Trojan.Ransom Registry Value HKCU\SOFTWARE\Microsoft\Windows\NT\CurrentVersion\Windows|Load

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.21.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Katy :: KATY-PC [Administrator]

22.08.2012 09:38:58
mbam-log-2012-08-22 (09-38-58).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 191816
Laufzeit: 2 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (Trojan.Ransom) -> Daten: C:\Users\Katy\LOCALS~1\Temp\msawxfa.com -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

OTL logfile created on: 22.08.2012 10:41:27 - Run 1
OTL by OldTimer - Version 3.2.58.1     Folder = C:\Users\Katy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,65 Gb Available Physical Memory | 66,19% Memory free
7,99 Gb Paging File | 6,17 Gb Available in Paging File | 77,21% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,73 Gb Total Space | 15,61 Gb Free Space | 32,04% Space Free | Partition Type: NTFS
Drive D: | 547,34 Gb Total Space | 352,41 Gb Free Space | 64,39% Space Free | Partition Type: NTFS
Drive G: | 100,00 Mb Total Space | 71,85 Mb Free Space | 71,85% Space Free | Partition Type: NTFS
 
Computer Name: KATY-PC | User Name: Katy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.22 10:31:45 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Katy\Desktop\OTL.exe
PRC - [2012.08.08 18:53:27 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.07.14 02:14:27 | 000,016,864 | ---- | M] (Mozilla Corporation) -- C:\Programme\Firefox\plugin-container.exe
PRC - [2012.07.14 02:13:42 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Programme\Firefox\firefox.exe
PRC - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) -- C:\Program Files (x86)\Skype\Updater\Updater.exe
PRC - [2012.06.12 14:52:45 | 001,535,176 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
PRC - [2012.05.08 20:30:20 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 20:30:19 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.04.17 15:05:00 | 000,651,264 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
PRC - [2011.09.15 13:06:04 | 000,088,576 | ---- | M] () -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
PRC - [2011.07.19 23:29:11 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2009.09.10 21:24:00 | 000,380,928 | ---- | M] (AMD) -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.07.14 02:14:07 | 002,003,424 | ---- | M] () -- C:\Programme\Firefox\mozjs.dll
MOD - [2012.06.12 14:52:45 | 009,459,912 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll
MOD - [2012.05.10 08:54:03 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll
MOD - [2012.05.10 08:53:20 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.05.10 08:53:17 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.05.10 08:53:16 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.05.10 08:53:11 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012.04.17 15:05:00 | 001,515,520 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\Maps\R66Api.dll
MOD - [2012.04.17 15:05:00 | 000,651,264 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
MOD - [2012.04.17 15:05:00 | 000,559,244 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.7.dll
MOD - [2012.04.17 15:05:00 | 000,516,599 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.dll
MOD - [2012.04.17 15:05:00 | 000,389,120 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\HtcDetect.dll
MOD - [2012.04.17 15:05:00 | 000,172,032 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDetectLegend.dll
MOD - [2012.04.17 15:05:00 | 000,151,552 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDisk.dll
MOD - [2012.04.17 15:05:00 | 000,103,936 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\OutputLog.dll
MOD - [2012.04.17 15:05:00 | 000,094,208 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync 3.0\fdHttpd.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012.08.06 12:24:22 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2012.07.28 04:09:44 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Running] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.08 20:30:20 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 20:30:19 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.09.15 13:06:04 | 000,088,576 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2011.07.19 23:29:11 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2010.10.13 12:41:06 | 000,487,280 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Programme\Tablet\Pen\Pen_TouchService.exe -- (TouchServicePen)
SRV - [2010.10.13 12:41:04 | 005,790,064 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Programme\Tablet\Pen\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.28 06:07:44 | 010,278,912 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2012.07.28 06:07:44 | 010,278,912 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012.07.28 03:14:46 | 000,368,640 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012.05.14 08:12:30 | 000,096,896 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2012.05.08 20:30:20 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.08 20:30:20 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.10.11 15:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.10.05 14:26:10 | 000,018,288 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV:64bit: - [2010.10.05 14:26:00 | 000,016,168 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacomvhid.sys -- (wacomvhid)
DRV:64bit: - [2010.06.25 16:08:10 | 000,036,928 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\htcnprot.sys -- (htcnprot)
DRV:64bit: - [2010.02.18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2009.11.01 19:16:50 | 000,033,736 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys -- (HTCAND64)
DRV:64bit: - [2009.08.23 16:02:30 | 000,120,336 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009.07.14 02:01:09 | 000,679,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xnacc.sys -- (xnacc)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.04.08 14:28:46 | 000,068,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2007.12.06 09:51:00 | 000,391,680 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk60x64.sys -- (yukonx64)
DRV:64bit: - [2007.02.16 21:12:36 | 000,012,848 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2012.03.05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.1)
DRV - [2012.03.05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5A 51 FF 0E E6 E0 CC 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.deviantart.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_257.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Firefox\components [2012.08.21 23:14:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Firefox\plugins [2012.06.07 19:34:01 | 000,000,000 | ---D | M]
 
