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_38.dll
[2012.03.08 22:06:45 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_38.dll
[2012.03.08 22:06:45 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_1.dll
[2012.03.08 22:06:45 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_4.dll
[2012.03.08 22:06:44 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_38.dll
[2012.03.08 22:06:44 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_0.dll
[2012.03.08 22:06:43 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_37.dll
[2012.03.08 22:06:43 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_37.dll
[2012.03.08 22:06:43 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_0.dll
[2012.03.08 22:06:43 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_3.dll
[2012.03.08 22:06:42 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_37.dll
[2012.03.08 22:06:42 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_10.dll
[2012.03.08 22:06:41 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_36.dll
[2012.03.08 22:06:41 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_36.dll
[2012.03.08 22:06:41 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_36.dll
[2012.03.08 22:06:40 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_35.dll
[2012.03.08 22:06:40 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_35.dll
[2012.03.08 22:06:40 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_35.dll
[2012.03.08 22:06:40 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_9.dll
[2012.03.08 22:06:40 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_8.dll
[2012.03.08 22:06:40 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_2.dll
[2012.03.08 22:06:39 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_34.dll
[2012.03.08 22:06:39 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_34.dll
[2012.03.08 22:06:39 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_34.dll
[2012.03.08 22:06:38 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_7.dll
[2012.03.08 22:06:38 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_3.dll
[2012.03.08 22:06:37 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_33.dll
[2012.03.08 22:06:37 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_33.dll
[2012.03.08 22:06:37 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_33.dll
[2012.03.08 22:06:36 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_32.dll
[2012.03.08 22:06:36 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10.dll
[2012.03.08 22:06:36 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_6.dll
[2012.03.08 22:06:36 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_5.dll
[2012.03.08 22:06:35 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_31.dll
[2012.03.08 22:06:35 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_4.dll
[2012.03.08 22:06:35 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_1.dll
[2012.03.08 22:06:34 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_3.dll
[2012.03.08 22:06:34 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_2.dll
[2012.03.08 22:06:34 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_1.dll
[2012.03.08 22:06:34 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_2.dll
[2012.03.08 22:06:34 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_1.dll
[2012.03.08 22:06:20 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll
[2012.03.08 22:06:19 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_29.dll
[2012.03.08 22:06:19 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_28.dll
[2012.03.08 22:06:19 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_27.dll
[2012.03.08 22:06:19 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_0.dll
[2012.03.08 22:06:19 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_0.dll
[2012.03.08 22:06:18 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_26.dll
[2012.03.08 22:06:17 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_24.dll
[2012.03.08 22:04:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Empire - Total War
