Hallo,

also ich habe mir gestern den GVU Trojaner eingefangen und habe mich dann etwas schlau gemacht wie ich den entfernt bekomme, habe dann die Anleitung hier befolgt --> http://www.trojaner-board.de/112119-...entfernen.html

Der GVU Trojaner ist nun weg, aber um sicher zu gehen soll ich noch einmal die Logs hier reinstellen


Soo einmal den vollständigen Malwarebytes Anti-Malware Log :

 Malwarebytes Anti-Malware  (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.29.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8080.16413
*** :: ***-PC [Administrator]

Schutz: Aktiviert

29.06.2012 12:21:30
mbam-log-2012-06-29 (13-47-18).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 404648
Laufzeit: 1 Stunde(n), 25 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 5
HKCR\CLSID\{20C28584-8F10-4D92-987C-0A1008E2435A} (Trojan.Agent) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{20C28584-8F10-4D92-987C-0A1008E2435A} (Trojan.Agent) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{20C28584-8F10-4D92-987C-0A1008E2435A} (Trojan.Agent) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{20C28584-8F10-4D92-987C-0A1008E2435A} (Trojan.Agent) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F99BD4F5-D402-4c21-A8BC-510830B6BE37} (Trojan.Banker) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 2
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Hijack.Shell.Gen) -> Daten: C:\Users\***\AppData\Roaming\w6j6rt45jtuhdre5.exe -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Userinit (Trojan.Agent) -> Daten: C:\Users\***\AppData\Roaming\appconf32.exe -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

Die gefundenen Malwares hab ich entfernt und hab dann OTL gestartet !


Und hier einmal der OTL Log:

OTL logfile created on: 29.06.2012 13:53:49 - Run 2
OTL by OldTimer - Version 3.2.53.0     Folder = C:\Users\***\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8080.16413)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 0,99 Gb Available Physical Memory | 52,87% Memory free
3,74 Gb Paging File | 2,78 Gb Available in Paging File | 74,36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 677,54 Gb Total Space | 632,87 Gb Free Space | 93,41% Space Free | Partition Type: NTFS
Drive D: | 20,00 Gb Total Space | 13,54 Gb Free Space | 67,68% Space Free | Partition Type: NTFS
 