[2010.08.27 20:31:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Katy\AppData\Roaming\mozilla\Extensions
[2012.05.02 20:10:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Katy\AppData\Roaming\mozilla\Firefox\Profiles\5bhpqnng.default\extensions
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [HydraVisionDesktopManager] C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (AMD)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab (Java Plug-in 10.6.2)
O16 - DPF: {CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab (Java Plug-in 1.7.0_06)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CBA6CA7F-ACF3-4649-B7F5-42B2E64EBE49}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (UserInit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{6db9ea40-b303-11e1-b0e7-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{6db9ea40-b303-11e1-b0e7-806e6f6e6963}\Shell\AutoRun\command - "" = F:\autorun.exe -auto
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.22 10:37:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA
[2012.08.22 10:31:41 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Katy\Desktop\OTL.exe
[2012.08.22 09:35:37 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.08.22 07:19:43 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.08.22 07:19:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.08.22 07:19:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2012.08.21 23:32:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.08.21 23:31:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.07.28 05:43:12 | 000,070,144 | ---- | C] (AMD) -- C:\Windows\SysNative\coinst_8.982.dll
[2012.07.28 04:10:34 | 000,534,528 | ---- | C] (AMD) -- C:\Windows\SysNative\atieclxx.exe
[2012.07.28 04:09:44 | 000,239,616 | ---- | C] (AMD) -- C:\Windows\SysNative\atiesrxx.exe
[2012.07.28 04:08:20 | 000,120,320 | ---- | C] (AMD) -- C:\Windows\SysNative\atitmm64.dll
[2012.07.28 04:08:04 | 000,021,504 | ---- | C] (AMD) -- C:\Windows\SysNative\atimuixx.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.22 10:45:39 | 001,642,148 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.22 10:45:39 | 000,707,300 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.22 10:45:39 | 000,660,918 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.22 10:45:39 | 000,152,892 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.22 10:45:39 | 000,125,108 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.22 10:39:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.22 10:39:53 | 3219,791,872 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.22 10:38:59 | 000,000,020 | ---- | M] () -- C:\Users\Katy\defogger_reenable
[2012.08.22 10:37:17 | 000,000,728 | ---- | M] () -- C:\Users\Public\Desktop\Star Wars - The Old Republic.lnk
[2012.08.22 10:31:45 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Katy\Desktop\OTL.exe
[2012.08.22 10:22:11 | 000,050,477 | ---- | M] () -- C:\Users\Katy\Desktop\Defogger.exe
[2012.08.22 09:44:11 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.22 09:44:11 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.21 23:14:37 | 000,000,845 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.08.15 20:06:55 | 000,441,776 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.28 05:43:12 | 000,070,144 | ---- | M] (AMD) -- C:\Windows\SysNative\coinst_8.982.dll
[2012.07.28 04:17:00 | 000,268,728 | ---- | M] () -- C:\Windows\SysWow64\atiapfxx.blb
[2012.07.28 04:17:00 | 000,268,728 | ---- | M] () -- C:\Windows\SysNative\atiapfxx.blb
[2012.07.28 04:10:34 | 000,534,528 | ---- | M] (AMD) -- C:\Windows\SysNative\atieclxx.exe
[2012.07.28 04:09:44 | 000,239,616 | ---- | M] (AMD) -- C:\Windows\SysNative\atiesrxx.exe
[2012.07.28 04:08:20 | 000,120,320 | ---- | M] (AMD) -- C:\Windows\SysNative\atitmm64.dll
[2012.07.28 04:08:04 | 000,021,504 | ---- | M] (AMD) -- C:\Windows\SysNative\atimuixx.dll
[2012.07.28 03:39:50 | 003,150,560 | ---- | M] () -- C:\Windows\SysNative\atiumd6a.cap
[2012.07.28 03:30:54 | 003,187,136 | ---- | M] () -- C:\Windows\SysWow64\atiumdva.cap
[2012.07.27 22:47:40 | 000,187,392 | ---- | M] () -- C:\Windows\SysNative\clinfo.exe
 
========== Files Created - No Company Name ==========
 
[2012.08.22 10:38:59 | 000,000,020 | ---- | C] () -- C:\Users\Katy\defogger_reenable
[2012.08.22 10:37:17 | 000,000,728 | ---- | C] () -- C:\Users\Public\Desktop\Star Wars - The Old Republic.lnk
[2012.08.22 10:22:08 | 000,050,477 | ---- | C] () -- C:\Users\Katy\Desktop\Defogger.exe
[2012.07.28 04:17:00 | 000,268,728 | ---- | C] () -- C:\Windows\SysWow64\atiapfxx.blb
[2012.07.28 04:17:00 | 000,268,728 | ---- | C] () -- C:\Windows\SysNative\atiapfxx.blb
[2012.07.28 03:39:50 | 003,150,560 | ---- | C] () -- C:\Windows\SysNative\atiumd6a.cap
[2012.07.28 03:30:54 | 003,187,136 | ---- | C] () -- C:\Windows\SysWow64\atiumdva.cap
[2012.07.27 22:47:40 | 000,187,392 | ---- | C] () -- C:\Windows\SysNative\clinfo.exe
[2012.05.30 19:44:51 | 000,007,597 | ---- | C] () -- C:\Users\Katy\AppData\Local\Resmon.ResmonCfg
[2012.03.09 17:17:36 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.03.09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.11.11 12:23:09 | 000,000,058 | ---- | C] () -- C:\Users\Katy\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.07.19 23:29:12 | 000,281,656 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.07.19 23:29:11 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.01.12 18:33:11 | 000,000,092 | ---- | C] () -- C:\Users\Katy\AppData\Local\fusioncache.dat
[2011.01.12 18:32:19 | 001,619,106 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.08.27 22:22:14 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
 
========== LOP Check ==========
 
[2011.06.27 21:02:07 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\Anthropics
[2012.06.10 15:52:49 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\DAEMON Tools Lite
[2011.11.11 12:23:09 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\DonationCoder
[2012.01.03 16:19:42 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\FileZilla
[2011.06.02 17:53:46 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\GetRightToGo
[2011.07.30 20:31:29 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\Hi-Rez Studios
[2012.01.20 16:40:43 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\HTC
[2011.08.08 17:16:24 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012.05.07 15:58:24 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\JavaEditor
[2010.12.10 23:11:47 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\SYSTEMAX Software Development
[2012.04.24 15:08:30 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\TS3Client
[2010.12.10 23:59:40 | 000,000,000 | ---D | M] -- C:\Users\Katy\AppData\Roaming\WTouch
[2012.08.02 17:43:39 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         

OTL Extras logfile created on: 22.08.2012 10:41:27 - Run 1
OTL by OldTimer - Version 3.2.58.1     Folder = C:\Users\Katy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,65 Gb Available Physical Memory | 66,19% Memory free
7,99 Gb Paging File | 6,17 Gb Available in Paging File | 77,21% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,73 Gb Total Space | 15,61 Gb Free Space | 32,04% Space Free | Partition Type: NTFS
Drive D: | 547,34 Gb Total Space | 352,41 Gb Free Space | 64,39% Space Free | Partition Type: NTFS
Drive G: | 100,00 Mb Total Space | 71,85 Mb Free Space | 71,85% Space Free | Partition Type: NTFS
 
