| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU Trojaner auf meinem PCWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
06.08.2012, 10:55
| #1 |
| |  GVU Trojaner auf meinem PC Hallo erstmal ich habe mir einen von diesen GVU Viren eingefangen. Dieser lässt mich nicht aufmeinen Desktop oder sonst wo hin zugreifen sprich ich bin nicht in der Lage Programme auszuführen das Internet zuöffnen oder sonst irgendwas. Freue mich über jegliche Hilfe |
|
06.08.2012, 11:02
| #2 |
| /// Malware-holic   | GVU Trojaner auf meinem PC hi
__________________neustart, f8 drücken, abgesicherter modus mit netzwerk wählen, im betroffenen konto anmelden. Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
__________________ |
|
06.08.2012, 11:40
| #3 |
| | GVU Trojaner auf meinem PC Okay habe die beiden Text Dokumente.
__________________Edit kommt sofort Code:
ATTFilter OTL logfile created on: 06.08.2012 12:34:21 - Run 1 OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Lukas Hilber\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,98 Gb Total Physical Memory | 2,88 Gb Available Physical Memory | 72,34% Memory free 7,96 Gb Paging File | 6,87 Gb Available in Paging File | 86,30% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 688,95 Gb Total Space | 585,75 Gb Free Space | 85,02% Space Free | Partition Type: NTFS Drive D: | 689,21 Gb Total Space | 332,50 Gb Free Space | 48,24% Space Free | Partition Type: NTFS Computer Name: LUKASHILBER-PC | User Name: Lukas Hilber | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Lukas Hilber\Desktop\OTL.exe (OldTimer Tools) ========== Modules (No Company Name) ========== ========== Win32 Services (SafeList) ========== SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (HiPatchService) -- C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios) SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.) SRV - (GREGService) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated) SRV - (BBUpdate) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) SRV - (Live Updater Service) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe (Acer Incorporated) SRV - (EgisTec Ticket Service) -- C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe (Egis Technology Inc. ) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (GamesAppService) -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.) SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (NOBU) -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation) SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (e1cexpress) -- C:\Windows\SysNative\drivers\e1c62x64.sys (Intel Corporation) DRV:64bit: - (mwlPSDVDisk) -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.) DRV:64bit: - (mwlPSDFilter) -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.) DRV:64bit: - (mwlPSDNServ) -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.) DRV:64bit: - (EtronHub3) -- C:\Windows\SysNative\drivers\EtronHub3.sys (Etron Technology Inc) DRV:64bit: - (EtronXHCI) -- C:\Windows\SysNative\drivers\EtronXHCI.sys (Etron Technology Inc) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-4001011127-71849744-855568330-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKU\S-1-5-21-4001011127-71849744-855568330-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE - HKU\S-1-5-21-4001011127-71849744-855568330-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-4001011127-71849744-855568330-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll () FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Lukas Hilber\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Lukas Hilber\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 11:47:17 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 11:47:17 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.02.18 20:13:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lukas Hilber\AppData\Roaming\mozilla\Extensions [2012.06.29 23:49:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lukas Hilber\AppData\Roaming\mozilla\Firefox\Profiles\40dlhlr9.default\extensions [2012.06.29 23:49:06 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Lukas Hilber\AppData\Roaming\mozilla\Firefox\Profiles\40dlhlr9.default\extensions\ich@maltegoetz.de [2012.03.18 18:31:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.07.18 11:47:17 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.06.18 19:46:10 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.06.18 19:46:10 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.06.18 19:46:10 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.06.18 19:46:10 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.18 19:46:10 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.18 19:46:10 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://www.google.com/ CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}, CHR - homepage: hxxp://www.google.com/ CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Lukas Hilber\AppData\Local\Google\Chrome\Application\21.0.1180.60\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Lukas Hilber\AppData\Local\Google\Chrome\Application\21.0.1180.60\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Lukas Hilber\AppData\Local\Google\Chrome\Application\21.0.1180.60\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\Lukas Hilber\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dll CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Google Update (Enabled) = C:\Users\Lukas Hilber\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll CHR - plugin: McAfee SecurityCenter (Enabled) = c:\progra~2\mcafee\msc\npmcsn~1.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: YouTube = C:\Users\Lukas Hilber\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\Lukas Hilber\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Google Mail = C:\Users\Lukas Hilber\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files (x86)\Softonic\Softonic\1.5.21.0\SoftonicTlbr.dll (Softonic.com) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [ArcadeMovieService] C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe (CyberLink Corp.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe () O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation) O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-4001011127-71849744-855568330-1001..\Run: [Muettyyka] "C:\Users\Lukas Hilber\AppData\Roaming\Ybme\tuyhe.exe" File not found O4 - HKU\S-1-5-21-4001011127-71849744-855568330-1001..\Run: [piclair.exe] C:\Users\Lukas Hilber\Desktop\Piclair.exe () O4 - HKU\S-1-5-21-4001011127-71849744-855568330-1001..\Run: [Speech Recognition] C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.4.1) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.4.1) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E2036B6D-929C-4B58-88CF-20251397EEF0}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP CREATERESTOREPOINT Unable to start System Restore Service. Error code 1084 ========== Files/Folders - Created Within 30 Days ========== [2012.08.06 12:26:29 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Lukas Hilber\Desktop\OTL.exe [2012.07.26 10:51:00 | 000,000,000 | ---D | C] -- C:\Users\Lukas Hilber\AppData\Roaming\Ventrilo [2012.07.26 10:49:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ventrilo [2012.07.26 10:49:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ventrilo [2012.07.26 10:48:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard [2012.07.19 16:45:22 | 000,000,000 | ---D | C] -- C:\Users\Lukas Hilber\AppData\Local\Chromium [2012.07.19 16:41:21 | 000,000,000 | ---D | C] -- C:\Users\Lukas Hilber\AppData\Roaming\Ybme [2012.07.19 16:41:21 | 000,000,000 | ---D | C] -- C:\Users\Lukas Hilber\AppData\Roaming\Xiqo [2012.07.19 16:41:21 | 000,000,000 | ---D | C] -- C:\Users\Lukas Hilber\AppData\Roaming\Niypo [2012.07.19 16:29:40 | 000,000,000 | ---D | C] -- C:\Users\Lukas Hilber\Documents\My Games [2012.07.19 15:52:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios [2012.07.19 15:52:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Hi-Rez Studios [2012.07.19 15:52:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hi-Rez Studios [2012.07.18 08:17:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Nexon [2012.07.18 04:18:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexon [2012.07.18 04:16:15 | 000,000,000 | ---D | C] -- C:\Nexon [2012.07.18 04:16:09 | 000,000,000 | ---D | C] -- C:\ProgramData\NexonEU [2012.07.07 22:20:02 | 000,000,000 | ---D | C] -- C:\Users\Lukas Hilber\Desktop\Zephion - 05.07.2012 [2012.07.07 22:11:23 | 000,000,000 | ---D | C] -- C:\Users\Lukas Hilber\Documents\BlackshotScreenshot [2010.06.02 05:22:02 | 000,089,944 | ---- | C] (Microsoft Corporation) -- C:\Users\Lukas Hilber\DSETUP.dll ========== Files - Modified Within 30 Days ========== [2012.08.06 12:32:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.06 12:32:50 | 3207,073,792 | -HS- | M] () -- C:\hiberfil.sys [2012.08.06 12:26:30 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Lukas Hilber\Desktop\OTL.exe [2012.08.06 12:09:18 | 004,503,728 | ---- | M] () -- C:\ProgramData\rat_0ybba.pad [2012.08.06 11:51:23 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.06 11:51:23 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.06 11:42:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.06 11:33:53 | 001,613,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.08.06 11:33:53 | 000,696,848 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.08.06 11:33:53 | 000,652,166 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.08.06 11:33:53 | 000,148,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.08.06 11:33:53 | 000,121,098 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.08.06 11:25:09 | 000,001,148 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4001011127-71849744-855568330-1001UA.job [2012.08.06 11:22:44 | 000,001,889 | ---- | M] () -- C:\Users\Lukas Hilber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.08.05 20:22:49 | 000,030,594 | ---- | M] () -- C:\Users\Lukas Hilber\Desktop\pedobaer0f25.png [2012.08.05 14:25:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4001011127-71849744-855568330-1001Core.job [2012.08.02 21:26:43 | 000,002,490 | ---- | M] () -- C:\Users\Lukas Hilber\Desktop\Google Chrome.lnk [2012.08.02 11:56:20 | 000,263,186 | ---- | M] () -- C:\Users\Lukas Hilber\Desktop\Minecraft.exe [2012.07.26 10:49:34 | 000,000,268 | ---- | M] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini [2012.07.26 10:49:32 | 000,000,875 | ---- | M] () -- C:\Users\Public\Desktop\Ventrilo.lnk [2012.07.19 15:52:19 | 000,002,033 | ---- | M] () -- C:\Users\Public\Desktop\Hi-Rez Diagnostics and Support.lnk [2012.07.19 15:52:18 | 000,002,024 | ---- | M] () -- C:\Users\Public\Desktop\Smite Closed Beta.lnk [2012.07.18 04:18:08 | 000,001,634 | ---- | M] () -- C:\Users\Public\Desktop\Combat Arms EU.lnk [2012.07.12 11:40:33 | 000,274,464 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.09 17:11:43 | 010,065,146 | ---- | M] () -- C:\Users\Lukas Hilber\Desktop\Switchbotv3_0_0_4.rar ========== Files Created - No Company Name ========== [2012.08.06 11:22:44 | 004,503,728 | ---- | C] () -- C:\ProgramData\rat_0ybba.pad [2012.08.06 11:22:44 | 000,001,889 | ---- | C] () -- C:\Users\Lukas Hilber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.08.05 20:21:48 | 000,030,594 | ---- | C] () -- C:\Users\Lukas Hilber\Desktop\pedobaer0f25.png [2012.08.02 11:56:15 | 000,263,186 | ---- | C] () -- C:\Users\Lukas Hilber\Desktop\Minecraft.exe [2012.07.26 10:49:32 | 000,000,875 | ---- | C] () -- C:\Users\Public\Desktop\Ventrilo.lnk [2012.07.26 10:49:31 | 000,000,268 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini [2012.07.19 15:52:19 | 000,002,033 | ---- | C] () -- C:\Users\Public\Desktop\Hi-Rez Diagnostics and Support.lnk [2012.07.19 15:52:18 | 000,002,024 | ---- | C] () -- C:\Users\Public\Desktop\Smite Closed Beta.lnk [2012.07.18 04:18:08 | 000,001,634 | ---- | C] () -- C:\Users\Public\Desktop\Combat Arms EU.lnk [2012.07.09 17:11:41 | 010,065,146 | ---- | C] () -- C:\Users\Lukas Hilber\Desktop\Switchbotv3_0_0_4.rar [2012.06.15 21:35:02 | 001,590,370 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.07.23 08:39:22 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2010.06.02 05:22:54 | 001,412,902 | ---- | C] () -- C:\Users\Lukas Hilber\OCT2006_d3dx9_31_x64.cab [2010.06.02 05:22:54 | 001,127,217 | ---- | C] () -- C:\Users\Lukas Hilber\OCT2006_d3dx9_31_x86.cab [2010.06.02 05:22:54 | 000,273,960 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2008_XAudio_x64.cab [2010.06.02 05:22:54 | 000,272,611 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2008_XAudio_x86.cab [2010.06.02 05:22:54 | 000,182,361 | ---- | C] () -- C:\Users\Lukas Hilber\OCT2006_XACT_x64.cab [2010.06.02 05:22:54 | 000,138,017 | ---- | C] () -- C:\Users\Lukas Hilber\OCT2006_XACT_x86.cab [2010.06.02 05:22:54 | 000,086,037 | ---- | C] () -- C:\Users\Lukas Hilber\Oct2005_xinput_x64.cab [2010.06.02 05:22:54 | 000,045,359 | ---- | C] () -- C:\Users\Lukas Hilber\Oct2005_xinput_x86.cab [2010.06.02 05:22:52 | 001,906,878 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2008_d3dx9_40_x64.cab [2010.06.02 05:22:52 | 001,550,796 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2008_d3dx9_40_x86.cab [2010.06.02 05:22:52 | 000,965,421 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2008_d3dx10_40_x86.cab [2010.06.02 05:22:52 | 000,121,794 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2008_XACT_x64.cab [2010.06.02 05:22:52 | 000,092,684 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2008_XACT_x86.cab [2010.06.02 05:22:52 | 000,054,522 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2008_X3DAudio_x64.cab [2010.06.02 05:22:52 | 000,021,851 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2008_X3DAudio_x86.cab [2010.06.02 05:22:50 | 000,994,154 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2008_d3dx10_40_x64.cab [2010.06.02 05:22:50 | 000,196,762 | ---- | C] () -- C:\Users\Lukas Hilber\NOV2007_XACT_x64.cab [2010.06.02 05:22:50 | 000,148,264 | ---- | C] () -- C:\Users\Lukas Hilber\NOV2007_XACT_x86.cab [2010.06.02 05:22:50 | 000,046,144 | ---- | C] () -- C:\Users\Lukas Hilber\NOV2007_X3DAudio_x64.cab [2010.06.02 05:22:50 | 000,018,496 | ---- | C] () -- C:\Users\Lukas Hilber\NOV2007_X3DAudio_x86.cab [2010.06.02 05:22:48 | 001,802,058 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2007_d3dx9_36_x64.cab [2010.06.02 05:22:48 | 001,709,360 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2007_d3dx9_36_x86.cab [2010.06.02 05:22:48 | 000,864,600 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2007_d3dx10_36_x64.cab [2010.06.02 05:22:48 | 000,803,884 | ---- | C] () -- C:\Users\Lukas Hilber\Nov2007_d3dx10_36_x86.cab [2010.06.02 05:22:48 | 000,273,018 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2009_XAudio_x86.cab [2010.06.02 05:22:46 | 000,275,044 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2009_XAudio_x64.cab [2010.06.02 05:22:46 | 000,121,506 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2009_XACT_x64.cab [2010.06.02 05:22:46 | 000,092,740 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2009_XACT_x86.cab [2010.06.02 05:22:38 | 000,054,600 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2009_X3DAudio_x64.cab [2010.06.02 05:22:38 | 000,021,298 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2009_X3DAudio_x86.cab [2010.06.02 05:22:36 | 001,973,702 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2009_d3dx9_41_x64.cab [2010.06.02 05:22:36 | 001,612,446 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2009_d3dx9_41_x86.cab [2010.06.02 05:22:36 | 001,067,160 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2009_d3dx10_41_x64.cab [2010.06.02 05:22:36 | 001,040,745 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2009_d3dx10_41_x86.cab [2010.06.02 05:22:36 | 000,251,194 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2008_XAudio_x64.cab [2010.06.02 05:22:36 | 000,226,250 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2008_XAudio_x86.cab [2010.06.02 05:22:36 | 000,122,336 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2008_XACT_x64.cab [2010.06.02 05:22:36 | 000,093,734 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2008_XACT_x86.cab [2010.06.02 05:22:34 | 001,769,862 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2008_d3dx9_37_x64.cab [2010.06.02 05:22:34 | 001,443,282 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2008_d3dx9_37_x86.cab [2010.06.02 05:22:34 | 000,818,260 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2008_d3dx10_37_x86.cab [2010.06.02 05:22:34 | 000,055,058 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2008_X3DAudio_x64.cab [2010.06.02 05:22:34 | 000,021,867 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2008_X3DAudio_x86.cab [2010.06.02 05:22:32 | 000,937,246 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_d3dx9_43_x64.cab [2010.06.02 05:22:32 | 000,844,884 | ---- | C] () -- C:\Users\Lukas Hilber\Mar2008_d3dx10_37_x64.cab [2010.06.02 05:22:32 | 000,768,036 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_d3dx9_43_x86.cab [2010.06.02 05:22:32 | 000,278,060 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_XAudio_x86.cab [2010.06.02 05:22:32 | 000,277,338 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_XAudio_x64.cab [2010.06.02 05:22:32 | 000,124,596 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_XACT_x64.cab [2010.06.02 05:22:32 | 000,093,686 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_XACT_x86.cab [2010.06.02 05:22:30 | 000,762,188 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_d3dcsx_43_x86.cab [2010.06.02 05:22:30 | 000,235,955 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_d3dx10_43_x64.cab [2010.06.02 05:22:30 | 000,197,283 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_d3dx10_43_x86.cab [2010.06.02 05:22:30 | 000,138,205 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_d3dx11_43_x64.cab [2010.06.02 05:22:30 | 000,109,445 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_d3dx11_43_x86.cab [2010.06.02 05:22:28 | 000,944,460 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_D3DCompiler_43_x64.cab [2010.06.02 05:22:28 | 000,931,471 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_D3DCompiler_43_x86.cab [2010.06.02 05:22:28 | 000,752,783 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2010_d3dcsx_43_x64.cab [2010.06.02 05:22:20 | 000,269,024 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2008_XAudio_x86.cab [2010.06.02 05:22:18 | 001,792,608 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2008_d3dx9_38_x64.cab [2010.06.02 05:22:18 | 001,463,878 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2008_d3dx9_38_x86.cab [2010.06.02 05:22:18 | 000,867,828 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2008_d3dx10_38_x64.cab [2010.06.02 05:22:18 | 000,849,919 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2008_d3dx10_38_x86.cab [2010.06.02 05:22:18 | 000,269,628 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2008_XAudio_x64.cab [2010.06.02 05:22:18 | 000,152,909 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2007_XACT_x86.cab [2010.06.02 05:22:18 | 000,121,054 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2008_XACT_x64.cab [2010.06.02 05:22:18 | 000,093,128 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2008_XACT_x86.cab [2010.06.02 05:22:18 | 000,055,154 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2008_X3DAudio_x64.cab [2010.06.02 05:22:18 | 000,021,905 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2008_X3DAudio_x86.cab [2010.06.02 05:22:16 | 001,607,774 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2007_d3dx9_34_x64.cab [2010.06.02 05:22:16 | 001,607,286 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2007_d3dx9_34_x86.cab [2010.06.02 05:22:16 | 001,064,925 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2005_d3dx9_26_x86.cab [2010.06.02 05:22:16 | 000,699,044 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2007_d3dx10_34_x64.cab [2010.06.02 05:22:16 | 000,698,472 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2007_d3dx10_34_x86.cab [2010.06.02 05:22:16 | 000,197,122 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2007_XACT_x64.cab [2010.06.02 05:22:16 | 000,180,785 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2006_XACT_x64.cab [2010.06.02 05:22:16 | 000,133,671 | ---- | C] () -- C:\Users\Lukas Hilber\JUN2006_XACT_x86.cab [2010.06.02 05:22:14 | 001,336,002 | ---- | C] () -- C:\Users\Lukas Hilber\Jun2005_d3dx9_26_x64.cab [2010.06.02 05:22:14 | 000,277,191 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2010_XAudio_x86.cab [2010.06.02 05:22:14 | 000,276,960 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2010_XAudio_x64.cab [2010.06.02 05:22:14 | 000,122,446 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2010_XACT_x64.cab [2010.06.02 05:22:14 | 000,093,180 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2010_XACT_x86.cab [2010.06.02 05:22:12 | 000,194,675 | ---- | C] () -- C:\Users\Lukas Hilber\FEB2007_XACT_x64.cab [2010.06.02 05:22:12 | 000,147,983 | ---- | C] () -- C:\Users\Lukas Hilber\FEB2007_XACT_x86.cab [2010.06.02 05:22:12 | 000,054,678 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2010_X3DAudio_x64.cab [2010.06.02 05:22:12 | 000,020,713 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2010_X3DAudio_x86.cab [2010.06.02 05:22:10 | 000,178,359 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2006_XACT_x64.cab [2010.06.02 05:22:10 | 000,132,409 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2006_XACT_x86.cab [2010.06.02 05:22:04 | 001,084,720 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2006_d3dx9_29_x86.cab [2010.06.02 05:22:02 | 001,801,048 | ---- | C] () -- C:\Users\Lukas Hilber\dsetup32.dll [2010.06.02 05:22:02 | 001,574,376 | ---- | C] () -- C:\Users\Lukas Hilber\DEC2006_d3dx9_32_x86.cab [2010.06.02 05:22:02 | 001,362,796 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2006_d3dx9_29_x64.cab [2010.06.02 05:22:02 | 001,247,499 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2005_d3dx9_24_x64.cab [2010.06.02 05:22:02 | 001,013,225 | ---- | C] () -- C:\Users\Lukas Hilber\Feb2005_d3dx9_24_x86.cab [2010.06.02 05:22:02 | 000,537,432 | ---- | C] () -- C:\Users\Lukas Hilber\DXSETUP.exe [2010.06.02 05:22:02 | 000,192,475 | ---- | C] () -- C:\Users\Lukas Hilber\DEC2006_XACT_x64.cab [2010.06.02 05:22:02 | 000,145,599 | ---- | C] () -- C:\Users\Lukas Hilber\DEC2006_XACT_x86.cab [2010.06.02 05:22:02 | 000,094,011 | ---- | C] () -- C:\Users\Lukas Hilber\dxupdate.cab [2010.06.02 05:22:02 | 000,042,410 | ---- | C] () -- C:\Users\Lukas Hilber\dxdllreg_x86.cab [2010.06.02 05:22:00 | 001,571,154 | ---- | C] () -- C:\Users\Lukas Hilber\DEC2006_d3dx9_32_x64.cab [2010.06.02 05:22:00 | 001,357,976 | ---- | C] () -- C:\Users\Lukas Hilber\Dec2005_d3dx9_28_x64.cab [2010.06.02 05:22:00 | 001,079,456 | ---- | C] () -- C:\Users\Lukas Hilber\Dec2005_d3dx9_28_x86.cab [2010.06.02 05:22:00 | 000,273,264 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_XAudio_x64.cab [2010.06.02 05:22:00 | 000,272,642 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_XAudio_x86.cab [2010.06.02 05:22:00 | 000,212,807 | ---- | C] () -- C:\Users\Lukas Hilber\DEC2006_d3dx10_00_x64.cab [2010.06.02 05:22:00 | 000,191,720 | ---- | C] () -- C:\Users\Lukas Hilber\DEC2006_d3dx10_00_x86.cab [2010.06.02 05:22:00 | 000,122,408 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_XACT_x64.cab [2010.06.02 05:22:00 | 000,093,106 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_XACT_x86.cab [2010.06.02 05:21:58 | 000,930,116 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_d3dx9_42_x64.cab [2010.06.02 05:21:58 | 000,728,456 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_d3dx9_42_x86.cab [2010.06.02 05:21:58 | 000,232,635 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_d3dx10_42_x64.cab [2010.06.02 05:21:58 | 000,192,131 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_d3dx10_42_x86.cab [2010.06.02 05:21:58 | 000,136,301 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_d3dx11_42_x64.cab [2010.06.02 05:21:58 | 000,105,044 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_d3dx11_42_x86.cab [2010.06.02 05:21:56 | 003,319,740 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_d3dcsx_42_x86.cab [2010.06.02 05:21:56 | 003,112,111 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_d3dcsx_42_x64.cab [2010.06.02 05:21:56 | 000,900,598 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_D3DCompiler_42_x86.cab [2010.06.02 05:21:46 | 000,919,044 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2009_D3DCompiler_42_x64.cab [2010.06.02 05:21:46 | 000,271,412 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2008_XAudio_x64.cab [2010.06.02 05:21:46 | 000,271,038 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2008_XAudio_x86.cab [2010.06.02 05:21:44 | 001,794,084 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2008_d3dx9_39_x64.cab [2010.06.02 05:21:44 | 001,464,672 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2008_d3dx9_39_x86.cab [2010.06.02 05:21:44 | 000,849,167 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2008_d3dx10_39_x86.cab [2010.06.02 05:21:44 | 000,198,096 | ---- | C] () -- C:\Users\Lukas Hilber\AUG2007_XACT_x64.cab [2010.06.02 05:21:44 | 000,153,012 | ---- | C] () -- C:\Users\Lukas Hilber\AUG2007_XACT_x86.cab [2010.06.02 05:21:44 | 000,121,772 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2008_XACT_x64.cab [2010.06.02 05:21:44 | 000,092,996 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2008_XACT_x86.cab [2010.06.02 05:21:42 | 001,800,160 | ---- | C] () -- C:\Users\Lukas Hilber\AUG2007_d3dx9_35_x64.cab [2010.06.02 05:21:42 | 001,708,152 | ---- | C] () -- C:\Users\Lukas Hilber\AUG2007_d3dx9_35_x86.cab [2010.06.02 05:21:42 | 000,867,612 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2008_d3dx10_39_x64.cab [2010.06.02 05:21:42 | 000,852,286 | ---- | C] () -- C:\Users\Lukas Hilber\AUG2007_d3dx10_35_x64.cab [2010.06.02 05:21:42 | 000,796,867 | ---- | C] () -- C:\Users\Lukas Hilber\AUG2007_d3dx10_35_x86.cab [2010.06.02 05:21:40 | 001,350,542 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2005_d3dx9_27_x64.cab [2010.06.02 05:21:40 | 001,077,644 | ---- | C] () -- C:\Users\Lukas Hilber\Aug2005_d3dx9_27_x86.cab [2010.06.02 05:21:40 | 000,182,903 | ---- | C] () -- C:\Users\Lukas Hilber\AUG2006_XACT_x64.cab [2010.06.02 05:21:40 | 000,137,235 | ---- | C] () -- C:\Users\Lukas Hilber\AUG2006_XACT_x86.cab [2010.06.02 05:21:40 | 000,087,142 | ---- | C] () -- C:\Users\Lukas Hilber\AUG2006_xinput_x64.cab [2010.06.02 05:21:40 | 000,053,302 | ---- | C] () -- C:\Users\Lukas Hilber\APR2007_xinput_x86.cab [2010.06.02 05:21:40 | 000,046,058 | ---- | C] () -- C:\Users\Lukas Hilber\AUG2006_xinput_x86.cab [2010.06.02 05:21:38 | 001,606,039 | ---- | C] () -- C:\Users\Lukas Hilber\APR2007_d3dx9_33_x86.cab [2010.06.02 05:21:38 | 000,195,766 | ---- | C] () -- C:\Users\Lukas Hilber\APR2007_XACT_x64.cab [2010.06.02 05:21:38 | 000,151,225 | ---- | C] () -- C:\Users\Lukas Hilber\APR2007_XACT_x86.cab [2010.06.02 05:21:38 | 000,096,817 | ---- | C] () -- C:\Users\Lukas Hilber\APR2007_xinput_x64.cab [2010.06.02 05:21:36 | 001,607,358 | ---- | C] () -- C:\Users\Lukas Hilber\APR2007_d3dx9_33_x64.cab [2010.06.02 05:21:36 | 000,698,612 | ---- | C] () -- C:\Users\Lukas Hilber\APR2007_d3dx10_33_x64.cab [2010.06.02 05:21:36 | 000,695,865 | ---- | C] () -- C:\Users\Lukas Hilber\APR2007_d3dx10_33_x86.cab [2010.06.02 05:21:34 | 000,046,010 | ---- | C] () -- C:\Users\Lukas Hilber\Apr2006_xinput_x86.cab [2010.06.02 05:21:20 | 000,087,101 | ---- | C] () -- C:\Users\Lukas Hilber\Apr2006_xinput_x64.cab [2010.06.02 05:21:18 | 004,162,630 | ---- | C] () -- C:\Users\Lukas Hilber\Apr2006_MDX1_x86_Archive.cab [2010.06.02 05:21:18 | 000,916,430 | ---- | C] () -- C:\Users\Lukas Hilber\Apr2006_MDX1_x86.cab [2010.06.02 05:21:18 | 000,179,133 | ---- | C] () -- C:\Users\Lukas Hilber\Apr2006_XACT_x64.cab [2010.06.02 05:21:18 | 000,133,103 | ---- | C] () -- C:\Users\Lukas Hilber\Apr2006_XACT_x86.cab [2010.06.02 05:21:16 | 001,397,830 | ---- | C] () -- C:\Users\Lukas Hilber\Apr2006_d3dx9_30_x64.cab [2010.06.02 05:21:16 | 001,347,354 | ---- | C] () -- C:\Users\Lukas Hilber\Apr2005_d3dx9_25_x64.cab [2010.06.02 05:21:16 | 