Computer Name: ***-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Opera\opera.exe (Opera Software)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Adobe\Reader 10.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\PrintIsolationHost.exe (Microsoft Corporation)
PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Brother\BrUtilities\BrLogAPI.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (NisSrv) -- c:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (uxddrv) -- F:\uxddrv86.sys File not found
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dsl-start.computerbild.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://dsl-start.computerbild.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7F 3D 7D 63 78 54 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Azzei] C:\Users\***\AppData\Roaming\Umoce\vyuxp.exe ()
O4 - HKCU..\Run: [bC4lJzJAS4eHdGa] C:\Users\***\AppData\Roaming\w6j6rt45jtuhdre5.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} https://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.66.2.cab (Battlefield Play4Free Updater)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{273B9F28-C4E5-45B4-97FB-AC18D4606B99}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKCU Winlogon: UserInit - (C:\Users\Nuri Ayiz\AppData\Roaming\w6j6rt45jtuhdre5.exe) -  File not found
O20 - HKCU Winlogon: UserInit - (C:\WINDOWS\System32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{aa2528c8-2ca7-11e1-a24f-6c626d05b73c}\Shell - "" = AutoRun
O33 - MountPoints2\{aa2528c8-2ca7-11e1-a24f-6c626d05b73c}\Shell\AutoRun\command - "" = G:\CD_Start.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.29 12:16:12 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.06.29 12:16:12 | 000,000,000 | ---D | C] -- C:\Users\Nuri Ayiz\AppData\Roaming\Malwarebytes
[2012.06.29 12:16:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.29 12:16:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.29 12:16:00 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.06.29 12:16:00 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.29 11:51:51 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Nuri Ayiz\Desktop\OTL.exe
[2012.06.29 11:44:57 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012.06.28 14:01:55 | 000,000,000 | ---D | C] -- C:\ProgramData\F4D55F3B0079246B0142EF0FB4EB23C1
[2012.06.28 14:01:47 | 000,000,000 | ---D | C] -- C:\Users\Nuri Ayiz\AppData\Roaming\Umoce
[2012.06.28 14:01:47 | 000,000,000 | ---D | C] -- C:\Users\Nuri Ayiz\AppData\Roaming\Ifboe
[2012.06.28 14:01:47 | 000,000,000 | ---D | C] -- C:\Users\Nuri Ayiz\AppData\Roaming\Edygc
[2012.06.23 19:09:51 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2012.06.23 19:09:51 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2012.06.23 19:09:31 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2012.06.23 19:09:31 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2012.06.23 19:09:31 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2012.06.23 19:09:20 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2012.06.23 19:09:20 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2012.06.15 09:37:41 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.06.14 10:17:38 | 002,343,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.06.14 10:17:37 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012.06.14 10:17:37 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012.06.14 10:17:36 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012.06.01 16:35:31 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2012.06.01 16:35:31 | 000,161,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2012.06.01 16:35:31 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2012.06.01 16:35:31 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2012.06.01 16:35:31 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2012.06.01 16:35:31 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2012.06.01 16:35:31 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.06.01 16:35:31 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2012.06.01 16:35:30 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2012.06.01 16:35:30 | 001,426,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.06.01 16:35:30 | 000,580,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.06.01 16:35:30 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2012.06.01 16:35:30 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2012.06.01 16:35:30 | 000,356,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2012.06.01 16:35:30 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2012.06.01 16:35:30 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.06.01 16:35:30 | 000,223,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2012.06.01 16:35:30 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.06.01 16:35:30 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2012.06.01 16:35:30 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2012.06.01 16:35:30 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2012.06.01 16:35:30 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2012.06.01 16:35:30 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2012.06.01 16:35:30 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2012.06.01 16:35:30 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2012.06.01 16:35:30 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2012.06.01 16:35:29 | 002,382,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.06.01 16:35:29 | 001,791,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.06.01 16:35:29 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2012.06.01 16:35:29 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2012.06.01 16:35:29 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.06.01 16:35:29 | 000,117,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2012.06.01 16:35:29 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2012.06.01 16:35:29 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2012.06.01 16:35:29 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2012.06.01 16:35:29 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2012.06.01 16:35:29 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2012.06.01 16:34:12 | 000,000,000 | ---D | C] -- C:\Program Files\Feedback Tool
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Nuri Ayiz\AppData\Roaming\*.tmp files -> C:\Users\Nuri Ayiz\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.29 13:53:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.29 13:53:01 | 1507,778,560 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.29 13:26:13 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.06.29 12:48:06 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.29 12:48:06 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.29 12:43:38 | 000,001,919 | ---- | M] () -- C:\Users\***\Desktop\Microsoft Security Essentials.lnk
[2012.06.29 12:21:03 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.06.29 12:16:08 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.29 11:54:50 | 000,656,250 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.06.29 11:54:50 | 000,618,132 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.06.29 11:54:50 | 000,131,022 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.06.29 11:54:50 | 000,107,412 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.06.29 11:51:53 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.06.28 14:07:36 | 000,000,051 | ---- | M] () -- C:\Users\***\AppData\Roaming\blckdom.res
[2012.06.28 12:37:06 | 000,014,208 | ---- | M] () -- C:\Users\***\Desktop\Angebot  für  PRONTO  PIZZERIA  ERWITTE.odt
[2012.06.23 11:03:35 | 000,014,112 | ---- | M] () -- C:\Users\***\Documents\Angebot für  Lieth  Grill  Paderborn.odt