Computer Name: KATY-PC | User Name: Katy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1763FD82-3B35-4D26-91DF-A2E07AF254C0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{25B26AA2-1E93-48F7-A8E8-C19A27703A87}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{3910293C-E730-41A4-9737-3B4C241B8D25}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{49105213-B111-440F-9463-AFE5B286D1DA}" = rport=138 | protocol=17 | dir=out | app=system | 
"{4F1F85F0-2767-41B3-8715-EBF8359637E8}" = lport=138 | protocol=17 | dir=in | app=system | 
"{524FBC5E-3361-4215-A679-A1302C9EFA19}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{52A2DC20-903F-4C90-91A4-2D275BFD775B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{542C4201-C340-4F3A-8450-EDD9762C0FED}" = lport=137 | protocol=17 | dir=in | app=system | 
"{5C72FFC2-1CD3-4EBF-BF77-B2210678252B}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{5F53796D-3E8B-417A-A615-48624C4A9BB9}" = rport=139 | protocol=6 | dir=out | app=system | 
"{5F80A605-6564-48C9-91BB-F457E072DB1F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{7E6D75CE-CA04-4089-83BD-51071BD70CF9}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{8D2AC020-FE20-4A2C-AFA1-D5AC63E8D254}" = lport=445 | protocol=6 | dir=in | app=system | 
"{8FE87BF9-9309-40CB-AFDD-FC1B180B7494}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{A533751C-63C4-4E81-83D6-B869A575EA06}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{BF765ADC-AA6B-4C26-AEA0-CAF3C28033B2}" = rport=445 | protocol=6 | dir=out | app=system | 
"{C8CD3668-6F64-4052-B35C-CA2E0E778F7C}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{CB704DA3-341F-4A76-B3DC-70FC4F39951C}" = rport=137 | protocol=17 | dir=out | app=system | 
"{D2766950-EACC-434E-8F2A-E9F4D477B109}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{F03B9546-E034-431D-B36F-7EE9CAA7B15C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{F0E4EEB8-FF27-44BE-AFDE-9B48B1F7DDCA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{FBD13777-49F2-4E19-9C66-DD97B8616144}" = lport=139 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{035F0B1D-BE19-4B78-879F-EBF4176F8F92}" = protocol=6 | dir=in | app=d:\games\mass effect 2\masseffect2launcher.exe | 
"{081142B4-2992-4E49-9411-5C0810E83065}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{09E69922-141E-415D-B2AC-71A17A39BF4E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{16894D30-1549-4907-803D-D2764E55126F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{1D114714-9B7C-429D-8267-EC5B27B385F2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{26573D69-FDCF-4C0C-955C-C404FAB3C37E}" = protocol=6 | dir=in | app=d:\games\mass effect 3\binaries\win32\masseffect3.exe | 
"{27D71DB6-951E-440B-BD6B-621AFA0DD386}" = protocol=6 | dir=in | app=d:\games\wow ptr\world of warcraft public test\launcher.patch.exe | 
"{27F5CDF4-E26F-4B29-A2EC-572A78CE985A}" = protocol=6 | dir=in | app=d:\games\mass effect\masseffectlauncher.exe | 
"{2A780362-9599-4E97-BB16-56933BE5BA43}" = protocol=6 | dir=in | app=d:\games\apb reloaded\binaries\apb.exe | 
"{2C7B6843-F2DB-4D71-B7FA-D30FB6580D24}" = protocol=6 | dir=in | app=d:\games\mass effect 2\binaries\masseffect2.exe | 
"{3077EBB8-8BBE-4522-BC5F-F2970FF5A23D}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{31E2A5B7-D00A-45D7-95B2-892B3C74E17E}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{3693CC5F-3769-494C-87F5-C7FA7CA60225}" = protocol=17 | dir=in | app=d:\games\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-dede-downloader.exe | 
"{42EC1808-E913-4EAD-A20F-1CC0424880CB}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{480EC606-EABE-4F0F-8000-6E783FAAFFDC}" = protocol=17 | dir=in | app=d:\games\star wars-the old republic\launcher.exe | 
"{4880B33F-C791-490B-8D3A-362F12C7AF6D}" = protocol=17 | dir=in | app=d:\games\mass effect\binaries\masseffect.exe | 
"{5144750E-8EA0-4D39-A748-1E688F12ED9D}" = protocol=6 | dir=in | app=d:\games\mass effect\binaries\masseffect.exe | 
"{5726560C-6E55-4617-95DA-213A60E653A4}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{5885F546-ED14-4BC2-8FF2-D5DC03320B50}" = protocol=17 | dir=in | app=d:\games\apb reloaded\binaries\apb.exe | 
"{5B4045CD-863C-4A43-9BA4-4C3DE887ED4F}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{5D46EEEC-8159-4F1A-8F63-31C227784E64}" = protocol=6 | dir=in | app=d:\games\vindictus\vindictus eu\en-eu\nmservice.exe | 
"{61FD02FD-7252-45EF-A28A-D39842822C03}" = protocol=17 | dir=in | app=d:\games\wow ptr\world of warcraft public test\launcher.patch.exe | 
"{6231D483-9ADB-4BE1-A9F1-CCA6EECB78EF}" = protocol=6 | dir=in | app=d:\games\star wars-the old republic\launcher.exe | 
"{650E3D75-2D61-4174-A809-23AD4507F47F}" = protocol=6 | dir=in | app=d:\games\world of warcraft\launcher.patch.exe | 
"{67E0FBE7-1670-4C84-A2CB-A345C41EED29}" = protocol=17 | dir=in | app=d:\games\mass effect 2\binaries\masseffect2.exe | 
"{68A52CA0-FA9A-4EFC-A8D9-51C1212408BD}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{6BA9251C-FEDD-4148-81DF-61495EAD00EA}" = protocol=6 | dir=in | app=d:\games\apb reloaded\binaries\vivoxvoiceservice.exe | 