[2012.03.08 20:19:38 | 000,000,000 | ---D | C] -- C:\Program Files\Empire - Total War
[2012.03.08 16:39:54 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\Empire - Total War
[2012.03.08 15:26:41 | 000,000,000 | ---D | C] -- C:\ProgramData\TheBflix
[2012.03.08 15:26:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TheBflix
[2012.03.08 14:49:36 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Local\BittorrentBar_DE
[2012.03.07 22:51:34 | 000,473,656 | ---- | C] (Duplex Secure Ltd.) -- C:\Windows\System32\drivers\sptd.sys
[2012.03.07 22:50:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2012.03.07 22:46:50 | 000,242,240 | ---- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2012.03.07 22:46:42 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite
[2012.03.07 22:45:36 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\DAEMON Tools Lite
[2012.03.07 22:45:34 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite
[2012.03.07 22:34:50 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2012.03.07 22:34:13 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\uTorrent
[2012.03.06 21:10:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DigitalZone
[2012.02.28 17:59:08 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Local\Google
[2012.02.28 17:59:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2012.02.28 17:59:02 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012.02.28 17:57:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012.02.28 17:57:42 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012.02.28 17:56:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012.02.28 17:46:45 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\pdfforge
[2012.02.28 17:46:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
[2012.02.28 17:46:41 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSCOMCT2.OCX
[2012.02.28 17:46:41 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSMAPI32.OCX
[2012.02.28 17:46:40 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSCMCDE.DLL
[2012.02.28 17:46:40 | 000,125,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\VB6DE.DLL
[2012.02.28 17:46:39 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSCC2DE.DLL
[2012.02.28 17:46:39 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSMPIDE.DLL
[2012.02.28 17:46:39 | 000,000,000 | ---D | C] -- C:\Program Files\PDFCreator
[2012.02.27 20:29:32 | 000,000,000 | ---D | C] -- C:\Users\Tommy\Desktop\Download
[2012.02.27 01:22:18 | 000,000,000 | ---D | C] -- C:\Users\Tommy\AppData\Roaming\Media Finder
[2012.02.27 01:20:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong
[2012.02.27 01:20:17 | 000,000,000 | ---D | C] -- C:\Program Files\PriceGong
[2012.02.27 01:20:05 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM
[2012.02.27 01:20:05 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM
========== Files - Modified Within 30 Days ==========
[2012.03.24 21:14:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.24 21:08:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1386417269-986701621-1243459835-1001UA.job
[2012.03.24 20:28:57 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.24 20:23:46 | 000,664,634 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.24 20:23:46 | 000,624,776 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.24 20:23:46 | 000,134,770 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.24 20:23:46 | 000,110,414 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.24 20:19:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.24 20:19:24 | 2359,951,360 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.24 20:17:47 | 000,009,936 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.24 20:17:47 | 000,009,936 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.24 17:08:02 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1386417269-986701621-1243459835-1001Core.job
[2012.03.22 02:13:13 | 000,000,903 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.03.20 20:23:58 | 000,002,057 | ---- | M] () -- C:\Users\Tommy\Desktop\KalOnline RedLight.lnk