[2012.06.23 09:26:08 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.06.23 09:26:08 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.06.21 12:21:13 | 000,026,650 | ---- | M] () -- C:\Users\***\Desktop\Konserven.odt
[2012.06.21 12:10:45 | 000,026,819 | ---- | M] () -- C:\Users\***\Desktop\Preisliste  2011.odt
[2012.06.21 12:08:25 | 000,012,062 | ---- | M] () -- C:\Users\***\Desktop\Angebot   für  PRONTO PIZZERIA   ERWITTE.odt
[2012.06.18 10:33:43 | 000,012,963 | ---- | M] () -- C:\Users\***\Desktop\Bestellung    A&A  Großhandel.odt
[2012.06.18 09:54:38 | 000,014,399 | ---- | M] () -- C:\Users\***\Documents\Paradies   Grill.odt
[2012.06.16 19:05:53 | 000,013,021 | ---- | M] () -- C:\Users\***\Documents\Angebot  für  Facefood   Imbiss  Rietberg.odt
[2012.06.14 17:50:42 | 000,337,664 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.06.14 13:39:23 | 000,021,310 | ---- | M] () -- C:\Users\***\Documents\Angebot   für    Bei   Badip       Delbrück.odt
[2012.06.04 15:22:09 | 000,013,431 | ---- | M] () -- C:\Users\***\Documents\Saigon   Brockhägerstr.   Gütersloh.odt
[2012.06.04 09:36:27 | 000,016,963 | ---- | M] () -- C:\Users\***\Documents\Angebot  für  Karadeniz  Grill    Rheda-Wiedenbrück.odt
[2012.06.03 00:19:33 | 000,045,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2012.06.03 00:19:32 | 000,035,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2012.06.03 00:19:23 | 000,577,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2012.06.03 00:12:32 | 002,422,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2012.06.03 00:12:13 | 000,088,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2012.06.02 15:19:42 | 000,171,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2012.06.02 15:12:20 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2012.06.02 12:56:32 | 000,016,318 | ---- | M] () -- C:\Users\***\Documents\Angebot  für   Bella   Kreta   Pizzeria   Gütersloh.odt
[2012.06.01 16:35:32 | 000,161,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2012.06.01 16:35:31 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2012.06.01 16:35:31 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2012.06.01 16:35:31 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2012.06.01 16:35:31 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2012.06.01 16:35:31 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2012.06.01 16:35:31 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2012.06.01 16:35:31 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.06.01 16:35:31 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2012.06.01 16:35:30 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2012.06.01 16:35:30 | 002,382,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.06.01 16:35:30 | 001,426,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.06.01 16:35:30 | 000,580,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.06.01 16:35:30 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2012.06.01 16:35:30 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2012.06.01 16:35:30 | 000,356,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2012.06.01 16:35:30 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2012.06.01 16:35:30 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.06.01 16:35:30 | 000,223,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2012.06.01 16:35:30 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.06.01 16:35:30 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2012.06.01 16:35:30 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2012.06.01 16:35:30 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2012.06.01 16:35:30 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2012.06.01 16:35:30 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2012.06.01 16:35:30 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2012.06.01 16:35:30 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2012.06.01 16:35:30 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2012.06.01 16:35:29 | 001,791,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.06.01 16:35:29 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2012.06.01 16:35:29 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2012.06.01 16:35:29 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.06.01 16:35:29 | 000,117,760 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2012.06.01 16:35:29 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2012.06.01 16:35:29 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2012.06.01 16:35:29 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2012.06.01 16:35:29 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2012.06.01 16:35:29 | 000,010,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\***\AppData\Roaming\*.tmp files -> C:\Users\***\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.29 12:43:38 | 000,001,919 | ---- | C] () -- C:\Users\***\Desktop\Microsoft Security Essentials.lnk
[2012.06.29 12:16:08 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.14 14:15:51 | 000,014,399 | ---- | C] () -- C:\Users\***\Documents\Paradies   Grill.odt
[2012.06.11 09:07:59 | 000,000,051 | ---- | C] () -- C:\Users\***\AppData\Roaming\blckdom.res
[2012.06.01 16:35:30 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2012.05.31 12:38:37 | 000,014,208 | ---- | C] () -- C:\Users\***\Desktop\Angebot  für  PRONTO  PIZZERIA  ERWITTE.odt
[2012.05.31 12:31:54 | 000,012,062 | ---- | C] () -- C:\Users\***\Desktop\Angebot   für  PRONTO PIZZERIA   ERWITTE.odt
[2012.04.18 10:05:57 | 000,000,995 | ---- | C] () -- C:\Windows\eReg.dat
[2012.04.12 10:22:09 | 000,011,463 | ---- | C] () -- C:\Users\***\Bei  Onkel  Brunch Rechnung  Tische.odt
[2011.11.25 13:15:38 | 000,000,035 | ---- | C] () -- C:\Windows\SIERRA.INI
[2011.10.26 14:34:23 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2011.10.26 14:34:22 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2011.10.25 11:31:03 | 000,138,264 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2011.10.25 11:31:03 | 000,138,056 | ---- | C] () -- C:\Users\***\AppData\Roaming\PnkBstrK.sys
[2011.10.25 11:30:37 | 000,234,768 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2011.10.25 11:30:33 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2011.10.01 11:08:42 | 000,000,232 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2011.08.26 15:05:39 | 000,010,865 | ---- | C] () -- C:\Users\***\Preise Pizzakartons NEUE.odt
[2011.08.20 13:52:00 | 000,012,444 | ---- | C] () -- C:\Users\***\Von   FODI   XL   Einkauf   und   Verkauf.odt
[2011.08.11 14:36:03 | 000,021,731 | ---- | C] () -- C:\Users\***\Beckum  Preise.odt
[2011.08.04 11:12:42 | 000,022,219 | ---- | C] () -- C:\Users\***\Preisliste  Pizzerien.odt
[2011.07.25 10:46:01 | 000,911,092 | ---- | C] () -- C:\Users\***\Großhandel  Logo.jpg
[2011.06.10 06:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2011.06.04 09:37:00 | 000,000,248 | ---- | C] () -- C:\Users\***\AppData\Roaming\wklnhst.dat
[2011.06.02 21:56:15 | 000,000,229 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2011.06.02 21:56:15 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini
[2011.06.02 21:55:39 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.06.02 21:55:39 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.06.02 21:54:35 | 000,000,050 | ---- | C] () -- C:\Windows\System32\bridf08b.dat
[2011.06.02 21:54:03 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat
[2011.06.02 21:50:21 | 000,031,864 | ---- | C] () -- C:\Windows\maxlink.ini
[2011.02.11 19:10:52 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2011.02.11 19:10:50 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2011.02.11 19:10:50 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2011.02.11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2011.02.11 18:38:44 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
 