"{70A243E0-7AC8-4F48-8C96-52DAEF88BC89}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{75BBFDDD-701A-429C-9259-DDDE29F862D9}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{77339CF2-AFB8-47B3-835F-82FDC3F0882D}" = protocol=17 | dir=in | app=d:\games\star wars-the old republic\swtor\retailclient\swtor.exe | 
"{78FBE1E2-574E-4C3B-8F50-8C9D6DC30A30}" = protocol=6 | dir=in | app=d:\games\star wars-the old republic\swtor\retailclient\swtor.exe | 
"{7A01109E-FC4D-435E-83EE-0EC4F35B25E8}" = protocol=17 | dir=in | app=d:\games\star wars-the old republic\swtor\retailclient\swtor.exe | 
"{7D6D5486-0FBA-4D14-9057-FB1DF12DA884}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{7DF26D81-DC3C-48D3-9A2B-D724199CF7A5}" = protocol=17 | dir=in | app=d:\games\mass effect 2\masseffect2launcher.exe | 
"{7FEDD36B-FA1B-44D7-BBBA-840F9244ECDA}" = protocol=17 | dir=in | app=d:\games\apb reloaded\binaries\vivoxvoiceservice.exe | 
"{8695D18C-2241-49D3-9A77-A357EFB356A6}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{86A21776-0926-43EA-B7C5-6FC40E64E883}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{8B50B558-5BA6-4DA3-81F0-E0A40E283976}" = protocol=17 | dir=in | app=d:\games\vindictus\vindictus eu\en-eu\nmservice.exe | 
"{8D0C3C22-2070-4D0F-9685-4C10EF3DAA58}" = protocol=6 | dir=in | app=d:\games\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-dede-downloader.exe | 
"{8E6E994D-B3F8-46CA-9C5E-3FBF4B78B033}" = protocol=6 | dir=in | app=d:\steam\steam.exe | 
"{A444045D-8FEB-4C3E-AB18-825E1133FBEA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A4F71EC0-3C48-45FC-99E1-41AFFA50304D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{ACB93E25-B672-4951-A39C-2B372859318C}" = protocol=17 | dir=in | app=d:\games\star wars-the old republic\launcher.exe | 
"{ADDD67E5-63B4-4D7F-8BC2-03C977DCC6C8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{B1601759-13F1-4652-BD66-A68677613B04}" = protocol=17 | dir=in | app=d:\games\mass effect\masseffectlauncher.exe | 
"{B1E9F062-956C-4919-9990-B37386298C3A}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\amd driver updater, vista and 7, 64 bit\setup.exe | 
"{B708FF81-2D3A-4B1C-BB31-678AA759D450}" = protocol=17 | dir=in | app=d:\games\world of warcraft\launcher.patch.exe | 
"{B78F4ED6-206E-435D-9713-0FFF4A169A63}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{BA368C79-F315-47A0-AA1A-D39E523E1AD5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{C481E99D-4EC0-43CB-9C29-5C4F9BAEEE4B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{CC1A24D0-8E17-4FA4-B711-3AD55C8DED87}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{CE529B8E-2761-4D4A-B185-9FB36EA1034A}" = protocol=17 | dir=in | app=d:\steam\steam.exe | 
"{D2AF5069-4653-4E83-9B74-1FA0C471E166}" = protocol=17 | dir=in | app=d:\games\wow ptr\world of warcraft public test\launcher.exe | 
"{D4A2677B-A6A7-49C1-8197-0308FCAD27C0}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{DED0F02C-6666-4AD6-922B-804F188F07CC}" = protocol=6 | dir=out | app=system | 
"{E44F00F3-1D30-4838-BC52-2997118083FC}" = protocol=6 | dir=in | app=d:\games\wow ptr\world of warcraft public test\launcher.exe | 
"{E8083241-0117-41FE-BE27-818BE586A3BB}" = protocol=6 | dir=in | app=d:\games\star wars-the old republic\swtor\retailclient\swtor.exe | 
"{E93E8B3B-3117-43E7-BBDB-6B944F303850}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{E9CDF5A6-34B2-4755-9537-C2CE32E8A7BD}" = protocol=17 | dir=in | app=d:\games\mass effect 3\binaries\win32\masseffect3.exe | 
"{F3B47E45-CA20-4C5F-983D-18CA1C20D23B}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\amd driver updater, vista and 7, 64 bit\setup.exe | 
"{F4F5F614-B6EB-4592-A7DE-91BA41D1F244}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F69FBDB3-69A9-4C44-8C93-3C613DD65600}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{F7063B05-A3C6-4DD8-9D05-1D97D1ACF1ED}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{FFB82FF7-CE4A-4122-BBB1-C001DDBCB0EB}" = protocol=6 | dir=in | app=d:\games\star wars-the old republic\launcher.exe | 
"TCP Query User{104C2087-BD81-4F69-89F3-C8945F544FF8}D:\games\world of warcraft\temp\wow-4.0.0.2104-enus-tools-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\temp\wow-4.0.0.2104-enus-tools-downloader.exe | 
"TCP Query User{10BBD97B-3754-498A-ABD7-CBB95E4FEAE9}D:\games\metin2\metin2.bin" = protocol=6 | dir=in | app=d:\games\metin2\metin2.bin | 
"TCP Query User{121D0865-6AB6-4560-BD54-F35A718A04CA}D:\games\world of warcraft\repair.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\repair.exe | 
"TCP Query User{145EFA15-303C-4E3A-A39F-22D5D4B760C2}D:\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\launcher.exe | 
"TCP Query User{17005798-2158-40BF-9C0A-EB186006F3BD}D:\games\world of warcraft\temp\wow-4.0.0.1807-to-4.0.0.2072-enus-tools-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\temp\wow-4.0.0.1807-to-4.0.0.2072-enus-tools-downloader.exe | 