001,115,221 | ---- | C] () -- C:\Users\Lukas Hilber\Apr2006_d3dx9_30_x86.cab [2010.06.02 05:21:16 | 001,078,962 | ---- | C] () -- C:\Users\Lukas Hilber\Apr2005_d3dx9_25_x86.cab ========== LOP Check ========== [2012.08.04 21:18:21 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\.minecraft [2012.04.09 01:20:58 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\.Nitrous [2012.03.27 20:30:23 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\Audacity [2012.05.09 20:40:52 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\Blockscape [2012.02.21 01:25:08 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\clear.fi [2012.05.28 17:17:09 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\Downloaded Installations [2012.02.18 21:33:23 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\LolClient [2012.05.24 16:05:09 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\LolClient2 [2012.04.07 04:22:41 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\LOVE [2012.06.13 20:25:08 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\Need for Speed World [2012.07.19 16:41:21 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\Niypo [2012.05.11 15:21:10 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\Notepad++ [2012.02.18 20:08:40 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\OEM [2012.06.13 21:56:21 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\Patcher [2012.06.27 22:58:36 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\six-updater [2012.06.27 22:58:21 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\six-zsync [2012.04.06 01:25:03 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\SplitMediaLabs [2012.03.04 18:30:27 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\Teeworlds [2012.07.17 17:21:34 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\TS3Client [2012.07.19 17:12:02 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\Xiqo [2012.07.22 03:53:00 | 000,000,000 | ---D | M] -- C:\Users\Lukas Hilber\AppData\Roaming\Ybme [2012.05.28 11:12:01 | 000,032,618 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2012.02.18 20:08:18 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2012.01.30 15:23:55 | 000,000,000 | ---D | M] -- C:\book [2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2012.02.18 20:05:39 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.07.11 11:24:03 | 000,000,000 | ---D | M] -- C:\Intel [2012.07.18 04:16:15 | 000,000,000 | ---D | M] -- C:\Nexon [2012.02.18 20:07:54 | 000,000,000 | -H-D | M] -- C:\OEM [2009.07.14 05:20:08 | 000,000,000 | -H-D | M] -- C:\PerfLogs [2012.05.02 00:35:40 | 000,000,000 | R--D | M] -- C:\Program Files [2012.07.26 10:49:32 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2012.08.06 11:22:44 | 000,000,000 | -H-D | M] -- C:\ProgramData [2012.02.18 20:05:39 | 000,000,000 | -HSD | M] -- C:\Programme [2012.02.18 20:05:39 | 000,000,000 | -HSD | M] -- C:\Recovery [2012.02.18 21:01:01 | 000,000,000 | ---D | M] -- C:\Riot Games [2012.08.05 19:00:33 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2012.02.18 20:05:45 | 000,000,000 | R--D | M] -- C:\Users [2012.08.06 12:10:53 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys < MD5 for: AHCIX86S.SYS > [2010.09.24 03:48:00 | 000,222,288 | ---- | M] (Advanced Micro Devices, Inc) MD5=A3F4FEE7E8C40242FD6CD77DAE51370F -- C:\OEM\Preload\Autorun\DRV\AMD VGA Generic Driver\Packages\Drivers\SBDrv\SB8xx\RAID\W7\ahcix86s.sys < MD5 for: ATAPI.SYS > [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: EXPLORER.EXE > [2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2010.11.21 05:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2010.11.21 05:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe < MD5 for: IASTOR.SYS > [2010.11.06 00:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\drivers\iaStor.sys [2010.11.06 00:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_710b330fb3531234\iaStor.sys < MD5 for: IASTORV.SYS > [2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys [2010.11.21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys [2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys [2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys [2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys [2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys < MD5 for: NETLOGON.DLL > [2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll [2010.11.21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll [2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll [2010.11.21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll < MD5 for: NVSTOR.SYS > [2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys [2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys [2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys [2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys [2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys [2010.11.21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys < MD5 for: SCECLI.DLL > [2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll [2010.11.21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll [2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll [2010.11.21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll < MD5 for: USER32.DLL > [2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll [2010.11.21 05:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll [2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll [2010.11.21 05:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll < MD5 for: USERINIT.EXE > [2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.21 05:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.21 05:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WINLOGON.EXE > [2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.21 05:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\*.dll /lockedfiles > < %USERPROFILE%\*.* > [2010.06.02 05:21:16 | 001,347,354 | ---- | M] () -- C:\Users\Lukas Hilber\Apr2005_d3dx9_25_x64.cab [2010.06.02 05:21:16 | 001,078,962 | ---- | M] () -- C:\Users\Lukas Hilber\Apr2005_d3dx9_25_x86.cab [2010.06.02 05:21:16 | 001,397,830 | ---- | M] () -- C:\Users\Lukas Hilber\Apr2006_d3dx9_30_x64.cab [2010.06.02 05:21:16 | 001,115,221 | ---- | M] () -- C:\Users\Lukas Hilber\Apr2006_d3dx9_30_x86.cab [2010.06.02 05:21:18 | 000,916,430 | ---- | M] () -- C:\Users\Lukas Hilber\Apr2006_MDX1_x86.cab [2010.06.02 05:21:18 | 004,162,630 | ---- | M] () -- C:\Users\Lukas Hilber\Apr2006_MDX1_x86_Archive.cab [2010.06.02 05:21:18 | 000,179,133 | ---- | M] () -- C:\Users\Lukas Hilber\Apr2006_XACT_x64.cab [2010.06.02 05:21:18 | 000,133,103 | ---- | M] () -- C:\Users\Lukas Hilber\Apr2006_XACT_x86.cab [2010.06.02 05:21:20 | 000,087,101 | ---- | M] () -- C:\Users\Lukas Hilber\Apr2006_xinput_x64.cab [2010.06.02 05:21:34 | 000,046,010 | ---- | M] () -- C:\Users\Lukas Hilber\Apr2006_xinput_x86.cab [2010.06.02 05:21:36 | 000,698,612 | ---- | M] () -- C:\Users\Lukas Hilber\APR2007_d3dx10_33_x64.cab [2010.06.02 05:21:36 | 000,695,865 | ---- | M] () -- C:\Users\Lukas Hilber\APR2007_d3dx10_33_x86.cab [2010.06.02 05:21:36 | 001,607,358 | ---- | M] () -- C:\Users\Lukas Hilber\APR2007_d3dx9_33_x64.cab [2010.06.02 05:21:38 | 001,606,039 | ---- | M] () -- C:\Users\Lukas Hilber\APR2007_d3dx9_33_x86.cab [2010.06.02 05:21:38 | 000,195,766 | ---- | M] () -- C:\Users\Lukas Hilber\APR2007_XACT_x64.cab [2010.06.02 05:21:38 | 000,151,225 | ---- | M] () -- C:\Users\Lukas Hilber\APR2007_XACT_x86.cab [2010.06.02 05:21:38 | 000,096,817 | ---- | M] () -- C:\Users\Lukas Hilber\APR2007_xinput_x64.cab [2010.06.02 05:21:40 | 000,053,302 | ---- | M] () -- C:\Users\Lukas Hilber\APR2007_xinput_x86.cab [2010.06.02 05:21:40 | 001,350,542 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2005_d3dx9_27_x64.cab [2010.06.02 05:21:40 | 001,077,644 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2005_d3dx9_27_x86.cab [2010.06.02 05:21:40 | 000,182,903 | ---- | M] () -- C:\Users\Lukas Hilber\AUG2006_XACT_x64.cab [2010.06.02 05:21:40 | 000,137,235 | ---- | M] () -- C:\Users\Lukas Hilber\AUG2006_XACT_x86.cab [2010.06.02 05:21:40 | 000,087,142 | ---- | M] () -- C:\Users\Lukas Hilber\AUG2006_xinput_x64.cab [2010.06.02 05:21:40 | 000,046,058 | ---- | M] () -- C:\Users\Lukas Hilber\AUG2006_xinput_x86.cab [2010.06.02 05:21:42 | 000,852,286 | ---- | M] () -- C:\Users\Lukas Hilber\AUG2007_d3dx10_35_x64.cab [2010.06.02 05:21:42 | 000,796,867 | ---- | M] () -- C:\Users\Lukas Hilber\AUG2007_d3dx10_35_x86.cab [2010.06.02 05:21:42 | 001,800,160 | ---- | M] () -- C:\Users\Lukas Hilber\AUG2007_d3dx9_35_x64.cab [2010.06.02 05:21:42 | 001,708,152 | ---- | M] () -- C:\Users\Lukas Hilber\AUG2007_d3dx9_35_x86.cab [2010.06.02 05:21:44 | 000,198,096 | ---- | M] () -- C:\Users\Lukas Hilber\AUG2007_XACT_x64.cab [2010.06.02 05:21:44 | 000,153,012 | ---- | M] () -- C:\Users\Lukas Hilber\AUG2007_XACT_x86.cab [2010.06.02 05:21:42 | 000,867,612 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2008_d3dx10_39_x64.cab [2010.06.02 05:21:44 | 000,849,167 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2008_d3dx10_39_x86.cab [2010.06.02 05:21:44 | 001,794,084 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2008_d3dx9_39_x64.cab [2010.06.02 05:21:44 | 001,464,672 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2008_d3dx9_39_x86.cab [2010.06.02 05:21:44 | 000,121,772 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2008_XACT_x64.cab [2010.06.02 05:21:44 | 000,092,996 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2008_XACT_x86.cab [2010.06.02 05:21:46 | 000,271,412 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2008_XAudio_x64.cab [2010.06.02 05:21:46 | 000,271,038 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2008_XAudio_x86.cab [2010.06.02 05:21:46 | 000,919,044 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_D3DCompiler_42_x64.cab [2010.06.02 05:21:56 | 000,900,598 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_D3DCompiler_42_x86.cab [2010.06.02 05:21:56 | 003,112,111 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_d3dcsx_42_x64.cab [2010.06.02 05:21:56 | 003,319,740 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_d3dcsx_42_x86.cab [2010.06.02 05:21:58 | 000,232,635 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_d3dx10_42_x64.cab [2010.06.02 05:21:58 | 000,192,131 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_d3dx10_42_x86.cab [2010.06.02 05:21:58 | 000,136,301 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_d3dx11_42_x64.cab [2010.06.02 05:21:58 | 000,105,044 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_d3dx11_42_x86.cab [2010.06.02 05:21:58 | 000,930,116 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_d3dx9_42_x64.cab [2010.06.02 05:21:58 | 000,728,456 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_d3dx9_42_x86.cab [2010.06.02 05:22:00 | 000,122,408 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_XACT_x64.cab [2010.06.02 05:22:00 | 000,093,106 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_XACT_x86.cab [2010.06.02 05:22:00 | 000,273,264 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_XAudio_x64.cab [2010.06.02 05:22:00 | 000,272,642 | ---- | M] () -- C:\Users\Lukas Hilber\Aug2009_XAudio_x86.cab [2010.06.02 05:22:00 | 001,357,976 | ---- | M] () -- C:\Users\Lukas Hilber\Dec2005_d3dx9_28_x64.cab [2010.06.02 05:22:00 | 001,079,456 | ---- | M] () -- C:\Users\Lukas Hilber\Dec2005_d3dx9_28_x86.cab [2010.06.02 05:22:00 | 000,212,807 | ---- | M] () -- C:\Users\Lukas Hilber\DEC2006_d3dx10_00_x64.cab [2010.06.02 05:22:00 | 000,191,720 | ---- | M] () -- C:\Users\Lukas Hilber\DEC2006_d3dx10_00_x86.cab [2010.06.02 05:22:00 | 001,571,154 | ---- | M] () -- C:\Users\Lukas Hilber\DEC2006_d3dx9_32_x64.cab [2010.06.02 05:22:02 | 001,574,376 | ---- | M] () -- C:\Users\Lukas Hilber\DEC2006_d3dx9_32_x86.cab [2010.06.02 05:22:02 | 000,192,475 | ---- | M] () -- C:\Users\Lukas Hilber\DEC2006_XACT_x64.cab [2010.06.02 05:22:02 | 000,145,599 | ---- | M] () -- C:\Users\Lukas Hilber\DEC2006_XACT_x86.cab [2010.06.02 05:22:02 | 000,089,944 | ---- | M] (Microsoft Corporation) -- C:\Users\Lukas Hilber\DSETUP.dll [2010.06.02 05:22:02 | 001,801,048 | ---- | M] () -- C:\Users\Lukas Hilber\dsetup32.dll [2010.06.02 05:22:02 | 000,042,410 | ---- | M] () -- C:\Users\Lukas Hilber\dxdllreg_x86.cab [2010.06.02 05:22:02 | 000,537,432 | ---- | M] () -- C:\Users\Lukas Hilber\DXSETUP.exe [2010.06.02 05:22:02 | 000,094,011 | ---- | M] () -- C:\Users\Lukas Hilber\dxupdate.cab [2010.06.02 05:22:02 | 001,247,499 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2005_d3dx9_24_x64.cab [2010.06.02 05:22:02 | 001,013,225 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2005_d3dx9_24_x86.cab [2010.06.02 05:22:02 | 001,362,796 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2006_d3dx9_29_x64.cab [2010.06.02 05:22:04 | 001,084,720 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2006_d3dx9_29_x86.cab [2010.06.02 05:22:10 | 000,178,359 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2006_XACT_x64.cab [2010.06.02 05:22:10 | 000,132,409 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2006_XACT_x86.cab [2010.06.02 05:22:12 | 000,194,675 | ---- | M] () -- C:\Users\Lukas Hilber\FEB2007_XACT_x64.cab [2010.06.02 05:22:12 | 000,147,983 | ---- | M] () -- C:\Users\Lukas Hilber\FEB2007_XACT_x86.cab [2010.06.02 05:22:12 | 000,054,678 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2010_X3DAudio_x64.cab [2010.06.02 05:22:12 | 000,020,713 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2010_X3DAudio_x86.cab [2010.06.02 05:22:14 | 000,122,446 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2010_XACT_x64.cab [2010.06.02 05:22:14 | 000,093,180 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2010_XACT_x86.cab [2010.06.02 05:22:14 | 000,276,960 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2010_XAudio_x64.cab [2010.06.02 05:22:14 | 000,277,191 | ---- | M] () -- C:\Users\Lukas Hilber\Feb2010_XAudio_x86.cab [2010.06.02 05:22:14 | 001,336,002 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2005_d3dx9_26_x64.cab [2010.06.02 05:22:16 | 001,064,925 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2005_d3dx9_26_x86.cab [2010.06.02 