========== LOP Check ==========
 
[2011.08.05 17:42:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Command & Conquer 3 Kanes Rache
[2011.08.09 17:51:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2012.02.07 14:10:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2011.07.14 14:22:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2011.07.14 14:22:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.06.28 14:06:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Edygc
[2012.06.28 14:01:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ifboe
[2012.05.30 11:39:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\kock
[2011.06.02 21:53:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2011.10.24 17:08:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Opera
[2011.08.18 12:58:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Sierra Entertainment
[2011.06.06 17:58:07 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Template
[2012.06.05 14:12:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\UAs
[2012.02.14 13:57:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ubisoft
[2012.06.28 14:01:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Umoce
[2012.02.14 14:42:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\uTorrent
[2012.02.23 11:01:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WoAx-IT
[2012.06.05 14:13:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\xmldm
[2012.06.06 17:42:21 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         

OTL Extras logfile created on: 29.06.2012 13:53:49 - Run 2
OTL by OldTimer - Version 3.2.53.0     Folder = C:\Users\***\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8080.16413)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 0,99 Gb Available Physical Memory | 52,87% Memory free
3,74 Gb Paging File | 2,78 Gb Available in Paging File | 74,36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 677,54 Gb Total Space | 632,87 Gb Free Space | 93,41% Space Free | Partition Type: NTFS
Drive D: | 20,00 Gb Total Space | 13,54 Gb Free Space | 67,68% Space Free | Partition Type: NTFS
 