"TCP Query User{23078BFF-EAD7-4B4A-BC16-B86A0B140EF4}D:\games\vindictus\vindictus eu\en-eu\vindictus.exe" = protocol=6 | dir=in | app=d:\games\vindictus\vindictus eu\en-eu\vindictus.exe | 
"TCP Query User{2563D103-6AD1-4013-BFA9-BE5F43223296}D:\games\jka\gamedata\jamp.exe" = protocol=6 | dir=in | app=d:\games\jka\gamedata\jamp.exe | 
"TCP Query User{29E798EE-8C68-4C29-B556-D64C418B6B66}D:\games\kotf jedi academy expansion pack\gamedata\jamp.exe" = protocol=6 | dir=in | app=d:\games\kotf jedi academy expansion pack\gamedata\jamp.exe | 
"TCP Query User{315B5CBA-878A-43FB-BEB8-B71C8E0C2ACD}D:\games\witcher2\bin\witcher2.exe" = protocol=6 | dir=in | app=d:\games\witcher2\bin\witcher2.exe | 
"TCP Query User{33F5A755-A675-45CC-A9B9-4D924E6862F4}C:\program files (x86)\jawa\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\jawa\bin\javaw.exe | 
"TCP Query User{45E721ED-4273-4E0F-A4B5-D3D0FF2E7474}D:\games\world of warcraft\wow-2.1.1.1897-engb-tools-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\wow-2.1.1.1897-engb-tools-downloader.exe | 
"TCP Query User{482AEE91-7D14-490A-8829-9A006A137342}D:\games\metin2\metin2client.bin" = protocol=6 | dir=in | app=d:\games\metin2\metin2client.bin | 
"TCP Query User{58838A92-FB56-4950-9D88-702AB43DF51B}C:\program files\icq7.4\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"TCP Query User{5CD1B907-6B55-437E-8FDF-327DDD0CC5CE}D:\games\star wars-the old republic\betatest\retailclient\swtor.exe" = protocol=6 | dir=in | app=d:\games\star wars-the old republic\betatest\retailclient\swtor.exe | 
"TCP Query User{7A8A15ED-C7C5-49F1-A084-6BD9A23F0651}C:\users\katy\downloads\ptr-installer-4.0.0.12824-dede-downloader.exe" = protocol=6 | dir=in | app=c:\users\katy\downloads\ptr-installer-4.0.0.12824-dede-downloader.exe | 
"TCP Query User{80EA5CC3-56F4-43AA-9909-A599FAA8D30B}D:\games\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\backgrounddownloader.exe | 
"TCP Query User{81D11BE1-3785-442F-9F46-12A17CFAF774}D:\games\wow ptr\world of warcraft public test\blizzard downloader.exe" = protocol=6 | dir=in | app=d:\games\wow ptr\world of warcraft public test\blizzard downloader.exe | 
"TCP Query User{841CDE95-BBF4-4610-A5F8-DFC430121C90}D:\games\world of warcraft\temp\wow-4.0.1.2120-enus-tools-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\temp\wow-4.0.1.2120-enus-tools-downloader.exe | 
"TCP Query User{8C8DFB0B-6D0D-4FE0-B26D-704F1C250E8C}D:\games\world of warcraft\temp\wow-4.1.0.2346-enus-tools-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\temp\wow-4.1.0.2346-enus-tools-downloader.exe | 
"TCP Query User{8E40214D-D365-449D-ACD2-FA0502582F62}D:\games\world of warcraft\temp\wow-4.0.0.1807-to-4.0.0.1987-enus-tools-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\temp\wow-4.0.0.1807-to-4.0.0.1987-enus-tools-downloader.exe | 
"TCP Query User{B2F540ED-B6D1-42B0-944E-1C1A9CBCFB88}D:\games\world of warcraft\temp\wow-4.1.0.2317-enus-tools-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\temp\wow-4.1.0.2317-enus-tools-downloader.exe | 
"TCP Query User{B56D651D-23E7-459F-B09F-E75E0E2A9803}D:\games\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe | 
"TCP Query User{B5F3FA0C-7F1B-4437-A73C-CC8B4AAF89CE}D:\games\world of warcraft\blizzard downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\blizzard downloader.exe | 
"TCP Query User{B7119AB5-1CCE-4B33-B0AD-10BFE6B95B4C}D:\games\world of warcraft\wow-3.2.0.10192-to-3.3.0.10958-dede-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\wow-3.2.0.10192-to-3.3.0.10958-dede-downloader.exe | 
"TCP Query User{B7F08E18-F95D-4FFE-8B9C-B0C000AD2B81}D:\games\hdro\lotroclient.exe" = protocol=6 | dir=in | app=d:\games\hdro\lotroclient.exe | 
"TCP Query User{C9FAED2C-571A-43BA-A1F9-323E613FC7BD}D:\steam\steamapps\common\global agenda live\binaries\globalagenda.exe" = protocol=6 | dir=in | app=d:\steam\steamapps\common\global agenda live\binaries\globalagenda.exe | 
"TCP Query User{CDE52C40-A15A-43C1-9B05-BA10D862342E}D:\games\world of warcraft\temp\wow-4.0.1.2210-enus-tools-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\temp\wow-4.0.1.2210-enus-tools-downloader.exe | 
"TCP Query User{DF615BB4-19E3-481B-9FB8-B913CC9AF1CB}D:\games\world of warcraft\wow-3.3.5.12340-x86-win-dede-bkgnd-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\wow-3.3.5.12340-x86-win-dede-bkgnd-downloader.exe | 
"TCP Query User{EFE6928E-4E57-424A-8430-31C3BCF6583F}D:\games\world of warcraft\temp\wow-4.2.0.2506-enus-tools-downloader.exe" = protocol=6 | dir=in | app=d:\games\world of warcraft\temp\wow-4.2.0.2506-enus-tools-downloader.exe | 
"UDP Query User{1924681D-43AD-4C16-8778-5CE280CAFC21}D:\games\star wars-the old republic\betatest\retailclient\swtor.exe" = protocol=17 | dir=in | app=d:\games\star wars-the old republic\betatest\retailclient\swtor.exe | 
"UDP Query User{2128E111-CBAB-4E49-B451-308EBFFEA8F5}D:\games\world of warcraft\temp\wow-4.0.0.1807-to-4.0.0.1987-enus-tools-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\temp\wow-4.0.0.1807-to-4.0.0.1987-enus-tools-downloader.exe | 