05:22:16 | 000,180,785 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2006_XACT_x64.cab [2010.06.02 05:22:16 | 000,133,671 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2006_XACT_x86.cab [2010.06.02 05:22:16 | 000,699,044 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2007_d3dx10_34_x64.cab [2010.06.02 05:22:16 | 000,698,472 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2007_d3dx10_34_x86.cab [2010.06.02 05:22:16 | 001,607,774 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2007_d3dx9_34_x64.cab [2010.06.02 05:22:16 | 001,607,286 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2007_d3dx9_34_x86.cab [2010.06.02 05:22:16 | 000,197,122 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2007_XACT_x64.cab [2010.06.02 05:22:18 | 000,152,909 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2007_XACT_x86.cab [2010.06.02 05:22:18 | 000,867,828 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2008_d3dx10_38_x64.cab [2010.06.02 05:22:18 | 000,849,919 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2008_d3dx10_38_x86.cab [2010.06.02 05:22:18 | 001,792,608 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2008_d3dx9_38_x64.cab [2010.06.02 05:22:18 | 001,463,878 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2008_d3dx9_38_x86.cab [2010.06.02 05:22:18 | 000,055,154 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2008_X3DAudio_x64.cab [2010.06.02 05:22:18 | 000,021,905 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2008_X3DAudio_x86.cab [2010.06.02 05:22:18 | 000,121,054 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2008_XACT_x64.cab [2010.06.02 05:22:18 | 000,093,128 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2008_XACT_x86.cab [2010.06.02 05:22:18 | 000,269,628 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2008_XAudio_x64.cab [2010.06.02 05:22:20 | 000,269,024 | ---- | M] () -- C:\Users\Lukas Hilber\JUN2008_XAudio_x86.cab [2010.06.02 05:22:28 | 000,944,460 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_D3DCompiler_43_x64.cab [2010.06.02 05:22:28 | 000,931,471 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_D3DCompiler_43_x86.cab [2010.06.02 05:22:28 | 000,752,783 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_d3dcsx_43_x64.cab [2010.06.02 05:22:30 | 000,762,188 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_d3dcsx_43_x86.cab [2010.06.02 05:22:30 | 000,235,955 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_d3dx10_43_x64.cab [2010.06.02 05:22:30 | 000,197,283 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_d3dx10_43_x86.cab [2010.06.02 05:22:30 | 000,138,205 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_d3dx11_43_x64.cab [2010.06.02 05:22:30 | 000,109,445 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_d3dx11_43_x86.cab [2010.06.02 05:22:32 | 000,937,246 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_d3dx9_43_x64.cab [2010.06.02 05:22:32 | 000,768,036 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_d3dx9_43_x86.cab [2010.06.02 05:22:32 | 000,124,596 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_XACT_x64.cab [2010.06.02 05:22:32 | 000,093,686 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_XACT_x86.cab [2010.06.02 05:22:32 | 000,277,338 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_XAudio_x64.cab [2010.06.02 05:22:32 | 000,278,060 | ---- | M] () -- C:\Users\Lukas Hilber\Jun2010_XAudio_x86.cab [2010.06.02 05:22:32 | 000,844,884 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2008_d3dx10_37_x64.cab [2010.06.02 05:22:34 | 000,818,260 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2008_d3dx10_37_x86.cab [2010.06.02 05:22:34 | 001,769,862 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2008_d3dx9_37_x64.cab [2010.06.02 05:22:34 | 001,443,282 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2008_d3dx9_37_x86.cab [2010.06.02 05:22:34 | 000,055,058 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2008_X3DAudio_x64.cab [2010.06.02 05:22:34 | 000,021,867 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2008_X3DAudio_x86.cab [2010.06.02 05:22:36 | 000,122,336 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2008_XACT_x64.cab [2010.06.02 05:22:36 | 000,093,734 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2008_XACT_x86.cab [2010.06.02 05:22:36 | 000,251,194 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2008_XAudio_x64.cab [2010.06.02 05:22:36 | 000,226,250 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2008_XAudio_x86.cab [2010.06.02 05:22:36 | 001,067,160 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2009_d3dx10_41_x64.cab [2010.06.02 05:22:36 | 001,040,745 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2009_d3dx10_41_x86.cab [2010.06.02 05:22:36 | 001,973,702 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2009_d3dx9_41_x64.cab [2010.06.02 05:22:36 | 001,612,446 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2009_d3dx9_41_x86.cab [2010.06.02 05:22:38 | 000,054,600 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2009_X3DAudio_x64.cab [2010.06.02 05:22:38 | 000,021,298 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2009_X3DAudio_x86.cab [2010.06.02 05:22:46 | 000,121,506 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2009_XACT_x64.cab [2010.06.02 05:22:46 | 000,092,740 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2009_XACT_x86.cab [2010.06.02 05:22:46 | 000,275,044 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2009_XAudio_x64.cab [2010.06.02 05:22:48 | 000,273,018 | ---- | M] () -- C:\Users\Lukas Hilber\Mar2009_XAudio_x86.cab [2010.06.02 05:22:48 | 000,864,600 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2007_d3dx10_36_x64.cab [2010.06.02 05:22:48 | 000,803,884 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2007_d3dx10_36_x86.cab [2010.06.02 05:22:48 | 001,802,058 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2007_d3dx9_36_x64.cab [2010.06.02 05:22:48 | 001,709,360 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2007_d3dx9_36_x86.cab [2010.06.02 05:22:50 | 000,046,144 | ---- | M] () -- C:\Users\Lukas Hilber\NOV2007_X3DAudio_x64.cab [2010.06.02 05:22:50 | 000,018,496 | ---- | M] () -- C:\Users\Lukas Hilber\NOV2007_X3DAudio_x86.cab [2010.06.02 05:22:50 | 000,196,762 | ---- | M] () -- C:\Users\Lukas Hilber\NOV2007_XACT_x64.cab [2010.06.02 05:22:50 | 000,148,264 | ---- | M] () -- C:\Users\Lukas Hilber\NOV2007_XACT_x86.cab [2010.06.02 05:22:50 | 000,994,154 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2008_d3dx10_40_x64.cab [2010.06.02 05:22:52 | 000,965,421 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2008_d3dx10_40_x86.cab [2010.06.02 05:22:52 | 001,906,878 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2008_d3dx9_40_x64.cab [2010.06.02 05:22:52 | 001,550,796 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2008_d3dx9_40_x86.cab [2010.06.02 05:22:52 | 000,054,522 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2008_X3DAudio_x64.cab [2010.06.02 05:22:52 | 000,021,851 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2008_X3DAudio_x86.cab [2010.06.02 05:22:52 | 000,121,794 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2008_XACT_x64.cab [2010.06.02 05:22:52 | 000,092,684 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2008_XACT_x86.cab [2010.06.02 05:22:54 | 000,273,960 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2008_XAudio_x64.cab [2010.06.02 05:22:54 | 000,272,611 | ---- | M] () -- C:\Users\Lukas Hilber\Nov2008_XAudio_x86.cab [2012.08.06 12:32:12 | 001,572,864 | -HS- | M] () -- C:\Users\Lukas Hilber\ntuser.dat [2012.08.06 12:32:12 | 000,262,144 | -HS- | M] () -- C:\Users\Lukas Hilber\ntuser.dat.LOG1 [2012.02.18 20:05:50 | 000,000,000 | -HS- | M] () -- C:\Users\Lukas Hilber\ntuser.dat.LOG2 [2012.02.19 03:08:20 | 000,065,536 | -HS- | M] () -- C:\Users\Lukas Hilber\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf [2012.02.19 03:08:20 | 000,524,288 | -HS- | M] () -- C:\Users\Lukas Hilber\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms [2012.02.19 03:08:20 | 000,524,288 | -HS- | M] () -- C:\Users\Lukas Hilber\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms [2012.05.17 02:02:35 | 000,065,536 | -HS- | M] () -- C:\Users\Lukas Hilber\ntuser.dat{76bcd3b2-9f72-11e1-8836-c89cdca2b215}.TM.blf [2012.05.17 02:02:35 | 000,524,288 | -HS- | M] () -- C:\Users\Lukas Hilber\ntuser.dat{76bcd3b2-9f72-11e1-8836-c89cdca2b215}.TMContainer00000000000000000001.regtrans-ms [2012.05.17 02:02:35 | 000,524,288 | -HS- | M] () -- C:\Users\Lukas Hilber\ntuser.dat{76bcd3b2-9f72-11e1-8836-c89cdca2b215}.TMContainer00000000000000000002.regtrans-ms [2012.02.18 20:05:51 | 000,000,020 | -HS- | M] () -- C:\Users\Lukas Hilber\ntuser.ini [2010.06.02 05:22:54 | 000,086,037 | ---- | M] () -- C:\Users\Lukas Hilber\Oct2005_xinput_x64.cab [2010.06.02 05:22:54 | 000,045,359 | ---- | M] () -- C:\Users\Lukas Hilber\Oct2005_xinput_x86.cab [2010.06.02 05:22:54 | 001,412,902 | ---- | M] () -- C:\Users\Lukas Hilber\OCT2006_d3dx9_31_x64.cab [2010.06.02 05:22:54 | 001,127,217 | ---- | M] () -- C:\Users\Lukas Hilber\OCT2006_d3dx9_31_x86.cab [2010.06.02 05:22:54 | 000,182,361 | ---- | M] () -- C:\Users\Lukas Hilber\OCT2006_XACT_x64.cab [2010.06.02 05:22:54 | 000,138,017 | ---- | M] () -- C:\Users\Lukas Hilber\OCT2006_XACT_x86.cab < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 < > < End of report > Geändert von NoLimiT (06.08.2012 um 11:49 Uhr) |
|
06.08.2012, 11:50
| #4 |
| | GVU Trojaner auf meinem PCCode:
ATTFilter OTL Extras logfile created on: 06.08.2012 12:34:21 - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Lukas Hilber\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,98 Gb Total Physical Memory | 2,88 Gb Available Physical Memory | 72,34% Memory free
7,96 Gb Paging File | 6,87 Gb Available in Paging File | 86,30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 688,95 Gb Total Space | 585,75 Gb Free Space | 85,02% Space Free | Partition Type: NTFS
Drive D: | 689,21 Gb Total Space | 332,50 Gb Free Space | 48,24% Space Free | Partition Type: NTFS
Computer Name: LUKASHILBER-PC | User Name: Lukas Hilber | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-4001011127-71849744-855568330-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003B981B-205E-48BF-94A5-D0249407FCF6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{109DF41C-169E-4DEB-B664-8B1A42568EED}" = lport=2869 | protocol=6 | dir=in | app=system |
"{12B78227-A670-49FA-BB13-65D01925FF5E}" = lport=137 | protocol=17 | dir=in | app=system |
"{18B0B66E-AE81-409D-AAFB-8A4AB6AE1A8A}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1C2B5B30-DDA3-4F5A-AE4A-E82A97296940}" = lport=445 | protocol=6 | dir=in | app=system |
"{2269DF78-FB58-4097-9B7E-0765ECE453E9}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2C6A70E4-CCAE-46EA-8571-8F54EF6F247C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{38349EB7-0DA4-4286-9DD6-675E794D8985}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3A90346D-7AD8-43EC-884A-C970D4DBEB59}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5C0527FA-F81F-49B9-9D04-F5218B2AA8F4}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{600BA4A8-53A4-488A-A939-FD6B7E5939A7}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{7CEE9934-EDBF-4319-A4EE-4D1AF7B7EDC0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{93581DBC-32CE-425B-BABF-76BB35F51874}" = rport=138 | protocol=17 | dir=out | app=system |
"{9597C05A-1907-40A9-B1FA-916B94D1DCED}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{BD84D13B-7049-4E0C-8871-862FDA9FC880}" = rport=445 | protocol=6 | dir=out | app=system |
"{C62F6AB2-0899-4DA3-B3C8-DD690CA888C8}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C64D80E2-EFF9-44F0-8DE7-A4F1F442A739}" = rport=137 | protocol=17 | dir=out | app=system |
"{C88C73F4-D2E3-4357-A5A6-A13A4FA3A696}" = rport=139 | protocol=6 | dir=out | app=system |
"{D955647C-4AE6-4FF2-AC74-D66AA3A1A1C3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DEE151C7-A8D2-4CF3-9AEB-028A295268A3}" = lport=138 | protocol=17 | dir=in | app=system |
"{DF549D56-72D6-4E6F-B094-A0043D82112F}" = lport=139 | protocol=6 | dir=in | app=system |
"{EB6CD12A-83DE-4FAE-9219-62360178B980}" = lport=10243 | protocol=6 | dir=in | app=system |
"{EBBE104D-D9C3-48F8-9BAA-5285262EBCAE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F36BB8C2-1939-49F0-9881-07C6EA358E54}" = lport=12000 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05E283AB-7EFF-4A6E-9ED1-EBBE9DB3A7F6}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{0614740F-B1EA-473E-A600-F24D5648DD48}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{139D3366-C923-4AC7-BF11-0C71CA30425E}" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"{206363CD-37C5-4CB0-A1CA-9DF859E74913}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{289A07A1-2A92-492B-AE68-9B5D46C8E55C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2A45207A-1740-4DF2-AE81-794B4803C8C5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2FFFD7E4-95D3-4EFE-924F-3FDEF3D62BE7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3138F0DD-F2E8-4543-BB4C-826141843884}" = protocol=6 | dir=in | app=c:\program files (x86)\ventrilo\ventrilo.exe |
"{3D41501B-B90D-41C2-8D80-5E16D02BA391}" = protocol=6 | dir=in | app=c:\program files (x86)\efusion\blackshot\system\blackshot.exe |
"{3FBC551D-1B30-4A58-B182-2483B33DCC4E}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\kernel\dmr\clmsservice.exe |
"{40A2025D-4E1A-4021-B731-C711AA80CC17}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{42DD39D8-FBCC-43F5-93BC-49666325C6E4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{433F92F1-4535-40CF-B6B3-29F5B40EBA0A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{4811E89F-16E0-4730-A8B6-9ABCFE407219}" = protocol=17 | dir=in | app=c:\program files (x86)\efusion\blackshot\system\blackshot.exe |
"{4CA0CB6F-FE10-4709-985A-B40D90F42DF2}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{4CEBADA9-DB60-4D35-AB46-0B45FBF718BA}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{55B5D08A-3CAB-4D44-B823-F2BBDC918AB7}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\clear.fiagent.exe |
"{5B7699CF-2BBF-4549-9911-58722AB669A2}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\clear.fi.exe |