Computer Name: ***-PC | User Name: ***| Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C85CA3F-EAF1-4F8F-AC2E-100D5435EC7A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{13CAFEFE-C79A-4C0F-99C2-7CDEB68B85F2}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{1844A5DB-AED4-488C-BAF1-ACFAC936BF78}" = lport=6112 | protocol=6 | dir=in | name=6112 | 
"{1D774036-45B6-44FB-B299-7CFF7FFCE673}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{1DC7E328-769E-48FE-824E-C4BE11D3C86F}" = rport=139 | protocol=6 | dir=out | app=system | 
"{26740B4F-8D2D-4B54-BB0D-A6E945B2643A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{2ED4E10F-711D-490F-AEB3-EAF6D33BB507}" = rport=445 | protocol=6 | dir=out | app=system | 
"{2FD33465-3F23-46DD-ADAE-2260E85F55CD}" = lport=139 | protocol=6 | dir=in | app=system | 
"{32D0625D-E86B-4410-80AB-2B02DD1B10FD}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{3B585B05-6D86-4C9D-8190-85DC61B755B8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{4365A3C0-9A58-4850-AD73-70C523EE4A5B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{4AEE451A-178E-473C-AF3D-FE3E4F1C9C44}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{603D7582-3015-4F42-B1D2-D30C1432B2FF}" = lport=138 | protocol=17 | dir=in | app=system | 
"{6C604577-B2C1-41C3-9C41-523FE9C27CFF}" = rport=137 | protocol=17 | dir=out | app=system | 
"{6EF5A78D-EE4C-4F01-83F2-FA9EA1A3E0F6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{75CEE065-883C-4A65-ABD1-4E234490B77E}" = lport=6881 | protocol=6 | dir=in | name=6881 | 
"{775DD43B-47B9-4531-96AC-BFDAAA061125}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{86B77401-0219-4616-8BC1-F214748CC401}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{9EBB6C93-C398-4A28-A630-FBA3A03A297A}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 | 
"{A0BF7709-DD39-4B68-9AA2-B524CDCE1BF0}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A50D4A64-8EAB-4C1E-B213-3D04D1D62658}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{AAAB8A99-5581-4BE9-86F0-FB47733FE857}" = lport=445 | protocol=6 | dir=in | app=system | 
"{C4AFF5CA-660D-4615-8B0B-23B4773B70C1}" = lport=6999 | protocol=6 | dir=in | name=6999 | 
"{D53940F4-F18D-4FCA-8804-61B539A869D6}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{D7C55DF9-6E2A-4B21-BF4F-504EEBA4C0AD}" = rport=138 | protocol=17 | dir=out | app=system | 
"{D96B0AF4-C1E0-4BE7-BFED-515FE76A5497}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{DA89DDCC-71B0-49C2-BDA0-355C0933622A}" = lport=1119 | protocol=6 | dir=in | name=1119 | 
"{E2E8D4CB-7AC3-48B7-A125-DA13A3160281}" = lport=3724 | protocol=6 | dir=in | name=3724 | 
"{E6C28BB5-69A3-4B95-B316-150E41C988C3}" = lport=137 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{074953A6-860D-4631-AF0F-7F051ED86536}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 
"{0867BAA3-D940-4AB7-85AA-781574ABFCA4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{08F9CCDA-8DC6-4E3C-A0BC-0DEE47C4CD6C}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{0A2173F0-83E8-46BD-AD45-98B1EDB253D4}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 
"{0C01D3D2-AE71-4F26-99BF-A329C2E1921B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{262C24A0-69FC-4254-9250-5E9DE126350E}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{2676D568-987D-45FA-BFE2-2DC7B934B6B8}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe | 
"{35150CFC-EAAF-4A81-8F1F-DE2748AB41AF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{37AFAB4A-28A0-43F7-AA71-5777A44F016E}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{38001E01-E9CC-4B28-BA40-35AC52ADFE40}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 
"{469CCA3B-F2B6-4282-8B1D-37A976DDDB99}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{49A1A732-3EB7-44A3-B0A7-A2C2B8EDFFFA}" = protocol=17 | dir=in | app=c:\program files\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{4C14A2FB-D7D0-4371-80F8-9A83BE5DA3F4}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{51274EF0-7984-4E92-93FF-DF9425D428B3}" = protocol=17 | dir=in | app=c:\program files\world of warcraft\launcher.patch.exe | 
"{55C59431-AC81-469F-AA9D-13C47F14CDAA}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{57A45EDF-9449-40F6-9B6F-29EFFC50D257}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{6092AE64-61EF-4B96-9A04-34460281E67E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{63C86683-1D8B-4FE3-9C64-66ED021B0FC4}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{6DD79C2A-F42F-4D75-AB8D-2DB0C61B002A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{6E2C3062-6B7F-4D4C-BFBC-0BFA8B9D4EF0}" = protocol=17 | dir=in | app=c:\program files\starcraft ii\versions\base15405\sc2.exe | 
"{701747CC-A64F-484D-8B15-E0DEF8BD3442}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{7634434C-D54A-49B7-ABD7-392C9C6E0263}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"{76CF78A5-81F4-4639-8822-1FFFA466A497}" = protocol=17 | dir=in | app=c:\program files\starcraft ii\versions\base21029\sc2.exe | 
"{7B3C9B72-8E55-4093-B8AD-659FB3658E83}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe | 
"{7D0BBBB7-C123-4B86-BA44-A897CF2F04E9}" = protocol=17 | dir=in | app=c:\program files\world of warcraft\launcher.exe | 
"{7E6B36FB-F64E-432F-8A4C-7D708F7F51D3}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{80551BDE-F48B-4777-B021-F933624B88A3}" = protocol=6 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe | 
"{86B97488-DE81-45A9-A8A0-B680ACD2B24B}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{8DFF2B73-1AAE-44F1-9462-A5D16CF0D632}" = protocol=6 | dir=out | app=system | 
"{8E6D325E-9C60-49E8-B424-096D59317CE6}" = protocol=6 | dir=in | app=c:\program files\world of warcraft\launcher.patch.exe | 
"{94E17C80-AB13-445C-AA04-A0D6C409EC38}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{9D164B72-8FA3-47D6-BB4E-AC11DEB65275}" = protocol=17 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe | 
"{A965F70C-904E-4CC8-B31D-91A69BCCA80D}" = protocol=6 | dir=in | app=c:\program files\starcraft ii\versions\base21029\sc2.exe | 
"{AC27E8DB-0814-4F9F-8782-1620A96478CA}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.patch.exe | 
"{B01800E3-CF57-48B7-A329-131FBBA5B1DB}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{B24536EA-9A0E-494F-BD3B-6E6CCB72EA25}" = protocol=6 | dir=in | app=c:\program files\world of warcraft\launcher.exe | 
"{B79FCDD4-FDA0-4933-BB55-07702F328765}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe | 
"{B7E6F40C-23A7-4D75-AA16-B7065791D076}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\wow-x.x.x.x-4.0.0.12911-downloader.exe | 
"{B9931A8B-F155-493B-BFEE-ABB3095D3829}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe | 
"{BBBCB949-D759-44CD-B00F-33661D70FB83}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 
"{C5DBAD99-443F-41BD-A949-87A47D2695C8}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.patch.exe | 
"{C8507CC8-68AB-44B5-A79A-AA9DFF386B26}" = protocol=6 | dir=in | app=c:\program files\starcraft ii\versions\base15405\sc2.exe | 
"{CB3B559F-3A0E-46B6-97B4-3B08C6499348}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{CE4B60D7-535F-4A02-ABE8-2CA09051C81A}" = protocol=6 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe | 
"{D072F801-5494-497C-9BB6-BFC1477582C8}" = protocol=17 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe | 
"{DAC4AA0C-3238-425E-893B-F33916B440B5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{DE05C930-F6FE-4739-942C-AC62FE7105AD}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe | 
"{E09B05A6-2ECE-4F7A-BE6C-40E1D383DF01}" = dir=in | app=c:\program files\electronic arts\command & conquer 3 kanes rache\retailexe\1.0\cnc3ep1.dat | 
"{E2928F96-2E89-4A11-985D-A7B737E33BAA}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{E4231019-55EC-48D2-B9C1-D04AC39D6F37}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\wow-x.x.x.x-4.0.0.12911-downloader.exe | 