[2012.03.20 15:36:15 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.20 01:16:13 | 000,010,411 | ---- | M] () -- C:\Users\Tommy\.recently-used.xbel
[2012.03.14 14:23:48 | 000,265,640 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.03.14 14:19:47 | 000,000,129 | ---- | M] () -- C:\Windows\System32\MRT.INI
[2012.03.12 21:36:37 | 000,000,951 | ---- | M] () -- C:\Users\Tommy\Desktop\Empire - Total War.lnk
[2012.03.12 20:27:48 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.03.11 16:14:21 | 076,050,636 | ---- | M] () -- C:\Users\Tommy\Desktop\WR2_Akina_Mountain_Mindkiller.7z
[2012.03.11 16:10:14 | 039,577,870 | ---- | M] () -- C:\Users\Tommy\Desktop\Autumn_Driving_RaoulEmilian.rar
[2012.03.11 16:05:53 | 063,119,096 | ---- | M] () -- C:\Users\Tommy\Desktop\gr2_wr2_gk_bw_stadt.7z
[2012.03.11 13:38:36 | 762,695,948 | ---- | M] () -- C:\Users\Tommy\Desktop\RedLight_Setup21102011.exe
[2012.03.11 00:08:53 | 011,665,358 | ---- | M] () -- C:\Users\Tommy\Desktop\Saleen_S281.rar
[2012.03.11 00:08:02 | 001,645,338 | ---- | M] () -- C:\Users\Tommy\Desktop\k6Volvo9700420Traveller.rar
[2012.03.11 00:01:15 | 001,518,826 | ---- | M] () -- C:\Users\Tommy\Desktop\Traffic_AudiS6_TheTestdriver700 (1).rar
[2012.03.11 00:00:54 | 001,769,998 | ---- | M] () -- C:\Users\Tommy\Desktop\Mercedes_Cls_63_Traffic_Testdriver.rar
[2012.03.11 00:00:24 | 000,234,083 | ---- | M] () -- C:\Users\Tommy\Desktop\Smart_Pischti.zip
[2012.03.10 23:25:57 | 005,046,823 | ---- | M] () -- C:\Users\Tommy\Desktop\Brabus_G_61.rar
[2012.03.10 23:25:28 | 003,146,213 | ---- | M] () -- C:\Users\Tommy\Desktop\CK_Mercedes_S600_W140.7z
[2012.03.10 23:25:02 | 006,585,895 | ---- | M] () -- C:\Users\Tommy\Desktop\Mercedes_O305.rar
[2012.03.08 23:55:49 | 000,002,029 | ---- | M] () -- C:\Users\Tommy\Desktop\World Racing 2.lnk
[2012.03.08 00:04:33 | 000,001,896 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2012.03.07 22:46:50 | 000,242,240 | ---- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2012.03.07 22:34:50 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012.03.07 16:42:39 | 005,716,992 | ---- | M] () -- C:\Users\Tommy\Desktop\FAQ_eng.exe
[2012.03.06 21:10:15 | 000,001,999 | ---- | M] () -- C:\Users\Public\Desktop\Counter-Strike 1.6 DigitalZone.lnk
[2012.03.06 21:10:15 | 000,001,970 | ---- | M] () -- C:\Users\Public\Desktop\Half-Life DigitalZone.lnk
[2012.02.29 02:43:12 | 000,002,418 | ---- | M] () -- C:\user.js
[2012.02.28 17:58:30 | 000,001,989 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.02.28 17:46:46 | 000,000,989 | ---- | M] () -- C:\Users\Public\Desktop\PDFCreator.lnk
[2012.02.27 01:19:57 | 000,000,202 | ---- | M] () -- C:\Users\Tommy\Desktop\SweetPcFix.url
[2012.02.23 23:48:18 | 000,539,196 | ---- | M] () -- C:\Users\Tommy\Desktop\1313570206_Gta Sa SOK Market By MegaGTAMyths.rar
========== Files Created - No Company Name ==========
[2012.03.20 15:36:15 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.20 01:16:13 | 000,010,411 | ---- | C] () -- C:\Users\Tommy\.recently-used.xbel
[2012.03.12 23:40:01 | 000,002,057 | ---- | C] () -- C:\Users\Tommy\Desktop\KalOnline RedLight.lnk
[2012.03.12 23:30:29 | 762,695,948 | ---- | C] () -- C:\Users\Tommy\Desktop\RedLight_Setup21102011.exe
[2012.03.11 16:12:36 | 076,050,636 | ---- | C] () -- C:\Users\Tommy\Desktop\WR2_Akina_Mountain_Mindkiller.7z
[2012.03.11 16:09:22 | 039,577,870 | ---- | C] () -- C:\Users\Tommy\Desktop\Autumn_Driving_RaoulEmilian.rar
[2012.03.11 16:04:22 | 063,119,096 | ---- | C] () -- C:\Users\Tommy\Desktop\gr2_wr2_gk_bw_stadt.7z
[2012.03.11 00:08:09 | 011,665,358 | ---- | C] () -- C:\Users\Tommy\Desktop\Saleen_S281.rar
[2012.03.11 00:07:56 | 001,645,338 | ---- | C] () -- C:\Users\Tommy\Desktop\k6Volvo9700420Traveller.rar
[2012.03.11 00:01:15 | 001,518,826 | ---- | C] () -- C:\Users\Tommy\Desktop\Traffic_AudiS6_TheTestdriver700 (1).rar
[2012.03.11 00:00:51 | 001,769,998 | ---- | C] () -- C:\Users\Tommy\Desktop\Mercedes_Cls_63_Traffic_Testdriver.rar
[2012.03.11 00:00:24 | 000,234,083 | ---- | C] () -- C:\Users\Tommy\Desktop\Smart_Pischti.zip