"{5BEC3E2A-5C1F-4A25-9A6E-E29DAA382515}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{5F64D81A-7A5C-415D-AEA3-08E868CB95F2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{61D86453-F35C-44EB-A67E-690CB95B9090}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{6DBE2132-C956-4808-B117-61111DE6E404}" = protocol=17 | dir=in | app=c:\program files (x86)\ventrilo\ventrilo.exe |
"{78AC4A4B-6B0B-4207-8A9E-1E98C95D7E30}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{78BDB47D-F9D2-4C08-88C6-AEBC5829B59B}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\kernel\dmr\dmrengine.exe |
"{7BE30944-F6A5-48BD-91AD-1629C5F75FED}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\kernel\dmr\dmrengine.exe |
"{7E9724D4-BBC2-4F08-A50C-B5CB49993F4A}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{7F38CF86-8B56-488A-A521-1273096B8DD7}" = dir=in | app=c:\program files (x86)\acer\clear.fi\movie\playmovie.exe |
"{83AA3B6C-D2ED-4A48-B2B4-E36025647A61}" = protocol=6 | dir=out | app=system |
"{87B5E83C-7766-47CF-9C0C-1ED4E98AAFA7}" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"{94C578E1-543B-4648-AC46-7FA72933C545}" = protocol=6 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe |
"{990A2061-878E-439B-ACED-2C64AA993F92}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9DB991F1-9330-4D3D-8CA4-63C3C5BB52A9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A18DD89B-E7FA-4685-B6DF-4F341E70FA79}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B693E8E8-AE6D-4DB6-B27A-D7CB4136BF5A}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe |
"{B6FD8ED3-1D1C-46D1-96C0-1674D15737B8}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{B82C5126-1966-4829-835E-C21EDF9519D4}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{C1828866-A4C9-4E95-9058-00B78FD8EF58}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C4D088A1-759F-4670-9D9C-CFDF59730B47}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{C9D242DC-25AF-4AF2-BB94-DAB940B3A60D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CFD9C146-62E1-4744-9A84-53C2CEF397A2}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{D782029D-48D2-4BCF-89F4-410838E474AD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DC416AFD-0CA3-4881-8C77-1E911A884769}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\clear.fiagent.exe |
"{E02B7B1F-0F7A-49E4-B72D-EDF81B30A351}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\clear.fiagent.exe |
"{E78807BB-2AD7-401B-B01C-FF1133118018}" = protocol=17 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe |
"{EC691485-DB06-4337-9CF5-9BF339F14166}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\kernel\dmr\dmrengine.exe |
"{ED91579B-7073-4D88-BAA2-EF8754A652D9}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{F0229EE7-8181-414E-8971-6737B55963EA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F04E6399-0344-4B26-84FD-EF1957F2EDD9}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{F6FF651A-5724-4644-B6F0-BB377F810065}" = dir=in | app=c:\program files (x86)\acer\clear.fi\mvp\kernel\clml\clmlsvc.exe |
"{F97851EC-3E41-4B3E-8F91-1D419152DD46}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe |
"TCP Query User{02F02E24-7CC6-43D9-A40F-1B5F67E971EC}C:\programdata\electronic arts\need for speed world\data\nfsw.exe" = protocol=6 | dir=in | app=c:\programdata\electronic arts\need for speed world\data\nfsw.exe |
"TCP Query User{0388E30C-9654-4099-832E-FC1FB02EF472}C:\users\lukas hilber\appdata\roaming\ybme\tuyhe.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\appdata\roaming\ybme\tuyhe.exe |
"TCP Query User{0EEB4017-6BD5-41F9-92F4-AEEB6EDDE2E4}C:\users\lukas hilber\desktop\shizuka3-client-2012 - epic\clientstarter.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\shizuka3-client-2012 - epic\clientstarter.exe |
"TCP Query User{0FAC6EA8-9FFF-45DF-BAF8-DE984122CAE4}C:\users\lukas hilber\desktop\neuer ordner\nw3c.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\neuer ordner\nw3c.exe |
"TCP Query User{105F8386-C3C2-418E-A32E-B57D3FD140BD}C:\users\lukas hilber\downloads\blackmamba-network.com-full-client\metin2.bin" = protocol=6 | dir=in | app=c:\users\lukas hilber\downloads\blackmamba-network.com-full-client\metin2.bin |
"TCP Query User{1B549A65-416C-4FF2-9CA1-C38A24C73006}C:\program files (x86)\mozilla firefox\mythology - client\.mythology.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\mythology - client\.mythology.exe |
"TCP Query User{1FFE9FCE-28C0-4DBA-BF40-BF0BA1D219FE}C:\users\lukas hilber\desktop\zephion - 05.07.2012\metin2client.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\zephion - 05.07.2012\metin2client.exe |
"TCP Query User{27A1880F-3F7C-424D-8039-5BCDC11548E4}C:\users\lukas hilber\desktop\verus2-client\verus2.bin" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\verus2-client\verus2.bin |
"TCP Query User{31CEAA3A-7FE1-4FDB-8B88-0B20AE1148BD}C:\users\lukas hilber\desktop\flyworld2 reloaded\metin2client.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\flyworld2 reloaded\metin2client.exe |
"TCP Query User{35B86EED-7626-4639-82C8-691F07A558FB}C:\users\lukas hilber\desktop\vuphon2\metin2client.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\vuphon2\metin2client.exe |
"TCP Query User{384C1353-9ABD-4A41-A81F-0446B393A347}D:\sirius mt2\metin2client_sirius_mt2.bin" = protocol=6 | dir=in | app=d:\sirius mt2\metin2client_sirius_mt2.bin |
"TCP Query User{3D8EFAF7-2258-4443-94E8-1E8DACA5E0FF}C:\users\lukas hilber\desktop\cythoisa-mt2 2012\cythosia-mt2.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\cythoisa-mt2 2012\cythosia-mt2.exe |
"TCP Query User{421EDA8A-57BD-47B6-A362-5EFE44CCE9A1}C:\users\lukas hilber\desktop\anessia2\metin2client.bin" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\anessia2\metin2client.bin |
"TCP Query User{589B97E6-B44A-4C77-BA47-7E77B7A69EB3}C:\users\lukas hilber\desktop\energymt2\energymt2.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\energymt2\energymt2.exe |
"TCP Query User{64E01B9E-F4B3-4366-8A75-93803C421B57}C:\users\lukas hilber\desktop\vuphon2\metin2client.bin" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\vuphon2\metin2client.bin |
"TCP Query User{65F3B4BF-195A-4AA3-BDAE-011A5EAF964B}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"TCP Query User{662D2F8C-EF80-4965-87E3-E0DB0663A856}C:\users\lukas hilber\desktop\euphoria 2012 client\.euphoria.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\euphoria 2012 client\.euphoria.exe |
"TCP Query User{71BF0446-34C5-4171-9981-F343C0093053}C:\users\lukas hilber\desktop\taubben-mt2 client v1\taubbe-mt2.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\taubben-mt2 client v1\taubbe-mt2.exe |
"TCP Query User{72434530-93AC-42CA-BAFC-CC0CBD6CFB43}C:\users\lukas hilber\desktop\blackmamba-network.com-full-client\metin2.bin" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\blackmamba-network.com-full-client\metin2.bin |
"TCP Query User{72CEEECA-398E-4BF6-A40A-FB13DCDE31BA}C:\users\lukas hilber\desktop\client\metin2client.bin" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\client\metin2client.bin |
"TCP Query User{74ABDCE9-A981-4DD9-81DF-BB45A4B1D23F}C:\users\lukas hilber\desktop\helius2-client\helius2.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\helius2-client\helius2.exe |
"TCP Query User{74F4ED29-089B-40EB-B6D1-7119068EB2DC}C:\users\lukas hilber\desktop\xtrememt2client 2012\metin2client.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\xtrememt2client 2012\metin2client.exe |
"TCP Query User{7576A46E-4B02-433D-B540-44C1495BEB60}C:\users\lukas hilber\desktop\ayumi2_client\metin2client.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\ayumi2_client\metin2client.exe |
"TCP Query User{768A7B56-DCB3-474D-9C8A-3FF79B945C28}C:\users\lukas hilber\desktop\client mitin2\metin2client.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\client mitin2\metin2client.exe |
"TCP Query User{76DDE7B5-24D7-4201-A59B-6270E67BD882}C:\users\lukas hilber\desktop\energymt2\metin2client_live.bin" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\energymt2\metin2client_live.bin |
"TCP Query User{78C68F07-98C0-42FB-B4AA-302CEC04ED38}C:\users\lukas hilber\desktop\alzo\metin2client.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\alzo\metin2client.exe |
"TCP Query User{78C777B4-F0C4-4448-B49B-BA4629F05CA9}C:\nexon\combat arms eu\engine.exe" = protocol=6 | dir=in | app=c:\nexon\combat arms eu\engine.exe |
"TCP Query User{7A3B843C-4A3E-4DE9-8380-0723D544CB06}C:\users\lukas hilber\desktop\sayaki2 client v1.2\sayaki2.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\sayaki2 client v1.2\sayaki2.exe |
"TCP Query User{80A290DB-5E97-4076-9B34-1E11119A7D05}C:\users\lukas hilber\desktop\hardcore reloaded\metin2client.bin" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\hardcore reloaded\metin2client.bin |
"TCP Query User{866BE6E4-A0BF-48B0-847C-8A71123751B2}C:\users\lukas hilber\desktop\harmonia3\harmonia3.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\harmonia3\harmonia3.exe |
"TCP Query User{8EA042E5-5A4B-455A-B664-AD2664728937}C:\users\lukas hilber\desktop\cl2-revolution client apollon client 2012\cl2-revolution.exe.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\cl2-revolution client apollon client 2012\cl2-revolution.exe.exe |
"TCP Query User{8FA9A2CF-3877-418C-B597-6AE40EA16587}C:\users\lukas hilber\desktop\client\client\clientstarten.bin" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\client\client\clientstarten.bin |
"TCP Query User{92601BC7-B273-45DE-89A6-886B22C6A7F3}C:\users\lukas hilber\desktop\merkury2\.merkury2 - starter.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\merkury2\.merkury2 - starter.exe |
"TCP Query User{9905338E-4E45-44DE-A75D-6273D303E96A}C:\users\lukas hilber\desktop\takashi2_client3.3 official\clientstarter.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\takashi2_client3.3 official\clientstarter.exe |
"TCP Query User{9EBB352C-4568-44DD-B79C-71ADAEAD94F8}C:\users\lukas hilber\desktop\client\clienstarten.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\client\clienstarten.exe |
"TCP Query User{A7395884-CE9E-441B-A381-C29BA811B656}C:\users\lukas hilber\desktop\calypso-2 offiziel 2012 new client\calypso-2.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\calypso-2 offiziel 2012 new client\calypso-2.exe |
"TCP Query User{AA0E91A5-F23D-4459-873D-5410986A768D}C:\users\lukas hilber\desktop\akuma2 2012 client\akuma2.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\akuma2 2012 client\akuma2.exe |
"TCP Query User{B5B79FBA-9DBD-42D6-B1CB-68E84A41DAA2}C:\users\lukas hilber\desktop\rop-network 2012\rop-network.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\rop-network 2012\rop-network.exe |
"TCP Query User{BBB44955-1E94-4403-914C-8B852C14F558}C:\program files (x86)\dragonheart\data\lib\gm.pyc" = protocol=6 | dir=in | app=c:\program files (x86)\dragonheart\data\lib\gm.pyc |
"TCP Query User{BC8C2B9F-EC4E-4E14-B300-885A085690A3}C:\users\lukas hilber\desktop\hardcore reloaded\.hardcore reloaded.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\hardcore reloaded\.hardcore reloaded.exe |
"TCP Query User{C3AA83CB-739B-4CAB-96F0-C8F30B71190C}C:\program files (x86)\moonmt2juni2012\moonmt2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\moonmt2juni2012\moonmt2.exe |
"TCP Query User{D61211EE-9063-4FF9-ADE7-998EDA6DB9EA}C:\users\lukas hilber\desktop\client\client\clienstarten.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\client\client\clienstarten.exe |
"TCP Query User{D64491D0-74B4-4090-AB5E-C1A0E8A72FD4}C:\users\lukas hilber\desktop\energymt2\metin2.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\energymt2\metin2.exe |
"TCP Query User{DB0EAC35-D0F7-491A-A31F-81348FE9734B}C:\users\lukas hilber\desktop\tsuyoshi2\metin2client.bin" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\tsuyoshi2\metin2client.bin |
"TCP Query User{E2FDB6FA-70C3-4141-8788-A3932B3B858A}C:\users\lukas hilber\desktop\cl2-revolution new client\cl2-revolution.exe.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\cl2-revolution new client\cl2-revolution.exe.exe |
"TCP Query User{E66AEAB5-49A6-45E8-A247-EE260FFD91B2}C:\program files (x86)\dragonheart\data\lib\rtc.pyc" = protocol=6 | dir=in | app=c:\program files (x86)\dragonheart\data\lib\rtc.pyc |
"TCP Query User{E7BE7A18-E099-425E-882F-006E76F4E79A}C:\users\lukas hilber\desktop\euphoria 2012 client\.euphoria client.exe" = protocol=6 | dir=in | app=c:\users\lukas hilber\desktop\euphoria 2012 client\.euphoria client.exe |
"TCP Query User{E98DD35D-9158-4C64-94B3-7AD3CC046E2E}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{089E6C6D-F53D-450E-8816-06070D8E9498}C:\users\lukas hilber\desktop\merkury2\.merkury2 - starter.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\merkury2\.merkury2 - starter.exe |
"UDP Query User{08E2C120-616A-4B86-B6F3-179167CBB01B}C:\users\lukas hilber\desktop\energymt2\metin2.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\energymt2\metin2.exe |
"UDP Query User{0A6280A2-02E2-46C5-ADD1-57BEF767E515}C:\program files (x86)\dragonheart\data\lib\rtc.pyc" = protocol=17 | dir=in | app=c:\program files (x86)\dragonheart\data\lib\rtc.pyc |
"UDP Query User{10838A7F-BD51-4F42-8555-1366D3B84824}C:\users\lukas hilber\desktop\client\client\clienstarten.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\client\client\clienstarten.exe |
"UDP Query User{11FD9C72-A864-4332-8F43-D52DF362B299}C:\users\lukas hilber\appdata\roaming\ybme\tuyhe.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\appdata\roaming\ybme\tuyhe.exe |
"UDP Query User{136C4818-8F78-4C52-9A48-15CDC62F961D}C:\program files (x86)\mozilla firefox\mythology - client\.mythology.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\mythology - client\.mythology.exe |
"UDP Query User{13D0AD87-F1D7-4A62-991C-198A9A6F723A}C:\users\lukas hilber\desktop\vuphon2\metin2client.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\vuphon2\metin2client.exe |
"UDP Query User{19A4F2B7-D8B6-4C5F-B73F-7B15F650A9D5}C:\program files (x86)\moonmt2juni2012\moonmt2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\moonmt2juni2012\moonmt2.exe |