"{E4E9599E-41CB-43A4-A05E-819AE1982364}" = protocol=6 | dir=in | app=c:\program files\diablo iii\diablo iii.exe | 
"{E5D6E942-E675-49ED-9967-ED4654F433CB}" = protocol=17 | dir=in | app=c:\program files\diablo iii\diablo iii.exe | 
"{F3140AFB-4A4B-465F-8670-97E4B8516D05}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe | 
"{F3C914F9-4E21-45E9-AC5D-9DCA22841575}" = protocol=6 | dir=in | app=c:\program files\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{F7422A3D-50EA-4A10-920B-AD9EC4D40102}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{FB431E52-E204-4419-91B5-8E1FBE4B3457}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{FEFBD851-3044-4C82-A073-BF40C7F63006}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"TCP Query User{00B868DA-2657-4F4F-BA1E-F7101707B127}C:\program files\cityvillebot\cvbot.exe" = protocol=6 | dir=in | app=c:\program files\cityvillebot\cvbot.exe | 
"TCP Query User{144865DC-97DC-4377-A5D5-A51F201AA88A}C:\users\***\appdata\local\opera\opera\temporary_downloads\diablo-iii-8370-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\opera\opera\temporary_downloads\diablo-iii-8370-dede-installer-downloader.exe | 
"TCP Query User{327BA34D-7086-4000-AB46-EE6108FE88E7}C:\users\public\games\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe | 
"TCP Query User{4188D01D-0865-4C27-8B24-9D4FBFEB8B11}C:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe | 
"TCP Query User{55145FAE-F73D-4F40-92C0-B8B62FB35D49}C:\users\nuri ayiz\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\cprogram filesopera\operaupgrader.exe | 
"TCP Query User{60DEA1DD-7413-4ACC-9795-0E5BBD14CE82}C:\program files\world of warcraft\temp\wow-4.2.1.2727-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2727-enus-tools-downloader.exe | 
"TCP Query User{6565386A-196D-44E4-ACB6-2950024ABE0F}C:\sierra\empire earth\empire earth.exe" = protocol=6 | dir=in | app=c:\sierra\empire earth\empire earth.exe | 
"TCP Query User{67BE9662-3374-4E34-B2DD-141B11E79E61}C:\users\nuri ayiz\desktop\diablo-iii-8370-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\***\desktop\diablo-iii-8370-dede-installer-downloader.exe | 
"TCP Query User{6AB3B3FB-5DB9-41FA-AF11-B7636ABF8FAB}C:\users\nuri ayiz\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\electronicarts_patcher_000.exe | 
"TCP Query User{6E4F9237-F250-4DD9-9650-A551C3491E96}C:\program files\ea games\battlefield play4free\bfp4f.exe" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield play4free\bfp4f.exe | 
"TCP Query User{7C3BBB7C-1828-44EE-9E65-B57AFC64C14E}C:\program files\world of warcraft\temp\wow-4.2.1.2730-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2730-enus-tools-downloader.exe | 
"TCP Query User{817867F5-20DB-491A-8436-A06CD55CB11E}C:\program files\thq\dawn of war\w40k.exe" = protocol=6 | dir=in | app=c:\program files\thq\dawn of war\w40k.exe | 
"TCP Query User{9AF7B17E-E19C-4F69-8FB2-AF3950BBF631}C:\program files\starcraft ii\versions\base15405\sc2.exe" = protocol=6 | dir=in | app=c:\program files\starcraft ii\versions\base15405\sc2.exe | 
"TCP Query User{CB9D1161-D157-42A0-A214-13E5603F7301}C:\windows\system32\taskhost.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskhost.exe | 
"TCP Query User{D3B2C2DF-54BA-4D63-B876-0D895C96FA50}C:\programdata\battle.net\agent\agent.749\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.749\agent.exe | 
"TCP Query User{D5B417EB-C650-4EED-A2E8-40CB26195093}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 
"TCP Query User{E3C7CB9C-673C-4536-B875-2767EDCF822B}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"TCP Query User{F534A655-1483-4D9D-BD3E-C77B2A1A7379}C:\programdata\battle.net\agent\agent.868\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.868\agent.exe | 
"UDP Query User{1911879C-9B7F-43C8-A7E6-E07CE001FA9C}C:\users\***\desktop\diablo-iii-8370-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\***\desktop\diablo-iii-8370-dede-installer-downloader.exe | 
"UDP Query User{2CE87DE9-E440-4D87-AABE-8C234478B3E0}C:\users\***\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\electronicarts_patcher_000.exe | 
"UDP Query User{335363CB-D622-495A-85BF-AB293984516C}C:\users\***\appdata\local\opera\opera\temporary_downloads\diablo-iii-8370-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\nuri ayiz\appdata\local\opera\opera\temporary_downloads\diablo-iii-8370-dede-installer-downloader.exe | 
"UDP Query User{462891AB-47D7-49A0-B711-A1649FDD2B58}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 
"UDP Query User{4F834AD9-E182-4A1E-83E1-57CFC3D84F33}C:\users\public\games\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe | 
"UDP Query User{50C5C039-C834-467C-91C5-5B61AE64A4D0}C:\program files\cityvillebot\cvbot.exe" = protocol=17 | dir=in | app=c:\program files\cityvillebot\cvbot.exe | 
"UDP Query User{57FDB9D2-672F-4987-817B-406B36883447}C:\program files\world of warcraft\temp\wow-4.2.1.2730-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2730-enus-tools-downloader.exe | 
"UDP Query User{5F61220E-F732-4CD7-98BD-9957A7420713}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"UDP Query User{70B98E48-A4C7-47C5-ADD7-1F90FEF3AEB7}C:\program files\thq\dawn of war\w40k.exe" = protocol=17 | dir=in | app=c:\program files\thq\dawn of war\w40k.exe | 
"UDP Query User{7DABA21C-C2E0-461D-A5F3-C9F35C229A41}C:\users\***\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\cprogram filesopera\operaupgrader.exe | 
"UDP Query User{88AA2464-D681-4468-95D6-2F7FE25F8723}C:\program files\ea games\battlefield play4free\bfp4f.exe" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield play4free\bfp4f.exe | 
"UDP Query User{89CE6949-9746-48C8-8221-A53DEC035021}C:\programdata\battle.net\agent\agent.868\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.868\agent.exe | 
"UDP Query User{AC3B2423-18C5-4478-A153-0B6AF413F186}C:\program files\world of warcraft\temp\wow-4.2.1.2727-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2727-enus-tools-downloader.exe | 
"UDP Query User{DD8D3099-46A9-46CB-82FB-43218E77BC8C}C:\windows\system32\taskhost.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskhost.exe | 
"UDP Query User{E768F98F-9512-4012-9A46-45DED2EFD6DC}C:\sierra\empire earth\empire earth.exe" = protocol=17 | dir=in | app=c:\sierra\empire earth\empire earth.exe | 
"UDP Query User{E97D3925-90A9-4F5A-88D6-ACF5EE1C165E}C:\programdata\battle.net\agent\agent.749\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.749\agent.exe | 
"UDP Query User{ED1F9670-E211-4CC0-93D7-874819C7B35C}C:\program files\starcraft ii\versions\base15405\sc2.exe" = protocol=17 | dir=in | app=c:\program files\starcraft ii\versions\base15405\sc2.exe | 
"UDP Query User{FA50C7E0-36EA-4B4C-B3AB-3A74DE5014D8}C:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}" = ScanSoft PaperPort 11
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{13A5E785-5197-4EAD-8EE3-D660271E49BC}" = Feedback Tool
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F77C418-2C90-459C-BD33-B56A4182B9FA}" = System Requirements Lab CYRI
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 30
"{29042B1C-0713-4575-B7CA-5C8E7B0899D4}" = MySQL Connector/ODBC 5.1
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{48D082B9-18F6-4426-AFAC-8B6A3E7021B1}" = Brother MFL-Pro Suite MFC-250C
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Opera 12.00.1467" = Opera 12.00
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 22.06.2012 11:56:15 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc100  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b60  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0001df3d  ID des fehlerhaften
 Prozesses: 0x1578  Startzeit der fehlerhaften Anwendung: 0x01cd508f8cd8b5b9  Pfad der
 fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften Moduls:
 C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: cb9e22fa-bc82-11e1-8c56-6c626d05b73c
 