"UDP Query User{289A409A-650F-4284-BD88-1E3F1DF3D2D6}D:\games\hdro\lotroclient.exe" = protocol=17 | dir=in | app=d:\games\hdro\lotroclient.exe | 
"UDP Query User{4A794A67-D285-49A2-ADAE-6C8AF2C455F4}D:\games\wow ptr\world of warcraft public test\blizzard downloader.exe" = protocol=17 | dir=in | app=d:\games\wow ptr\world of warcraft public test\blizzard downloader.exe | 
"UDP Query User{4E008E77-3668-49CD-8A9B-48128176F52B}D:\games\world of warcraft\repair.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\repair.exe | 
"UDP Query User{56D66A03-CD8D-4AA7-84F3-ECEFF890980C}D:\games\world of warcraft\wow-2.1.1.1897-engb-tools-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\wow-2.1.1.1897-engb-tools-downloader.exe | 
"UDP Query User{635C05D2-741E-4E96-A420-C8EAB84E8137}C:\program files\icq7.4\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"UDP Query User{6B393F73-25F5-466A-9DF9-7BA0F8512FA9}D:\games\world of warcraft\wow-3.2.0.10192-to-3.3.0.10958-dede-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\wow-3.2.0.10192-to-3.3.0.10958-dede-downloader.exe | 
"UDP Query User{6D82D6C0-A4B9-494C-9592-BC50EF174B92}D:\games\world of warcraft\blizzard downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\blizzard downloader.exe | 
"UDP Query User{6FD23EA0-DD70-4D6A-8F0E-E4E09804B59F}D:\games\witcher2\bin\witcher2.exe" = protocol=17 | dir=in | app=d:\games\witcher2\bin\witcher2.exe | 
"UDP Query User{8566D9CB-3B1C-46A3-9C19-DAC6CDC0A848}D:\games\vindictus\vindictus eu\en-eu\vindictus.exe" = protocol=17 | dir=in | app=d:\games\vindictus\vindictus eu\en-eu\vindictus.exe | 
"UDP Query User{8742D1EA-5937-4323-89BD-CC8347302B15}D:\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\launcher.exe | 
"UDP Query User{8AD03A67-2192-4911-B787-6E7D6EB61515}D:\games\world of warcraft\temp\wow-4.0.1.2210-enus-tools-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\temp\wow-4.0.1.2210-enus-tools-downloader.exe | 
"UDP Query User{8F672903-4D18-4F7F-BE45-266128E98B11}D:\games\kotf jedi academy expansion pack\gamedata\jamp.exe" = protocol=17 | dir=in | app=d:\games\kotf jedi academy expansion pack\gamedata\jamp.exe | 
"UDP Query User{9357CB60-F502-4C43-8357-3ABC49581AF9}D:\games\world of warcraft\wow-3.3.5.12340-x86-win-dede-bkgnd-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\wow-3.3.5.12340-x86-win-dede-bkgnd-downloader.exe | 
"UDP Query User{974876EF-A55D-42E6-892D-77169504C5EE}D:\games\metin2\metin2client.bin" = protocol=17 | dir=in | app=d:\games\metin2\metin2client.bin | 
"UDP Query User{9E70E515-1D1D-482A-9B34-C8CB9C7643BB}C:\program files (x86)\jawa\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\jawa\bin\javaw.exe | 
"UDP Query User{A5CD6776-2E78-4362-B9B0-15AA946C2219}C:\users\katy\downloads\ptr-installer-4.0.0.12824-dede-downloader.exe" = protocol=17 | dir=in | app=c:\users\katy\downloads\ptr-installer-4.0.0.12824-dede-downloader.exe | 
"UDP Query User{A835BDAF-8D64-4E4D-B11C-C1C2ADE8BED1}D:\steam\steamapps\common\global agenda live\binaries\globalagenda.exe" = protocol=17 | dir=in | app=d:\steam\steamapps\common\global agenda live\binaries\globalagenda.exe | 
"UDP Query User{B78B8B1D-EB75-442C-BA64-E62612F52873}D:\games\metin2\metin2.bin" = protocol=17 | dir=in | app=d:\games\metin2\metin2.bin | 
"UDP Query User{D3D6A04A-5DAA-4166-BF7E-7D12525CEF00}D:\games\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe | 
"UDP Query User{D547E803-880F-4C5B-9E93-616B9B9704ED}D:\games\world of warcraft\temp\wow-4.0.0.1807-to-4.0.0.2072-enus-tools-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\temp\wow-4.0.0.1807-to-4.0.0.2072-enus-tools-downloader.exe | 
"UDP Query User{D697C503-86BC-45C7-A4C4-44C7D8258290}D:\games\jka\gamedata\jamp.exe" = protocol=17 | dir=in | app=d:\games\jka\gamedata\jamp.exe | 
"UDP Query User{D7BDA511-BE16-4E23-9457-4BD05FA27A4B}D:\games\world of warcraft\temp\wow-4.0.1.2120-enus-tools-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\temp\wow-4.0.1.2120-enus-tools-downloader.exe | 
"UDP Query User{DBB3EE38-0171-447B-9119-DCD0388C0066}D:\games\world of warcraft\temp\wow-4.2.0.2506-enus-tools-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\temp\wow-4.2.0.2506-enus-tools-downloader.exe | 
"UDP Query User{DE3BC65C-F44B-41DF-A9B3-15F7496D204E}D:\games\world of warcraft\temp\wow-4.1.0.2346-enus-tools-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\temp\wow-4.1.0.2346-enus-tools-downloader.exe | 
"UDP Query User{E78F93FE-0355-4FA9-ADF5-AE0DF58C672D}D:\games\world of warcraft\temp\wow-4.1.0.2317-enus-tools-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\temp\wow-4.1.0.2317-enus-tools-downloader.exe | 
"UDP Query User{F18C364D-E76C-4A6F-BA53-05226D05A4F7}D:\games\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\backgrounddownloader.exe | 
"UDP Query User{F243ADA3-A4E2-49EB-9AF2-9C10D52289B9}D:\games\world of warcraft\temp\wow-4.0.0.2104-enus-tools-downloader.exe" = protocol=17 | dir=in | app=d:\games\world of warcraft\temp\wow-4.0.0.2104-enus-tools-downloader.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{089E65D5-D06A-FE49-8D9C-9CABDF8858F5}" = ccc-utility64