"UDP Query User{1DF19BDC-10CE-4589-BC54-1D74F46AD495}C:\users\lukas hilber\desktop\tsuyoshi2\metin2client.bin" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\tsuyoshi2\metin2client.bin |
"UDP Query User{1F9574BD-D3FE-445D-B60C-147622CFDE51}C:\users\lukas hilber\desktop\takashi2_client3.3 official\clientstarter.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\takashi2_client3.3 official\clientstarter.exe |
"UDP Query User{21DF76FE-2878-447E-A97B-078805E293A8}C:\nexon\combat arms eu\engine.exe" = protocol=17 | dir=in | app=c:\nexon\combat arms eu\engine.exe |
"UDP Query User{2E6FE977-BB86-46F4-8D1C-E4E86E1FBB67}C:\users\lukas hilber\desktop\blackmamba-network.com-full-client\metin2.bin" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\blackmamba-network.com-full-client\metin2.bin |
"UDP Query User{388C62F9-4BE9-4FBE-A733-E966A15606C7}C:\users\lukas hilber\desktop\euphoria 2012 client\.euphoria client.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\euphoria 2012 client\.euphoria client.exe |
"UDP Query User{3D8D9951-4D5C-4157-A4EA-0021D6BC02AC}C:\users\lukas hilber\desktop\anessia2\metin2client.bin" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\anessia2\metin2client.bin |
"UDP Query User{3EC06540-7A0E-4216-9133-8B918553DA8C}C:\users\lukas hilber\desktop\akuma2 2012 client\akuma2.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\akuma2 2012 client\akuma2.exe |
"UDP Query User{4163EE33-CDB6-40BD-842F-28C70C8FBC36}C:\users\lukas hilber\desktop\rop-network 2012\rop-network.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\rop-network 2012\rop-network.exe |
"UDP Query User{41D136AC-7AB9-43D8-A1BE-5041B4C8AD24}C:\users\lukas hilber\desktop\cl2-revolution client apollon client 2012\cl2-revolution.exe.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\cl2-revolution client apollon client 2012\cl2-revolution.exe.exe |
"UDP Query User{4C9227B4-E9B7-4C29-9259-1209C2B7EDF9}C:\users\lukas hilber\desktop\cythoisa-mt2 2012\cythosia-mt2.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\cythoisa-mt2 2012\cythosia-mt2.exe |
"UDP Query User{53309065-5DE0-40E2-9CCD-471BF91F61DA}D:\sirius mt2\metin2client_sirius_mt2.bin" = protocol=17 | dir=in | app=d:\sirius mt2\metin2client_sirius_mt2.bin |
"UDP Query User{68B53D2A-3EC3-445C-B081-5E0A433FB002}C:\users\lukas hilber\desktop\verus2-client\verus2.bin" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\verus2-client\verus2.bin |
"UDP Query User{68F2250B-6915-4CF5-8654-6E65E0EAFD0C}C:\users\lukas hilber\desktop\xtrememt2client 2012\metin2client.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\xtrememt2client 2012\metin2client.exe |
"UDP Query User{6E470DE8-8806-4E23-84DD-5428AB669E86}C:\users\lukas hilber\desktop\neuer ordner\nw3c.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\neuer ordner\nw3c.exe |
"UDP Query User{7C5D889C-4530-46B3-9C8D-20E89CFFF025}C:\users\lukas hilber\desktop\calypso-2 offiziel 2012 new client\calypso-2.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\calypso-2 offiziel 2012 new client\calypso-2.exe |
"UDP Query User{7FA2C1D1-9813-4539-A335-A2F7AEFEE36E}C:\users\lukas hilber\desktop\zephion - 05.07.2012\metin2client.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\zephion - 05.07.2012\metin2client.exe |
"UDP Query User{8400817C-CDAF-494D-871F-BE17332ECB56}C:\users\lukas hilber\desktop\cl2-revolution new client\cl2-revolution.exe.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\cl2-revolution new client\cl2-revolution.exe.exe |
"UDP Query User{8B751042-2D4C-4E92-9A00-7BD79EBF4017}C:\users\lukas hilber\desktop\euphoria 2012 client\.euphoria.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\euphoria 2012 client\.euphoria.exe |
"UDP Query User{971ACCC4-D0DC-4C1A-A31B-E4B01A2F565E}C:\users\lukas hilber\desktop\sayaki2 client v1.2\sayaki2.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\sayaki2 client v1.2\sayaki2.exe |
"UDP Query User{A062F341-3570-4580-A9F6-E7F053E3D64F}C:\users\lukas hilber\desktop\hardcore reloaded\.hardcore reloaded.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\hardcore reloaded\.hardcore reloaded.exe |
"UDP Query User{A1ED9551-B6C2-4E26-9C71-C41B703D213B}C:\users\lukas hilber\desktop\energymt2\energymt2.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\energymt2\energymt2.exe |
"UDP Query User{A55AEE8D-DA69-4C82-80AC-5453C8AA04F4}C:\users\lukas hilber\desktop\ayumi2_client\metin2client.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\ayumi2_client\metin2client.exe |
"UDP Query User{A685B5B0-6627-4B00-8B4E-BCBAC6D57A00}C:\users\lukas hilber\desktop\vuphon2\metin2client.bin" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\vuphon2\metin2client.bin |
"UDP Query User{A89CF6E7-6449-4BAA-98A3-20E8604D592A}C:\users\lukas hilber\desktop\client mitin2\metin2client.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\client mitin2\metin2client.exe |
"UDP Query User{AFC5FB58-40D6-44A2-9D79-2628CE5196BD}C:\users\lukas hilber\desktop\client\metin2client.bin" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\client\metin2client.bin |
"UDP Query User{B21E8BCF-6C37-4FB5-9012-E801177C925C}C:\users\lukas hilber\desktop\taubben-mt2 client v1\taubbe-mt2.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\taubben-mt2 client v1\taubbe-mt2.exe |
"UDP Query User{B2F93141-A451-4BB1-AB43-1FD899C76DBD}C:\users\lukas hilber\desktop\flyworld2 reloaded\metin2client.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\flyworld2 reloaded\metin2client.exe |
"UDP Query User{B7668925-A27C-4942-B02D-CC6A01053AB6}C:\users\lukas hilber\desktop\client\clienstarten.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\client\clienstarten.exe |
"UDP Query User{C3898C0B-6305-4111-B0B3-6C4A8DD51770}C:\users\lukas hilber\desktop\helius2-client\helius2.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\helius2-client\helius2.exe |
"UDP Query User{C4ED2065-3D49-4420-802C-35B6F91E6B80}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"UDP Query User{C77A1AE2-2AB4-48F4-AAC9-F5781FBC62EB}C:\users\lukas hilber\desktop\hardcore reloaded\metin2client.bin" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\hardcore reloaded\metin2client.bin |
"UDP Query User{C9233448-47A5-42AE-B253-532BA5736B16}C:\users\lukas hilber\desktop\energymt2\metin2client_live.bin" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\energymt2\metin2client_live.bin |
"UDP Query User{CC3C9CCB-D98F-4452-8241-CB267F2A38AE}C:\users\lukas hilber\downloads\blackmamba-network.com-full-client\metin2.bin" = protocol=17 | dir=in | app=c:\users\lukas hilber\downloads\blackmamba-network.com-full-client\metin2.bin |
"UDP Query User{DBF0DFB2-7332-4D6C-83B2-E0B834FECB75}C:\programdata\electronic arts\need for speed world\data\nfsw.exe" = protocol=17 | dir=in | app=c:\programdata\electronic arts\need for speed world\data\nfsw.exe |
"UDP Query User{DC0D7D01-F1DB-4E2D-84DB-05A8E82E1BB7}C:\users\lukas hilber\desktop\alzo\metin2client.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\alzo\metin2client.exe |
"UDP Query User{E1231050-DF59-43DB-9A37-41577E382914}C:\users\lukas hilber\desktop\shizuka3-client-2012 - epic\clientstarter.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\shizuka3-client-2012 - epic\clientstarter.exe |
"UDP Query User{E4961CAF-791A-4D25-8007-DBAFD2E66378}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{E8FD1885-6A5C-4B36-864E-7FB64AEA905D}C:\users\lukas hilber\desktop\client\client\clientstarten.bin" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\client\client\clientstarten.bin |
"UDP Query User{E90DBA89-588C-419C-971A-8B47279EC760}C:\users\lukas hilber\desktop\harmonia3\harmonia3.exe" = protocol=17 | dir=in | app=c:\users\lukas hilber\desktop\harmonia3\harmonia3.exe |
"UDP Query User{FCBFCF84-29D6-47E5-81E2-A2F902A4A01E}C:\program files (x86)\dragonheart\data\lib\gm.pyc" = protocol=17 | dir=in | app=c:\program files (x86)\dragonheart\data\lib\gm.pyc |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0919C44F-F18A-4E3B-A737-03685272CE72}" = Windows Live Remote Service Resources
"{0B78ECB0-1A6B-4E6D-89D7-0E7CE77F0427}" = MyWinLocker
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1553D712-B35F-4A82-BC72-D6B11A94BE3E}" = Windows Live Remote Service Resources
"{1685AE50-97ED-485B-80F6-145071EE14B0}" = Windows Live Remote Service Resources
"{17A4FD95-A507-43F1-BC92-D8572AF8340A}" = Windows Live Remote Service Resources
"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources
"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder
"{22AB5CFD-B3DB-414E-9F99-4D024CCF1DA6}" = Windows Live Remote Client Resources
"{2426E29F-9E8C-4C0B-97FC-0DB690C1ED98}" = Windows Live Remote Client Resources
"{2C1A6191-9804-4FDC-AB01-6F9183C91A13}" = Windows Live Remote Client Resources
"{2F304EF4-0C31-47F4-8557-0641AAE4197C}" = Windows Live Remote Client Resources
"{34384A2A-2CA2-4446-AB0E-1F360BA2AAC5}" = Windows Live Remote Service Resources
"{350FD0E7-175A-4F86-84EF-05B77FCD7161}" = Windows Live Remote Service Resources
"{3921492E-82D2-4180-8124-E347AD2F2DB4}" = Windows Live Remote Client Resources
"{456FB9B5-AFBC-4761-BBDC-BA6BAFBB818F}" = Windows Live Remote Client Resources
"{480F28F0-8BCE-404A-A52E-0DBB7D1CE2EF}" = Windows Live Remote Service Resources
"{4C2E49C0-9276-4324-841D-774CCCE5DB48}" = Windows Live Remote Client Resources
"{5141AA6E-5FAC-4473-BFFB-BEE69DDC7F2B}" = Windows Live Remote Service Resources
"{5151E2DB-0748-4FD1-86A2-72E2F94F8BE7}" = Windows Live Remote Service Resources
"{57F2BD1C-14A3-4785-8E48-2075B96EB2DF}" = Windows Live Remote Service Resources
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5F44A3A1-5D24-4708-8776-66B42B174C64}" = Windows Live Remote Client Resources
"{5FCD6EFE-C2E7-4D77-8212-4BA223D8DF8E}" = Windows Live Remote Client Resources
"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources
"{61407251-7F7D-4303-810D-226A04D5CFF3}" = Windows Live Remote Service Resources
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources
"{6C9D3F1D-DBBE-46F9-96A0-726CC72935AF}" = Windows Live Remote Service Resources
"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources
"{702A632F-99CE-4E2D-B8F2-BF980E9CF62F}" = Windows Live Remote Client Resources
"{7AEC844D-448A-455E-A34E-E1032196BBCD}" = Windows Live Remote Service Resources
"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{850B8072-2EA7-4EDC-B930-7FE569495E76}" = Windows Live Remote Client Resources
"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources
"{8F7F2D9C-2DBE-4F10-9C7C-2724110A3339}" = Windows Live Remote Service Resources
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97A295A7-8840-4B35-BB61-27A8F4512CA3}" = Windows Live Remote Service Resources
"{9E9C960F-7F47-46D5-A95D-950B354DE2B8}" = Windows Live Remote Service Resources
"{A060182D-CDBE-4AD6-B9B4-860B435D6CBD}" = Windows Live Remote Client Resources
"{A508D5A2-3AC1-4594-A718-A663D6D3CF11}" = Windows Live Remote Service Resources
"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources
"{A6E0F6BE-30AC-4D36-97B0-1AC20E23CB83}" = Windows Live Remote Client Resources
"{B0BF8602-EA52-4B0A-A2BD-EDABB0977030}" = Windows Live Remote Client Resources
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 280.19
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 280.19
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.23.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B680A663-1A15-47A5-A07C-7DF9A97558B7}" = Windows Live Remote Client Resources
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{C504EC13-E122-4939-BD6E-EE5A3BAA5FEC}" = Windows Live Remote Client Resources
"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources
"{CFF3C688-2198-4BC3-A399-598226949C39}" = Windows Live Remote Client Resources
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{D1C1556C-7FF3-48A3-A5D6-7126F0FAFB66}" = Windows Live Remote Client Resources
"{D3E4F422-7E0F-49C7-8B00-F42490D7A385}" = Windows Live Remote Service Resources
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{ED421F97-E1C3-4E78-9F54-A53888215D58}" = Windows Live Remote Client Resources
"{EFB20CF5-1A6D-41F3-8895-223346CE6291}" = Windows Live Remote Service Resources
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6CB2C5F-B2C1-4DF1-BF44-39D0DC06FE6F}" = Windows Live Remote Service Resources
"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources
"{FAD0EC0B-753B-4A97-AD34-32AC1EC8DB69}" = Windows Live Remote Client Resources
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00884F14-05BD-4D8E-90E5-1ABF78948CA4}" = Windows Live Mesh
"{0125DB4D-98A0-4DBF-B68A-23BF08FFA6A3}" = Windows Live Messenger
"{039480EE-6933-4845-88B8-77FD0C3D059D}" = Windows Live Mesh
"{0557BBDA-69D3-4FA4-A93C-A5300F7034B4}" = Windows Live Writer
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{0654EA5D-308A-4196-882B-5C09744A5D81}" = Windows Live Photo Common
"{06B05153-97E4-427E-B1A8-E098F6C5E52F}" = Windows Live Essentials
"{073F306D-9851-4969-B828-7B6444D07D55}" = Windows Live Photo Common
"{0785A0B6-07DF-43CF-B147-E1EB4CEA0345}" = Windows Live Messenger
"{09922FFE-D153-44AE-8B60-EA3CB8088F93}" = Windows Live UX Platform Language Pack
"{0A4C4B29-5A9D-4910-A13C-B920D5758744}" = بريد Windows Live
"{0A9256E0-C924-46DE-921B-F6C4548A1C64}" = Windows Live Messenger
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C1931EB-8339-4837-8BEC-75029BF42734}" = Windows Live UX Platform Language Pack
"{0C975FCC-A06E-4CB6-8F54-A9B52CF37781}" = Windows Liven sähköposti
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live
"{10186F1A-6A14-43DF-A404-F0105D09BB07}" = Windows Live Mail
"{110668B7-54C6-47C9-BAC4-1CE77F156AF5}" = Windows Live Mesh
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{11417707-1F72-4279-95A3-01E0B898BBF5}" = Windows Live Mesh
"{11778DA1-0495-4ED9-972F-F9E0B0367CD5}" = Windows Live Writer
"{1203DC60-D9BD-44F9-B372-2B8F227E6094}" = Windows Live Temel Parçalar
"{120C160F-F53D-4A15-A873-E79BF5B98B48}" = Windows Live Photo Common
"{128133D3-037A-4C62-B1B7-55666A10587A}" = Windows Live UX Platform Language Pack
"{133D9D67-D475-4407-AC3C-D558087B2453}" = Windows Live Movie Maker
"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources
"{14C4C3B6-F1F4-401F-8C86-03E8E19AAC8C}" = clear.fi
"{168E7302-890A-4138-9109-A225ACAF7AD1}" = Windows Live Photo Common
"{17835B63-8308-427F-8CF5-D76E0D5FE457}" = Windows Live Essentials
"{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}" = MyWinLocker Suite
"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials
"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1A72337E-D126-4BAF-AC89-E6122DB71866}" = Windows Liven valokuvavalikoima
"{1A82AE99-84D3-486D-BAD6-675982603E14}" = Windows Live Writer
"{1D6C2068-807F-4B76-A0C2-62ED05656593}" = Windows Live Writer
"{1DA6D447-C54D-4833-84D4-3EA31CAECE9B}" = Windows Live UX Platform Language Pack
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FC83EAE-74C8-4C72-8400-2D8E40A017DE}" = Windows Live Writer
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20381A8A-808E-4A53-B6CD-AD2B85E16365}" = Windows Live UX Platform Language Pack
"{220C7F8C-929D-4F71-9DC7-F7A6823B38E4}" = Windows Live UX Platform Language Pack
"{226F0D93-76DE-4F1C-B14D-DE10443ADB60}" = Windows Live Movie Maker
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{249EE21B-8EDD-4F36-8A23-E580E9DBE80A}" = Windows Live Mail
"{24DF33E0-F924-4D0D-9B96-11F28F0D602D}" = Windows Live UX Platform Language Pack
"{2511AAD7-82DF-4B97-B0B3-E1B933317010}" = Windows Live Writer Resources
"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail
"{25CD4B12-8CC5-433E-B723-C9CB41FA8C5A}" = Windows Live Writer
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java(TM) 7 Update 4
"{26E3C07C-7FF7-4362-9E99-9E49E383CF16}" = Windows Live Writer Resources
"{28921580-E4BB-11E0-9FD7-1CC1DEF07CBE}" = Evernote v. 4.5.1
"{289AC7E0-0AEE-4a7b-913C-709D9803D23E}" = Nexon Game Manager
"{28B9D2D8-4304-483F-AD71-51890A063A74}" = Windows Live Photo Common
"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2AD2DD70-27F7-4343-BB4E-DE50A32D854B}" = Windows Live Messenger
"{2BA5FD10-653F-4CAF-9CCD-F685082A1DC1}" = Windows Live Writer
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2C4E06CC-1F04-4C25-8B3C-93A9049EC42C}" = Windows Live UX Platform Language Pack
"{2C7E8AA1-9C03-4606-BF34-5D99D07964DA}" = Windows Live Messenger
"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh
"{2D3E034E-F76B-410A-A169-55755D2637BB}" = Windows Live Mesh
"{2D8CED57-CCDB-4D86-9087-3BBCAE8F8F22}" = Six Updater
"{2E50E321-4747-4EB5-9ECB-BBC6C3AC0F31}" = Windows Live Writer Resources
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{303143DD-1F6D-4BC5-9342-FFC2E19B2DBD}" = Windows Live Messenger
"{3125D9DE-8D7A-4987-95F3-8A42389833D8}" = Windows Live Writer Resources
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{34C4F5AF-D757-4E6A-ABCA-65AB5A50A1A8}" = Windows Live Messenger
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common
"{37126D87-E4FD-4614-B908-A0BB7ECE3992}" = clear.fi
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{38509AAB-6FD0-40EA-8171-8499F92F5B3B}_is1" = DragonheartMt2 Version 1.0
"{39BDD209-5704-480C-9F4A-B69D0370DDBB}" = Windows Live Messenger
"{39F15B50-A977-4CA6-B1C3-6A8724CDA025}" = MyWinLocker 4
"{39F95B0B-A0B7-4FA7-BB6C-197DA2546468}" = Windows Live Mesh
"{3B72C1E0-26A1-40F6-8516-D50C651DFB3C}" = Windows Live Essentials
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}" = Smite Closed Beta
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{3D0C22FA-96D7-4789-BC5B-991A5A99BFFA}" = Windows Live Messenger
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh
"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack
"{410DF0AA-882D-450D-9E1B-F5397ACFFA80}" = Windows Live Essentials
"{4264C020-850B-4F08-ACBE-98205D9C336C}" = Windows Live Writer
"{429DF1A0-3610-4E9E-8ACE-3C8AC1BA8FCA}" = Windows Live Photo Gallery
"{43AAE145-83CF-4C96-9A5E-756CEFCE879F}" = clear.fi Client
"{43B43577-2514-4CE0-B14A-7E85C17C0453}" = Windows Live Essentials
"{4444F27C-B1A8-464E-9486-4C37BAB39A09}" = Фотогалерия на Windows Live
"{458F399F-62AC-4747-99F5-499BBF073D29}" = Windows Live Writer Resources
"{4664ED39-C80A-48F7-93CD-EBDCAFAB6CC5}" = Windows Live Writer Resources
"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh
"{4736B0ED-F6A1-48EC-A1B7-C053027648F1}" = Galeria fotogràfica del Windows Live
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{48F597DD-D397-4CFA-91A0-4C033A0113BD}" = Windows Live Mail
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A04DB63-8F81-4EF4-9D09-61A2057EF419}" = Windows Live Essentials
"{4A275FD1-2F24-4274-8C01-813F5AD1A92D}" = Windows Live Messenger
"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer
"{4C378B16-46B7-4DA1-A2CE-2EE676F74680}" = Windows Live UX Platform Language Pack
"{4C774C35-E0AF-72E1-136A-2BF666702268}" = Fooz Kids
"{4D141929-141B-4605-95D6-2B8650C1C6DA}" = Windows Live UX Platform Language Pack
"{4D7BAC8A-51B8-4243-8567-1415C4272D13}" = Windows Live Writer
"{4D83F339-5A5C-4B21-8FD3-5D407B981E72}" = Windows Live Photo Common
"{50300123-F8FC-4B50-B449-E847D04F1BA2}" = Windows Live Messenger
"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{523DF2BB-3A85-4047-9898-29DC8AEB7E69}" = Windows Live UX Platform Language Pack
"{5275D81E-83AD-4DE4-BC2B-6E6BA3A33244}" = Windows Live Writer Resources
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{5495E9A4-501A-4D4C-87C9-E80916CA9478}" = Windows Live UX Platform Language Pack
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5C2F5C1B-9732-4F81-8FBF-6711627DC508}" = Windows Live Fotogalleri
"{5CF5B1A5-CBC3-42F0-8533-5A5090665862}" = Windows Live Mesh
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{5D2E7BD7-4B6F-4086-BA8A-E88484750624}" = Windows Live Writer Resources
"{5D90ABE5-8A35-4947-8269-6F40BCE47A95}" = Windows Live Messenger
"{5DA7D148-D2D2-4C67-8444-2F0F9BD88A06}" = Windows Live Writer
"{5E627606-53B9-42D1-97E1-D03F6229E248}" = Windows Live UX Platform Language Pack
"{5F6E678A-7E61-448A-86CB-BC2AD1E04138}" = Windows Live Messenger
"{6057E21C-ABE9-4059-AE3E-3BEB9925E660}" = Windows Live Messenger
"{60C3C026-DB53-4DAB-8B97-7C1241F9A847}" = Windows Live Movie Maker
"{625D45F0-5DCB-48BF-8770-C240A84DAAEB}" = Windows Live Mesh
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{62BF4BD3-B1F6-4FA2-8388-CC0647ACBF86}" = Nero Multimedia Suite 10 Essentials
"{63AE67AA-1AB1-4565-B4EF-ABBC5C841E8D}" = Windows Live Messenger
"{63CF7D0C-B6E7-4EE9-8253-816B613CC437}" = Windows Live Mail
"{640798A0-A4FB-4C52-AC72-755134767F1E}" = Windows Live Movie Maker
"{64376910-1860-4CEF-8B34-AA5D205FC5F1}" = Poczta usługi Windows Live
"{644063FA-ABA3-42AC-A8AC-3EDC0706018B}" = Windows Live Mesh
"{6491AB99-A11E-41FD-A5E7-32DE8A097B8E}" = Windows Live Essentials
"{64B2D6B3-71AC-45A7-A6A1-2E07ABF58341}" = Windows Live Movie Maker
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail
"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6986737B-F286-40D1-87AF-938339DCF6AB}" = Windows Live Messenger
"{69C9C672-400A-43A0-B2DE-9DB38C371282}" = Windows Live Writer
"{69CAC24D-B1DC-4B97-A1BE-FE21843108FE}" = Windows Live Writer Resources
"{6A4ABCDC-0A49-4132-944E-01FBCCB3465C}" = Windows Live UX Platform Language Pack
"{6A563426-3474-41C6-B847-42B39F1485B2}" = Windows Live Messenger
"{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}" = AION Free-To-Play
"{6ABE832B-A5C7-44C1-B697-3E123B7B4D5B}" = Windows Live Mesh
"{6B556C37-8919-4991-AC34-93D018B9EA49}" = Windows Live Photo Common
"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker
"{6D30E864-46AE-435B-8230-8B5D42B4AE37}" = Windows Live Messenger
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{6EE9F44A-B8C7-4CDB-B2A9-441AF2AE315A}" = Windows Live Messenger
"{6EF2BE2C-3121-48B7-B7A6-C56046B3A588}" = Windows Live Movie Maker
"{6F37D92B-41AA-44B7-80D2-457ABDE11896}" = Windows Live Photo Common
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{709E38A9-7F80-4598-96CC-44B0D553FECE}" = Windows Live Messenger
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-acer" = WildTangent Games App (Acer Games)
"{71527C7C-5289-4CB2-88C9-23344C0FF6C1}" = Windows Live Movie Maker
"{71A81378-79D5-40CC-9BDC-380642D1A87F}" = Windows Live Writer
"{71C95134-F6A9-45E7-B7B3-07CA6012BF2A}" = Windows Live Mesh
"{7224A5D0-FE0A-4D35-AA4A-0E498026D125}_is1" = MoonMt2Juni2012 Version 1.6.2
"{7272F232-A7E0-4B2B-A5D2-71B7C5E2379C}" = Windows Live Fotótár
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7327080F-6673-421F-BBD9-B618F357EEB3}" = Windows Live UX Platform Language Pack
"{734104DE-C2BF-412F-BB97-FCCE1EC94229}" = Windows Live Writer Resources
"{7373E17D-18E0-44A7-AC3A-6A3BFB85D3B3}" = Windows Live Movie Maker
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{7465A996-0FCA-4D2D-A52C-F833B0829B5B}" = Windows Live Movie Maker
"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh
"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack
"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack
"{77F69CA1-E53D-4D77-8BA3-FA07606CC851}" = Фотоальбом Windows Live
"{78906B56-0E81-42A7-AC25-F54C946E1538}" = Windows Live Photo Common
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh
"{7A9D47BA-6D50-4087-866F-0800D8B89383}" = Podstawowe programy Windows Live
"{7ADFA72D-2A9F-4DEC-80A5-2FAA27E23F0F}" = Windows Live Photo Common
"{7AF8E500-B349-4A77-8265-9854E9A47925}" = Windows Live Movie Maker
"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World
"{7BA19818-F717-4DFB-BC11-FAF17B2B8AEE}" = Pošta Windows Live
"{7C2A3479-A5A0-412B-B0E6-6D64CBB9B251}" = Windows Live Photo Common
"{7CB529B2-6C74-4878-9C3F-C29C3C3BBDC6}" = Windows Live Writer Resources
"{7D0DE76C-874E-4BDE-A204-F4240160693E}" = Windows Live Photo Common
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7D926AD2-16D6-42C2-8CA1-AB09E96040BA}" = Windows Live Writer Resources
"{7D99B933-E29C-4599-92F0-DAED2AF041E3}" = Windows Live Essentials
"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer
"{7E90B133-FF47-48BB-91B8-36FC5A548FE9}" = Windows Live Writer Resources
"{7F6021AE-E688-4D03-843A-C2260482BA0D}" = Windows Live Messenger
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{7FF11E53-C002-4F40-8D68-6BE751E5DD62}" = Windows Live Writer Resources
"{804DE397-F82C-4867-9085-E0AA539A3294}" = Windows Live Writer
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{80E8C65A-8F70-4585-88A2-ABC54BABD576}" = Windows Live Mesh
"{827D3E4A-0186-48B7-9801-7D1E9DD40C07}" = Windows Live Essentials
"{82803FF3-563F-414F-A403-8D4C167D4120}" = Windows Live Mail
"{831D4B74-7A92-4363-869D-524876C480B1}_is1" = Sirius MT2 Version 20.12.02
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{84267681-BF16-40B6-9564-27BC57D7D71C}" = Windows Live Photo Common
"{84A411F9-40A5-4CDA-BF46-E09FBB2BC313}" = Windows Live Essentials
"{85373DA7-834E-4850-8AF5-1D99F7526857}" = Windows Live Photo Common
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{861B1145-7762-4794-B40C-3FF0A389DFE6}" = Windows Live Photo Gallery
"{86F444A5-C9B9-41DC-AF28-B5E46F5497C7}" = Windows Live Argazki Galeria
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{885F1BCD-C344-4758-85BD-09640CF449A5}" = Windows Live Photo Gallery
"{8909CFA8-97BF-4077-AC0F-6925243FFE08}" = Windows Liven asennustyökalu
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8CF5D47D-27B7-49D6-A14F-10550B92749D}" = Windows Live UX Platform Language Pack
"{8D68CE08-9A14-4B7B-9857-3C646A2F34C7}" = Fooz Kids Platform
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E285C75-9BE2-4349-972B-DECDDF472656}" = Windows Live Writer Resources
"{924B4D82-1B97-48EB-8F1E-55C4353C22DB}" = Windows Live Mail
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93C4B7D5-4E00-491F-BA3E-25B7B63EE7F6}" = Windows Live Mail
"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{97F77D62-5110-4FA3-A2D3-410B92D31199}" = Windows Live Fotogaléria
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99BE7F5D-AB52-4404-9E03-4240FFAA7DE9}" = Windows Live Mesh
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DA3F03B-2CEE-4344-838E-117861E61FAF}" = Windows Live Mail
"{9DB90178-B5B0-45BD-B0A7-D40A6A1DF1CA}" = Windows Live Movie Maker
"{9E2C5B0E-7A2D-4767-A9B2-77469FB1873A}" = Windows Live Mesh
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A101F637-2E56-42C0-8E08-F1E9086BFAF3}" = Windows Live Movie Maker
"{A199DB88-E22D-4CE7-90AC-B8BE396D7BF4}" = Windows Live Movie Maker
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB0B2113-5B96-4B95-8AD1-44613384911F}" = Windows Live Mesh
"{AB78C965-5C67-409B-8433-D7B5BDB12073}" = Windows Live Writer Resources
"{ABD534B7-E951-470E-92C2-CD5AF1735726}" = Windows Live Essentials
"{ABE2F2AA-7ADC-4717-9573-BF3F83C696AC}" = Windows Live Mail
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X MUI
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AD001A69-88CC-4766-B2DB-3C1DFAB9AC72}" = Windows Live Mesh
"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail
"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common
"{AF01B90A-D25C-4F60-AECD-6EEDF509DC11}" = Windows Live Mesh
"{B0AD205F-60D0-4084-AFB8-34D9A706D9A8}" = Windows Live Essentials
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2BCA478-EC0F-45EE-A9E9-5EABE87EA72D}" = Windows Live Photo Common
"{B33B61FE-701F-425F-98AB-2B85725CBF68}" = Windows Live Photo Common
"{B3BE54A4-8DFE-4593-8E66-56AB7133B812}" = Windows Live Writer
"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials
"{B63F0CE3-CCD0-490A-9A9C-E1A3B3A17137}" = Почта Windows Live
"{B7B67AA5-12DA-4F01-918D-B1BF66779D8A}" = Windows Live Writer Resources
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{BD4EBDB5-EB14-4120-BB04-BE0A26C7FB3E}" = Windows Live Photo Common
"{BD695C2F-3EA0-4DA4-92D5-154072468721}" = Windows Live Fotoğraf Galerisi
"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker
"{BF35168D-F6F9-4202-BA87-86B5E3C9BF7A}" = Windows Live Mesh
"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live
"{C01FCACE-CC3D-49A2-ADC2-583A49857C58}" = Windows Live Essentials
"{C08D5964-C42F-48EE-A893-2396F9562A7C}" = Windows Live Mesh
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C1C9D199-B4DD-4895-92DD-9A726A2FE341}" = Windows Live Writer
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C28D96C0-6A90-459E-A077-A6706F4EC0FC}" = Bing Bar
"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C3592426-531E-4110-911D-BFECE2CE284C}" = osu!
"{C454280F-3C3E-4929-B60E-9E6CED5717E7}" = Windows Live Mail
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C8421D85-CA0E-4E93-A9A9-B826C4FB88EA}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{CB3F59BB-7858-41A1-A7EA-4B8A6FC7D431}" = Galeria fotografii usługi Windows Live
"{CB66242D-12B1-4494-82D2-6F53A7E024A3}" = Galerie foto Windows Live
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CD442136-9115-4236-9C14-278F6A9DCB3F}" = Windows Live Movie Maker
"{CD7CB1E6-267A-408F-877D-B532AD2C882E}" = Windows Live Photo Common
"{CDC39BF2-9697-4959-B893-A2EE05EF6ACB}" = Windows Live Writer
"{CE929F09-3853-4180-BD90-30764BFF7136}" = גלריית התמונות של Windows Live
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF671BFE-6BA3-44E7-98C1-500D9C51D947}" = Windows Live Photo Gallery
"{D07B1FDA-876B-4914-9E9A-309732B6D44F}" = Windows Live Mail
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack
"{D31169F2-CD71-4337-B783-3E53F29F4CAD}" = Windows Live Mail
"{D3E5A972-9A15-427D-AE78-8181A5FD943C}" = eBay Worldwide
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D54A52A8-DF24-4CE8-850B-074CA47DFA74}" = Windows Live Messenger
"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail
"{D6CBB3B2-F510-483D-AE0D-1CF3F43CF1EE}" = Windows Live Writer Resources
"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack
"{DA29F644-2420-4448-8128-1331BE588999}" = Windows Live Writer
"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker
"{DB1208F4-B2FE-44E9-BFE6-8824DBD7891B}" = Windows Live Movie Maker
"{DBAA2B17-D596-4195-A169-BA2166B0D69B}" = Windows Live Mail
"{DCAB6BA7-6533-44BF-9235-E5BF33B7431C}" = Windows Live Writer
"{DDC1E1BD-7615-4186-89E1-F5F43F9B6491}" = Windows Live Movie Maker
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer
"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{DF71ABBB-B834-41C0-BB58-80B0545D754C}" = Windows Live UX Platform Language Pack
"{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5377D46-83C5-445A-A1F1-830336B42A10}" = Windows Live Galerija fotografija
"{E55E0C35-AC3C-4683-BA2F-834348577B80}" = Windows Live Writer
"{E59969EA-3B5B-4B24-8B94-43842A7FBFE9}" = Fotogalerija Windows Live
"{E5DD4723-FE0B-436E-A815-DC23CF902A0B}" = Windows Live UX Platform Language Pack
"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E7688C7D-DE09-4D43-9785-534EDE9BC18E}" = Windows Live Messenger
"{E83DC314-C926-4214-AD58-147691D6FE9F}" = Основные компоненты Windows Live
"{E8524B28-3BBB-4763-AC83-0E83FE31C350}" = Windows Live Writer
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{E8E37C4F-DE01-4286-AFB6-9FBEC8265A1A}" = clear.fi
"{E9D98402-21AB-4E9F-BF6B-47AF36EF7E97}" = Windows Live Writer Resources
"{EA777812-4905-4C08-8F6E-13BDCC734609}" = Windows Live UX Platform Language Pack
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{EE492B20-FB15-4A98-883C-3054354A11F8}" = Windows Live Messenger
"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心
"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0F5D89A-197C-495B-827E-3E98B811CD2E}" = Windows Live Photo Common
"{F0F9505B-3ACF-4158-9311-D0285136AA00}" = Windows Live Essentials
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F13587F7-AA4C-4C2E-AE7D-F33F3CCE57A9}" = Windows Live Messenger
"{F4BEA6C1-AAC3-4810-AAEA-588E26E0F237}" = Windows Live UX Platform Language Pack
"{F52C5BE7-3F57-464E-8A54-908402E43CE8}" = Windows Live Writer Resources
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{F694D1F7-1F12-4550-9B7A-C871273ABAD5}" = Windows Live Messenger
"{F7A46527-DF1F-4B0F-9637-98547E189442}" = Windows Live Galeria de Fotos
"{F7E80BA7-A09D-4DD1-828B-C4A0274D4720}" = Windows Live Mesh
"{F80E5450-3EF3-4270-B26C-6AC53BEC5E76}" = Windows Live Movie Maker
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA6CF94F-DACF-4FE7-959D-55C421B91B17}" = Windows Live Mail
"{FB3D07AE-73D0-47A9-AC12-6F50BF8B6202}" = Windows Live Movie Maker
"{FB79FDB7-4DE1-453D-99FE-9A880F57380E}" = Windows Live Fotogalerie
"{FBCA06D2-4642-4F33-B20A-A7AB3F0D2E69}" = معرض صور Windows Live
"{FCBC19F7-E068-4B7A-ACBB-CE9CCEB4B21F}" = Windows Live Messenger
"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE62C88B-425B-4BDE-8B70-CD5AE3B83176}" = Windows Live Essentials
"{FEEF7F78-5876-438B-B554-C4CC426A4302}" = Windows Live Essentials
"{FF105207-8423-4E13-B0B1-50753170B245}" = Windows Live Movie Maker
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"{FF737490-5A2D-4269-9D82-97DB2F7C0B09}" = Windows Live Movie Maker
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AnalogX AutoTune" = AnalogX AutoTune
"Avira AntiVir Desktop" = Avira Free Antivirus
"BlackShot" = BlackShot
"Combat Arms EU" = Combat Arms EU
"FoozKids" = Fooz Kids
"Hotkey Utility" = Hotkey Utility
"Identity Card" = Identity Card
"InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}" = MyWinLocker Suite
"InstallShield_{37126D87-E4FD-4614-B908-A0BB7ECE3992}" = clear.fi
"InstallShield_{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}" = AION Free-To-Play
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NCLauncher_GameForge" = NC Launcher (GameForge)
"Notepad++" = Notepad++
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Softonic" = Softonic toolbar on IE and Chrome
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WildTangent acer Master Uninstall" = Acer Games
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.11 (32-Bit)
"WTA-0550479a-03fc-4a53-839e-dcbc21801afe" = Plants vs. Zombies - Game of the Year
"WTA-067c94de-c523-42df-bceb-75e5d02e1e33" = Jewel Match 3
"WTA-2b12e054-5c6d-4d4c-b0b5-55d536f7650c" = Crazy Chicken Kart 2
"WTA-2cfed0ee-6fec-4da2-9103-38f2ac3bf6a8" = Zuma Deluxe
"WTA-38875c2b-bda0-4950-b036-cc8d1c903ee7" = Bejeweled 2 Deluxe
"WTA-46a8b91d-8519-4fb7-855e-08a99200260c" = Virtual Villagers 4 - The Tree of Life
"WTA-5192aee3-bca7-416e-8890-e21584368783" = Agatha Christie - Death on the Nile
"WTA-64939b29-46f6-42bf-a60c-350ab1f3b55d" = FATE
"WTA-76877f0a-0501-4908-b160-38d234993cff" = Torchlight
"WTA-83112490-d789-4869-bdb2-ed6b61b9760c" = John Deere Drive Green
"WTA-8a4dd94a-6902-476b-a998-29468ac12b3b" = Mystery of Mortlake Mansion
"WTA-9067186d-4a7e-4ee5-9b5b-3cadf97bc94f" = Penguins!
"WTA-9683e1b6-a573-429b-946e-f2e287afceef" = Wedding Dash
"WTA-aceef271-c3b4-4695-bc35-9f80ad198a59" = Insaniquarium Deluxe
"WTA-d3d2ab8c-30c2-423a-bb17-3e6c2aa34738" = Final Drive: Nitro
"WTA-df8ef4d0-770f-4bd8-80fd-73c01ecc4e89" = Slingo Deluxe
"WTA-f6a5b977-5b91-43c9-b7bc-e3489640ca7b" = Polar Bowler
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-4001011127-71849744-855568330-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 26.05.2012 18:58:30 | Computer Name = LukasHilber-PC | Source = WinMgmt | ID = 10
Description =
Error - 28.05.2012 05:13:46 | Computer Name = LukasHilber-PC | Source = WinMgmt | ID = 10
Description =
Error - 28.05.2012 20:10:26 | Computer Name = LukasHilber-PC | Source = WinMgmt | ID = 10
Description =
Error - 29.05.2012 06:02:43 | Computer Name = LukasHilber-PC | Source = WinMgmt | ID = 10
Description =
Error - 30.05.2012 07:10:28 | Computer Name = LukasHilber-PC | Source = WinMgmt | ID = 10
Description =
Error - 31.05.2012 07:08:09 | Computer Name = LukasHilber-PC | Source = WinMgmt | ID = 10
Description =
Error - 01.06.2012 07:09:31 | Computer Name = LukasHilber-PC | Source = WinMgmt | ID = 10
Description =
Error - 02.06.2012 04:59:35 | Computer Name = LukasHilber-PC | Source = WinMgmt | ID = 10
Description =
Error - 03.06.2012 15:10:02 | Computer Name = LukasHilber-PC | Source = WinMgmt | ID = 10
Description =
Error - 04.06.2012 14:15:21 | Computer Name = LukasHilber-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 16.04.2012 09:43:53 | Computer Name = LukasHilber-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "LogMeIn Hamachi Tunneling Engine" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1053
Error - 21.04.2012 05:13:32 | Computer Name = LukasHilber-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Steam Client Service erreicht.
Error - 21.04.2012 05:13:32 | Computer Name = LukasHilber-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
Error - 25.04.2012 13:57:21 | Computer Name = LukasHilber-PC | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus
lautet: 10.
Error - 25.04.2012 14:04:35 | Computer Name = LukasHilber-PC | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus
lautet: 10.
Error - 05.05.2012 11:47:32 | Computer Name = LukasHilber-PC | Source = WMPNetworkSvc | ID = 866333
Description =
Error - 05.05.2012 12:00:36 | Computer Name = LukasHilber-PC | Source = WMPNetworkSvc | ID = 866333
Description =
Error - 05.05.2012 13:37:51 | Computer Name = LukasHilber-PC | Source = WMPNetworkSvc | ID = 866333
Description =
Error - 11.05.2012 09:24:13 | Computer Name = LukasHilber-PC | Source = DCOM | ID = 10010
Description =
Error - 14.05.2012 13:01:12 | Computer Name = LukasHilber-PC | Source = BROWSER | ID = 8032
Description =
< End of report >
So da sind die beiden |
|
06.08.2012, 17:36
| #5 |
| /// Malware-holic | GVU Trojaner auf meinem PC hi dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
[2012.08.06 11:22:44 | 000,001,889 | ---- | C] () -- C:\Users\Lukas Hilber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
:Files
:Commands
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden für eine weitere analyse benötige ich mal folgendes. c:\Users\name\AppData\LocalLow\Sun\Java\Deployment\cache dort rechtsklick auf den ordner cache, diesen mit winrar oder einem anderen programm packen, und im upload channel hochladen bitte Trojaner-Board Upload Channel wenn dies erledigt ist, bittemelden.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
06.08.2012, 17:49
| #6 |
| | GVU Trojaner auf meinem PC Es hat sich kein Text Dokument gebildet, habe den Pfad gefunden lade es sofort hoch Aber der Virus speert meinen PC nicht mehr |
|
06.08.2012, 18:07
| #7 | |
| /// Malware-holic | GVU Trojaner auf meinem PC passt. archiv was du erstellt und hochgeladen hast, löschen bitte Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
06.08.2012, 18:53
| #8 |
| | GVU Trojaner auf meinem PC Alles getahn hier die .txt Code:
ATTFilter ComboFix 12-08-05.02 - Lukas Hilber 06.08.2012 19:43:00.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4078.2925 [GMT 2:00]
ausgeführt von:: c:\users\Lukas Hilber\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Lukas Hilber\AppData\Roaming\Love
c:\users\Lukas Hilber\AppData\Roaming\Love\mari0\options.txt
c:\users\Lukas Hilber\Desktop\Piclair.exe
c:\windows\security\Database\tmp.edb
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-07-06 bis 2012-08-06 ))))))))))))))))))))))))))))))
.
.
2012-08-06 16:44 . 2012-08-06 16:44 -------- d-----w- C:\_OTL
2012-08-03 07:38 . 2012-06-29 10:04 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{00F6E6A7-8519-4002-8C59-F929B83A2D91}\mpengine.dll
2012-07-26 08:51 . 2012-07-26 08:51 -------- d-----w- c:\users\Lukas Hilber\AppData\Roaming\Ventrilo
2012-07-26 08:49 . 2012-07-26 08:49 -------- d-----w- c:\program files (x86)\Ventrilo
2012-07-26 08:48 . 2012-07-26 08:48 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2012-07-19 14:45 . 2012-07-19 14:45 -------- d-----w- c:\users\Lukas Hilber\AppData\Local\Chromium
2012-07-19 14:41 . 2012-07-22 01:53 -------- d-----w- c:\users\Lukas Hilber\AppData\Roaming\Ybme
2012-07-19 14:41 . 2012-07-19 15:12 -------- d-----w- c:\users\Lukas Hilber\AppData\Roaming\Xiqo
2012-07-19 14:41 . 2012-07-19 14:41 -------- d-----w- c:\users\Lukas Hilber\AppData\Roaming\Niypo
2012-07-19 13:52 . 2012-07-19 14:45 -------- d-----w- c:\programdata\Hi-Rez Studios
2012-07-19 13:52 . 2012-07-19 13:52 -------- d-----w- c:\program files (x86)\Hi-Rez Studios
2012-07-18 06:17 . 2012-07-18 06:17 -------- d-----w- c:\programdata\Nexon
2012-07-18 02:16 . 2012-07-18 02:16 -------- d-----w- C:\Nexon
2012-07-11 23:19 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-11 08:33 . 2012-06-06 06:06 2004480 ----a-w- c:\windows\system32\msxml6.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-02 19:42 . 2012-05-21 10:47 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-02 19:42 . 2011-07-11 10:28 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-11 23:17 . 2012-05-01 22:42 59701280 ----a-w- c:\windows\system32\MRT.exe
2012-06-25 23:04 . 2012-07-05 11:38 4598224 ----a-w- c:\windows\SysWow64\GameMon.des
2012-06-02 22:19 . 2012-06-21 10:56 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-21 10:56 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-21 10:56 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-21 10:56 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-21 10:56 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-21 10:56 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-21 10:56 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-21 10:55 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 13:15 . 2012-06-21 10:55 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-05-31 10:25 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{5018CFD2-804D-4C99-9F81-25EAEA2769DE}"= "c:\program files (x86)\Softonic\Softonic\1.5.21.0\SoftonicTlbr.dll" [2012-03-15 250576]
.
[HKEY_CLASSES_ROOT\clsid\{5018cfd2-804d-4c99-9f81-25eaea2769de}]
[HKEY_CLASSES_ROOT\Softonic.dskBnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[HKEY_CLASSES_ROOT\Softonic.dskBnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 44544]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2011-04-02 340848]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2011-03-29 408432]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2011-03-29 202608]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-08-31 185640]
"Hotkey Utility"="c:\program files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe" [2011-08-11 627304]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-02 250056]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-06-07 191752]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-18 113120]
R3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28x.sys [2009-06-10 620544]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-09-16 27760]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2011-07-11 22648]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2011-07-11 20520]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-07-11 62776]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-08 86224]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-05-12 249648]
S2 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2011-04-02 173424]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2011-05-30 36456]
S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [2012-07-12 8704]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-05 13336]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2011-04-22 244624]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-07-23 379496]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [2011-07-20 342704]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [2011-06-30 54784]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [2011-06-30 77696]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2011-05-10 174184]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-08-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-21 19:42]
.
2012-08-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4001011127-71849744-855568330-1001Core.job
- c:\users\Lukas Hilber\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-26 20:15]
.
2012-08-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4001011127-71849744-855568330-1001UA.job
- c:\users\Lukas Hilber\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-26 20:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-11 11580520]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://acer.msn.com
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://acer.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Lukas Hilber\AppData\Roaming\Mozilla\Firefox\Profiles\40dlhlr9.default\
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-piclair.exe - c:\users\Lukas Hilber\Desktop\Piclair.exe
Wow6432Node-HKCU-Run-Muettyyka - c:\users\Lukas Hilber\AppData\Roaming\Ybme\tuyhe.exe
Toolbar-Locked - (no file)
AddRemove-Notepad++ - c:\program files (x86)\Notepad++\uninstall.exe
AddRemove-{7224A5D0-FE0A-4D35-AA4A-0E498026D125}_is1 - c:\program files (x86)\MoonMt2Juni2012\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
c:\program files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-08-06 19:50:23 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-08-06 17:50
.
Vor Suchlauf: 10 Verzeichnis(se), 631.518.064.640 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 634.504.663.040 Bytes frei
.
- - End Of File - - F0F8954A579EA7E94DF03A24F94BB32B
|
|
08.08.2012, 20:48
| #9 |
| /// Malware-holic | GVU Trojaner auf meinem PC hi malwarebytes: Downloade Dir bitte Malwarebytes
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu GVU Trojaner auf meinem PC |
| desktop, gvu trojaner, inter, interne, internet, jegliche, programme, troja, trojaner, viren, zugreife, zugreifen |
Linear-Darstellung