Error - 22.06.2012 12:57:21 | Computer Name = ***-PC | Source = Brother BrLog | ID = 1001
Description = WDLMW BrtWDLMW: [2012/06/22 18:57:21.079]: [00002572]: lperrcode->api
 = 1 , lperrcode->code = 2   
 
Error - 22.06.2012 12:57:22 | Computer Name = ***-PC | Source = Brother BrLog | ID = 1001
Description = WDLMW BrtWDLMW: [2012/06/22 18:57:22.593]: [00002572]: lperrcode->api
 = 1 , lperrcode->code = 2   
 
Error - 22.06.2012 12:57:24 | Computer Name = ***-PC | Source = Brother BrLog | ID = 1001
Description = WDLMW BrtWDLMW: [2012/06/22 18:57:24.093]: [00002572]: lperrcode->api
 = 1 , lperrcode->code = 2   
 
Error - 23.06.2012 13:06:39 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc100  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b60  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0001f8c4  ID des fehlerhaften
 Prozesses: 0x1f7c  Startzeit der fehlerhaften Anwendung: 0x01cd51628d25d978  Pfad der
 fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften Moduls:
 C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: cbb949d3-bd55-11e1-8c8b-6c626d05b73c
 
Error - 27.06.2012 11:14:32 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc100  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b60  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00077c29  ID des fehlerhaften
 Prozesses: 0x143c  Startzeit der fehlerhaften Anwendung: 0x01cd54778cf852d0  Pfad der
 fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften Moduls:
 C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: cbd32c73-c06a-11e1-8ca6-6c626d05b73c
 
Error - 28.06.2012 04:21:49 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc100  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b60  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00052bb6  ID des fehlerhaften
 Prozesses: 0x2a00  Startzeit der fehlerhaften Anwendung: 0x01cd55070f6cbe82  Pfad der
 fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften Moduls:
 C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: 4e4c5ae6-c0fa-11e1-8ca5-6c626d05b73c
 
Error - 28.06.2012 08:05:24 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: msseces.exe, Version: 4.0.1526.0,
 Zeitstempel: 0x4f710276  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00010854  ID des fehlerhaften
 Prozesses: 0x178  Startzeit der fehlerhaften Anwendung: 0x01cd55264b9268f4  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Microsoft Security Client\msseces.exe  Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: 8a38e451-c119-11e1-b64b-6c626d05b73c
 
Error - 28.06.2012 08:05:32 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: msseces.exe, Version: 4.0.1526.0,
 Zeitstempel: 0x4f710276  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00010854  ID des fehlerhaften
 Prozesses: 0x998  Startzeit der fehlerhaften Anwendung: 0x01cd55265139ad9b  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Microsoft Security Client\msseces.exe  Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: 8ee899db-c119-11e1-b64b-6c626d05b73c
 