[2012.03.10 23:25:51 | 005,046,823 | ---- | C] () -- C:\Users\Tommy\Desktop\Brabus_G_61.rar
[2012.03.10 23:25:24 | 003,146,213 | ---- | C] () -- C:\Users\Tommy\Desktop\CK_Mercedes_S600_W140.7z
[2012.03.10 23:24:56 | 006,585,895 | ---- | C] () -- C:\Users\Tommy\Desktop\Mercedes_O305.rar
[2012.03.10 22:25:55 | 000,000,129 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2012.03.09 01:10:11 | 021,224,019 | ---- | C] () -- C:\Users\Tommy\Desktop\Alps_v1.0neu.rar
[2012.03.08 23:55:49 | 000,002,029 | ---- | C] () -- C:\Users\Tommy\Desktop\World Racing 2.lnk
[2012.03.08 22:04:54 | 000,000,951 | ---- | C] () -- C:\Users\Tommy\Desktop\Empire - Total War.lnk
[2012.03.07 22:50:34 | 000,001,896 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2012.03.07 22:34:50 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012.03.07 16:42:39 | 005,716,992 | ---- | C] () -- C:\Users\Tommy\Desktop\FAQ_eng.exe
[2012.03.06 21:10:15 | 000,001,999 | ---- | C] () -- C:\Users\Public\Desktop\Counter-Strike 1.6 DigitalZone.lnk
[2012.03.06 21:10:15 | 000,001,970 | ---- | C] () -- C:\Users\Public\Desktop\Half-Life DigitalZone.lnk
[2012.02.28 17:59:14 | 000,001,096 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.28 17:59:13 | 000,001,092 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.28 17:58:30 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.02.28 17:58:30 | 000,001,989 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.02.28 17:46:46 | 000,000,989 | ---- | C] () -- C:\Users\Public\Desktop\PDFCreator.lnk
[2012.02.28 17:46:41 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2012.02.27 01:19:57 | 000,000,202 | ---- | C] () -- C:\Users\Tommy\Desktop\SweetPcFix.url
[2010.12.09 17:04:51 | 000,159,744 | ---- | C] () -- C:\Windows\System32\msmOn-ern.dll
[2010.10.12 01:21:31 | 000,159,744 | ---- | C] () -- C:\Windows\System32\msmmc-ocd.dll
[2010.08.25 19:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010.08.25 19:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010.08.25 19:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010.08.25 18:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2010.08.25 18:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010.08.25 18:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010.08.25 18:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
========== LOP Check ==========
[2012.01.31 21:19:22 | 000,000,000 | ---D | M] -- C:\Users\Divan\AppData\Roaming\Azureus
[2012.03.23 21:10:06 | 000,000,000 | ---D | M] -- C:\Users\Divan\AppData\Roaming\ExpressFiles
[2012.03.23 02:21:12 | 000,000,000 | ---D | M] -- C:\Users\Divan\AppData\Roaming\Media Finder
[2012.02.24 11:54:08 | 000,000,000 | ---D | M] -- C:\Users\Divan\AppData\Roaming\phonostar GmbH
[2012.01.02 01:04:50 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\Azureus
[2012.01.01 05:05:56 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\Babylon
[2012.03.24 21:30:03 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\BitTorrent
[2012.03.12 21:08:53 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\DAEMON Tools Lite
[2012.01.11 03:16:36 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\DVDVideoSoft
[2012.01.11 03:15:21 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.23 16:48:41 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\ExpressFiles
[2012.03.24 03:42:39 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\gema
[2012.03.09 01:28:04 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\gtk-2.0
[2012.03.23 02:21:12 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\Media Finder
[2012.02.28 17:46:45 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\pdfforge
[2012.03.08 22:08:18 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\The Creative Assembly
[2012.01.07 17:03:22 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\TS3Client
[2012.03.24 21:30:03 | 000,000,000 | ---D | M] -- C:\Users\Tommy\AppData\Roaming\uTorrent
[2012.03.07 22:52:50 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 192 bytes -> C:\ProgramData\TEMP:8927A071
< End of report >
|