"{0991D3E2-736E-4674-8C78-5E4AF3B9DD63}" = World of Warcraft Model Viewer 64-bit
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{119B2F5A-2A06-DB96-FF28-992EC2A10BDF}" = AMD Accelerated Video Transcoding
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{503640E5-B2ED-3173-D109-D4D03153471A}" = AMD Drag and Drop Transcoding
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6DB97EF8-603B-FB96-9B56-6F0D23E14263}" = AMD Media Foundation Decoders
"{717690AA-0C4B-1E11-F13B-D737E230B8CD}" = ATI Problem Report Wizard
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8E311AD5-3CC4-23CE-02C1-FBDAE91707E7}" = ATI AVIVO64 Codecs
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{D10B35A6-786F-2879-DC2F-EBBD735E51B8}" = AMD Fuel
"{DA2737A4-B639-96F4-1CC2-30D2919EE1FB}" = AMD Steady Video Plug-In 
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F4C71C2A-F068-8EEB-61AE-EA4707C57A1B}" = AMD Catalyst Install Manager
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Pen Tablet Driver" = Bamboo
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0CE6E094-B07B-CC6B-F7FD-9D7BD7BE0D86}" = CCC Help Thai
"{10EBB586-D21E-60CA-0856-AA753EBE1F16}" = Application Profiles
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}" = Mass Effect
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217006FF}" = Java 7 Update 6
"{2A9A40C7-6670-4D5F-8F41-D12E2E08B48B}" = Star Wars(TM): Knights of the Old Republic (TM)
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{3857A262-3B88-127A-96DB-5317B0F9B78C}" = CCC Help Dutch
"{3993DBF6-32F6-488B-9009-E156075AF7B7}" = CCC Help Greek
"{3A090DC5-ADF9-6B83-1095-017754BEC3D0}" = CCC Help Finnish
"{3B11D799-48E0-48ED-BFD7-EA655676D8BB}" = Star Wars: The Old Republic
"{3BCD05CE-8CDE-9503-8794-D8CDB9FA8562}" = Catalyst Control Center InstallProxy
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{59FB1BE3-155C-72B1-B5F6-B086DEB7D064}" = CCC Help Hungarian
"{5EEA2FBB-1AAF-56D0-C2E5-580ACEA4DED5}" = CCC Help Russian
"{65FBA21B-7F80-4E4E-B275-0958D2648F94}_is1" = Java-Editor 11.13, 2012.04.22
"{6A9D1594-7791-48f5-9CAA-DE9BCB968320}" = Mass Effect™ 3
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{7106B820-2071-2B46-7817-5F6ADD1FA112}" = CCC Help Polish
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{725B5F90-BD27-A74D-7685-48795904FCF3}" = CCC Help Japanese
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78887CA0-E5F1-3C99-B120-95310B217AB8}" = CCC Help French
"{82892947-1311-D6CA-8B79-2753E398FE32}" = CCC Help German
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{855E0BF8-5448-9681-B36E-B84029D355E4}" = CCC Help Danish
"{85E00941-FDFF-4796-A3B8-3ACC766FFCA5}" = Topaz Clean 3
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9090E44B-CFBA-47D4-2225-3037C539E7E9}" = Catalyst Control Center Graphics Previews Common
"{90DCE328-65D6-0CC0-14FF-A86D6EC57035}" = CCC Help Chinese Traditional
"{91C3236F-645F-52FD-6A83-A4CE5EE8028D}" = CCC Help Czech
"{92482FB3-C05B-41C6-89E7-75D985602A6E}" = System Requirements Lab
"{943A7AF0-C019-0CFB-BA79-F063E7980B25}" = AMD VISION Engine Control Center
"{9530AE42-DAE1-4619-9594-B23487285D17}" = NVIDIA PhysX
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A6CF1995-854B-0B57-BF9D-AD665C52493C}" = CCC Help Chinese Standard
"{AB0670D8-C462-750A-D34D-F18D38C0D64E}" = CCC Help Swedish
"{AB77DFDE-9949-4AEF-B180-BE322C3E65D0}" = HTC Sync
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AD59DD0E-E36C-9FF1-2F22-ADFA10A43D61}" = CCC Help Italian
"{C1C7818F-8270-BA45-D317-675187B9E33E}" = CCC Help Korean
"{C4F98C5C-69EC-34D5-45B6-9CF4AD8FCDFD}" = HydraVision
"{C9115BBB-C00B-481A-FD6A-C2BCDC88D6A1}" = CCC Help Turkish
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{E100AC00-5097-16FE-E007-3D5156FC2B93}" = CCC Help Portuguese
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E3AA13F6-F494-D77F-C678-B8E6F8B66448}" = CCC Help Spanish
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E56685FB-BC75-3BC4-526A-15FD1278F174}" = Catalyst Control Center Localization All
"{ECA16F5B-C5FD-2021-09B1-CA7CB49FDF46}" = CCC Help Norwegian
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EF2586BE-6016-DBED-06AB-569B429893A1}" = CCC Help English
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"DAEMON Tools Lite" = DAEMON Tools Lite
"FileZilla Client" = FileZilla Client 3.5.2
"Fraps" = Fraps (remove only)
"Intelli-studio" = SAMSUNG Intelli-studio
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Pen Tablet Driver" = Bamboo
"VLC media player" = VLC media player 1.1.11
"World of Warcraft" = World of Warcraft
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"090215de958f1060" = Curse Client
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.06.2012 08:38:17 | Computer Name = Katy-PC | Source = Application Hang | ID = 1002
Description = Programm Word.exe, Version 12.0.6504.5000 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 1308    Startzeit:
 01cd4ee034a5ed15    Endzeit: 18    Anwendungspfad: D:\Images\PortableOffice2007\PortableOffice2007\Word.exe

Berichts-ID:
 c8539a4b-bad4-11e1-baa4-0013469931f3  
 
Error - 20.06.2012 13:58:37 | Computer Name = Katy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_3_300_257.exe,
 Version: 11.3.300.257, Zeitstempel: 0x4fc82063  Name des fehlerhaften Moduls: NPSWF32_11_3_300_257.dll,
 Version: 11.3.300.257, Zeitstempel: 0x4fc821fc  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x0016b4ac  ID des fehlerhaften Prozesses: 0xf8c  Startzeit der fehlerhaften Anwendung:
 0x01cd4f00253d0219  Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll
Berichtskennung:
 8ea5966b-bb01-11e1-baa4-0013469931f3
 
Error - 21.06.2012 13:04:27 | Computer Name = Katy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_3_300_257.exe,
 Version: 11.3.300.257, Zeitstempel: 0x4fc82063  Name des fehlerhaften Moduls: NPSWF32_11_3_300_257.dll,
 Version: 11.3.300.257, Zeitstempel: 0x4fc821fc  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x0016b4ac  ID des fehlerhaften Prozesses: 0x894  Startzeit der fehlerhaften Anwendung:
 0x01cd4fce5dcdf916  Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll
Berichtskennung:
 2835647e-bbc3-11e1-8c51-0013469931f3
 
Error - 22.06.2012 08:51:40 | Computer Name = Katy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_3_300_257.exe,
 Version: 11.3.300.257, Zeitstempel: 0x4fc82063  Name des fehlerhaften Moduls: NPSWF32_11_3_300_257.dll,
 Version: 11.3.300.257, Zeitstempel: 0x4fc821fc  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x0016b4bd  ID des fehlerhaften Prozesses: 0x11d4  Startzeit der fehlerhaften Anwendung:
 0x01cd5075019a4324  Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll
Berichtskennung:
 022e9a64-bc69-11e1-aaf4-0013469931f3
 
Error - 24.07.2012 14:05:32 | Computer Name = Katy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_3_300_257.exe,
 Version: 11.3.300.257, Zeitstempel: 0x4fc82063  Name des fehlerhaften Moduls: NPSWF32_11_3_300_257.dll,
 Version: 11.3.300.257, Zeitstempel: 0x4fc821fc  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x001a4b75  ID des fehlerhaften Prozesses: 0xb88  Startzeit der fehlerhaften Anwendung:
 0x01cd69c0865cc175  Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll
Berichtskennung:
 281713b1-d5ba-11e1-9e83-0013469931f3
 
Error - 05.08.2012 12:35:19 | Computer Name = Katy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_3_300_257.exe,
 Version: 11.3.300.257, Zeitstempel: 0x4fc82063  Name des fehlerhaften Moduls: NPSWF32_11_3_300_257.dll,
 Version: 11.3.300.257, Zeitstempel: 0x4fc821fc  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x0016b4bd  ID des fehlerhaften Prozesses: 0xd08  Startzeit der fehlerhaften Anwendung:
 0x01cd7327e0d0fe11  Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll
Berichtskennung:
 8af95ed6-df1b-11e1-968f-0013469931f3
 
Error - 12.08.2012 12:03:02 | Computer Name = Katy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_3_300_257.exe,
 Version: 11.3.300.257, Zeitstempel: 0x4fc82063  Name des fehlerhaften Moduls: NPSWF32_11_3_300_257.dll,
 Version: 11.3.300.257, Zeitstempel: 0x4fc821fc  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x0016b4bd  ID des fehlerhaften Prozesses: 0x280  Startzeit der fehlerhaften Anwendung:
 0x01cd789cfc0e3526  Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll
Berichtskennung:
 310d6bb3-e497-11e1-9c1a-0013469931f3
 
Error - 21.08.2012 17:22:10 | Computer Name = Katy-PC | Source = Application Hang | ID = 1002
Description = Programm avscan.exe, Version 12.3.0.33 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: e40    Startzeit: 
01cd7fe12ca9f917    Endzeit: 60000    Anwendungspfad: C:\Program Files (x86)\Avira\AntiVir
 Desktop\avscan.exe    Berichts-ID: 11fff877-ebd6-11e1-a5a4-0013469931f3  
 
Error - 21.08.2012 18:27:45 | Computer Name = Katy-PC | Source = Application Hang | ID = 1002
Description = Programm Skype.exe, Version 5.10.0.116 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: ff8    Startzeit: 
01cd7fe72f6a9d4b    Endzeit: 31    Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe

Berichts-ID:
 6af06253-ebdf-11e1-90f9-0013469931f3  
 
Error - 22.08.2012 01:54:22 | Computer Name = Katy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_3_300_257.exe,
 Version: 11.3.300.257, Zeitstempel: 0x4fc82063  Name des fehlerhaften Moduls: NPSWF32_11_3_300_257.dll,
 Version: 11.3.300.257, Zeitstempel: 0x4fc821fc  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x0016b4ac  ID des fehlerhaften Prozesses: 0x230  Startzeit der fehlerhaften Anwendung:
 0x01cd802a8718d9ca  Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll
Berichtskennung:
 d1e7f293-ec1d-11e1-bc99-0013469931f3
 
[ System Events ]
Error - 21.08.2012 16:59:37 | Computer Name = Katy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 21.08.2012 17:24:19 | Computer Name = Katy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 21.08.2012 17:51:21 | Computer Name = Katy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 22.08.2012 01:08:50 | Computer Name = Katy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 22.08.2012 01:08:53 | Computer Name = Katy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 22.08.2012 01:17:45 | Computer Name = Katy-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 22.08.2012 03:24:26 | Computer Name = Katy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 22.08.2012 03:36:58 | Computer Name = Katy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 22.08.2012 03:37:00 | Computer Name = Katy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 22.08.2012 04:40:12 | Computer Name = Katy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.1" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
 
< End of report >
         

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.21.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Katy :: GITHY-PC [Administrator]

22.08.2012 14:07:01
mbam-log-2012-08-22 (14-07-01).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 332396
Laufzeit: 45 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)