Error - 29.06.2012 06:43:42 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: msseces.exe, Version: 4.0.1526.0,
 Zeitstempel: 0x4f710276  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00010854  ID des fehlerhaften
 Prozesses: 0xae4  Startzeit der fehlerhaften Anwendung: 0x01cd55e40bcd480b  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Microsoft Security Client\msseces.exe  Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: 4a901955-c1d7-11e1-8c8b-6c626d05b73c
 
[ System Events ]
Error - 02.05.2012 04:00:42 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 3002
Description = Vom Echtzeitschutz-Feature von %%860 wurde ein Fehler festgestellt

	Feature:
 %%835     Fehlercode: 0x80070005     Fehlerbeschreibung: Zugriff verweigert      Grund: %%842
 
Error - 02.05.2012 04:00:42 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 3002
Description = Vom Echtzeitschutz-Feature von %%860 wurde ein Fehler festgestellt

	Feature:
 %%834     Fehlercode: 0x80070005     Fehlerbeschreibung: Zugriff verweigert      Grund: %%837
 
Error - 02.05.2012 04:00:42 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 3002
Description = Vom Echtzeitschutz-Feature von %%860 wurde ein Fehler festgestellt

	Feature:
 %%835     Fehlercode: 0x80070005     Fehlerbeschreibung: Zugriff verweigert      Grund: %%837
 
Error - 14.05.2012 02:49:24 | Computer Name = ***-PC | Source = Microsoft-Windows-Application-Experience | ID = 205
Description = Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht
 initialisieren.
 
Error - 21.05.2012 03:09:27 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.127.273.0     Aktualisierungsquelle: %%859

	Aktualisierungsphase:
 %%852     Quellpfad: hxxp://www.microsoft.com     Signaturtyp: %%800     Aktualisierungstyp: %%803

	Benutzer:
 NT-AUTORITÄT\SYSTEM     Aktuelle Modulversion:      Vorherige Modulversion: 1.1.8403.0     Fehlercode:
 0x80072efe     Fehlerbeschreibung: Die Serververbindung wurde aufgrund eines Fehlers
 beendet. 
 
Error - 04.06.2012 02:54:26 | Computer Name = ***-PC | Source = Microsoft-Windows-Application-Experience | ID = 205
Description = Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht
 initialisieren.
 
Error - 06.06.2012 12:18:23 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.127.1364.0     Aktualisierungsquelle: 
%%859     Aktualisierungsphase: %%854     Quellpfad: hxxp://www.microsoft.com     Signaturtyp: 
%%800     Aktualisierungstyp: %%803     Benutzer: NT-AUTORITÄT\SYSTEM     Aktuelle Modulversion:
      Vorherige Modulversion: 1.1.8403.0     Fehlercode: 0x8024001e     Fehlerbeschreibung: Unerwartetes
 Problem bei der Überprüfung auf Updates. Informationen zum Installieren von Updates
 oder zur Problembehandlung finden Sie unter "Hilfe und Support". 
 
Error - 28.06.2012 08:31:04 | Computer Name = ***-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?28.?06.?2012 um 14:30:10 unerwartet heruntergefahren.
 
Error - 29.06.2012 07:52:16 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.129.640.0     Aktualisierungsquelle: %%859

	Aktualisierungsphase:
 %%853     Quellpfad: hxxp://www.microsoft.com     Signaturtyp: %%800     Aktualisierungstyp: %%803

	Benutzer:
 NT-AUTORITÄT\SYSTEM     Aktuelle Modulversion:      Vorherige Modulversion: 1.1.8502.0     Fehlercode:
 0x8024001e     Fehlerbeschreibung: Unerwartetes Problem bei der Überprüfung auf Updates.
 Informationen zum Installieren von Updates oder zur Problembehandlung finden Sie
 unter "Hilfe und Support". 
 
Error - 29.06.2012 07:52:16 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.129.640.0     Aktualisierungsquelle: %%859

	Aktualisierungsphase:
 %%853     Quellpfad: hxxp://www.microsoft.com     Signaturtyp: %%800     Aktualisierungstyp: %%803

	Benutzer:
 NT-AUTORITÄT\SYSTEM     Aktuelle Modulversion:      Vorherige Modulversion: 1.1.8502.0     Fehlercode:
 0x8024001e     Fehlerbeschreibung: Unerwartetes Problem bei der Überprüfung auf Updates.
 Informationen zum Installieren von Updates oder zur Problembehandlung finden Sie
 unter "Hilfe und Support". 
 
 
< End of report >
         

Danke im Vorraus !

Lg Jo

hi
ersetze *** durch nutzernamen, sonst läuft das script nicht
dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKCU..\Run: [Azzei] C:\Users\***\AppData\Roaming\Umoce\vyuxp.exe ()
[2012.06.28 14:01:47 | 000,000,000 | ---D | C] -- C:\Users\Nuri Ayiz\AppData\Roaming\Umoce
[2012.06.28 14:01:47 | 000,000,000 | ---D | C] -- C:\Users\Nuri Ayiz\AppData\Roaming\Ifboe
[2012.06.28 14:01:47 | 000,000,000 | ---D | C] -- C:\Users\Nuri Ayiz\AppData\Roaming\Edygc
 :Files
C:\Users\***\AppData\Roaming\Umoce
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus