Firefox stürzt ab und verdächtige Prozesse im Systemstart

OTL logfile created on: 29.08.2012 23:41:52 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Hendrik\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,50 Gb Available Physical Memory | 62,59% Memory free
8,00 Gb Paging File | 6,09 Gb Available in Paging File | 76,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 78,03 Gb Total Space | 45,08 Gb Free Space | 57,77% Space Free | Partition Type: NTFS
Drive D: | 268,55 Gb Total Space | 261,55 Gb Free Space | 97,39% Space Free | Partition Type: NTFS
Drive E: | 119,08 Gb Total Space | 53,96 Gb Free Space | 45,32% Space Free | Partition Type: NTFS
Drive F: | 931,51 Gb Total Space | 276,58 Gb Free Space | 29,69% Space Free | Partition Type: NTFS
Drive I: | 2,38 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: HENDRIK-PC | User Name: Hendrik | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.29 23:41:25 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Hendrik\Downloads\OTL.exe
PRC - [2012.08.24 02:45:44 | 000,529,744 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe
PRC - [2012.08.15 12:31:14 | 001,536,712 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe
PRC - [2012.08.08 17:31:10 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.08.06 12:15:36 | 000,167,424 | ---- | M] () -- C:\Users\Hendrik\AppData\Roaming\Amar\week.exe
PRC - [2012.08.05 16:00:51 | 001,353,080 | ---- | M] (Valve Corporation) -- E:\Spiele\Steam\Steam.exe
PRC - [2012.08.03 21:52:07 | 000,537,592 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
PRC - [2012.08.01 18:03:29 | 000,262,144 | ---- | M] () -- C:\Users\Hendrik\AppData\Roaming\Ehluew\xyla.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.07.14 02:13:42 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.09.21 10:36:04 | 000,608,008 | ---- | M] (PacketVideo) -- C:\Program Files (x86)\TwonkyMedia\twonkymediaserverconfig.exe
PRC - [2011.09.21 10:36:04 | 000,509,704 | ---- | M] (PacketVideo) -- C:\Program Files (x86)\TwonkyMedia\twonkymediaserverwatchdog.exe
PRC - [2011.09.21 10:36:02 | 001,517,320 | ---- | M] () -- C:\Program Files (x86)\TwonkyMedia\TwonkyMediaServer.exe
PRC - [2011.09.21 10:29:36 | 000,245,760 | ---- | M] () -- C:\Program Files (x86)\TwonkyMedia\twonkywebdav.exe
PRC - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PRC - [2009.02.23 11:43:54 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.24 02:45:44 | 020,317,008 | ---- | M] () -- E:\Spiele\Steam\bin\libcef.dll
MOD - [2012.08.24 02:45:44 | 001,099,616 | ---- | M] () -- E:\Spiele\Steam\bin\avcodec-53.dll
MOD - [2012.08.24 02:45:44 | 000,902,480 | ---- | M] () -- E:\Spiele\Steam\bin\chromehtml.dll
MOD - [2012.08.24 02:45:44 | 000,190,816 | ---- | M] () -- E:\Spiele\Steam\bin\avformat-53.dll
MOD - [2012.08.24 02:45:44 | 000,123,232 | ---- | M] () -- E:\Spiele\Steam\bin\avutil-51.dll
MOD - [2012.08.15 12:31:14 | 009,465,032 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll
MOD - [2012.08.06 12:15:36 | 000,167,424 | ---- | M] () -- C:\Users\Hendrik\AppData\Roaming\Amar\week.exe
MOD - [2012.08.01 18:03:29 | 000,262,144 | ---- | M] () -- C:\Users\Hendrik\AppData\Roaming\Ehluew\xyla.exe
MOD - [2012.07.14 02:14:07 | 002,003,424 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012.07.05 22:06:48 | 000,015,800 | ---- | M] () -- C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2native.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.08.24 02:45:44 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.08.15 12:31:15 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.08.03 21:52:07 | 000,537,592 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe -- (vpnagent)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.20 19:12:47 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2012.07.12 15:16:56 | 000,008,704 | ---- | M] (Hi-Rez Studios) [Auto | Running] -- E:\Spiele\Smite\HiPatchService.exe -- (HiPatchService)
SRV - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.09.21 10:36:04 | 000,509,704 | ---- | M] (PacketVideo) [Auto | Running] -- C:\Program Files (x86)\TwonkyMedia\twonkymediaserverwatchdog.exe -- (TwonkyMedia)
SRV - [2011.09.21 10:29:36 | 000,245,760 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\TwonkyMedia\twonkywebdav.exe -- (TwonkyWebDav)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.02.23 11:43:54 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2008.10.25 11:44:08 | 000,065,888 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- E:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.08.03 21:38:55 | 000,027,048 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpnva64.sys -- (vpnva)
DRV:64bit: - [2012.08.03 21:38:05 | 000,107,432 | R--- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acsock64.sys -- (acsock)
DRV:64bit: - [2012.07.20 19:31:15 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2012.05.02 15:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.04.27 10:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.04.25 00:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2000.01.01 02:00:00 | 001,561,688 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k)
DRV:64bit: - [2000.01.01 02:00:00 | 001,417,304 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX.SYS)
DRV:64bit: - [2000.01.01 02:00:00 | 001,417,304 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX)
DRV:64bit: - [2000.01.01 02:00:00 | 000,684,376 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k)
DRV:64bit: - [2000.01.01 02:00:00 | 000,580,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k)
DRV:64bit: - [2000.01.01 02:00:00 | 000,349,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2000.01.01 02:00:00 | 000,213,080 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV:64bit: - [2000.01.01 02:00:00 | 000,202,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT.SYS)
DRV:64bit: - [2000.01.01 02:00:00 | 000,202,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT)
DRV:64bit: - [2000.01.01 02:00:00 | 000,179,288 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv)
DRV:64bit: - [2000.01.01 02:00:00 | 000,118,360 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia)
DRV:64bit: - [2000.01.01 02:00:00 | 000,094,808 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT.SYS)
DRV:64bit: - [2000.01.01 02:00:00 | 000,094,808 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT)
DRV:64bit: - [2000.01.01 02:00:00 | 000,015,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 9E CC A9 94 84 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "spon.de"
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: E:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 18:43:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.07.20 18:44:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hendrik\AppData\Roaming\mozilla\Extensions
[2012.08.28 12:02:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hendrik\AppData\Roaming\mozilla\Firefox\Profiles\znetsef8.default\extensions
[2012.07.20 18:43:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.07.14 02:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.14 02:45:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.07.30 17:59:36 | 000,000,885 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.twonky.com
O1 - Hosts: 127.0.0.1 www.twonkymedia.com
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKCU..\Run: [Peoqpu] C:\Users\Hendrik\AppData\Roaming\Ehluew\xyla.exe ()
O4 - HKCU..\Run: [Rooss] C:\Users\Hendrik\AppData\Roaming\Amar\week.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - E:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - E:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7805A735-ED26-4C5C-8C16-D1EE386ACC05}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DF1C6412-7B58-4E7E-8A50-3ABFAE7C9C60}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - E:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.04.30 22:53:28 | 000,000,048 | R--- | M] () - I:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{803bcaeb-d27e-11e1-b415-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{803bcaeb-d27e-11e1-b415-806e6f6e6963}\Shell\AutoRun\command - "" = F:\setup.exe
O33 - MountPoints2\{ea0c4056-d285-11e1-96fd-00044b15fe73}\Shell - "" = AutoRun
O33 - MountPoints2\{ea0c4056-d285-11e1-96fd-00044b15fe73}\Shell\AutoRun\command - "" = I:\Set-up.exe -- [2010.04.07 14:38:28 | 000,812,496 | R--- | M] (Adobe Systems Incorporated)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.29 22:07:39 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Wyqyho
[2012.08.29 22:07:39 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Mopiko
[2012.08.29 22:07:39 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Daiwpu
[2012.08.29 20:56:36 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Ygumih
[2012.08.29 20:56:36 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Ogem
[2012.08.29 20:56:36 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Ehvyy
[2012.08.29 17:35:46 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Obabec
[2012.08.29 17:35:46 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Haed
[2012.08.29 17:35:46 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Ehluew
[2012.08.29 16:13:57 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Sesuq
[2012.08.29 16:13:57 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Muurb
[2012.08.29 16:13:57 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Amar
[2012.08.29 14:26:21 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012.08.29 14:26:21 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Identities
[2012.08.28 23:27:14 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Help
[2012.08.28 21:49:00 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Malwarebytes
[2012.08.28 21:48:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.28 21:48:42 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.28 21:48:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.28 21:48:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.28 21:47:53 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2012.08.28 21:46:50 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2012.08.28 18:42:55 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Local\Cisco
[2012.08.28 18:42:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco
[2012.08.28 18:42:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco
[2012.08.28 18:41:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Cisco
[2012.08.28 16:15:22 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2012.08.28 16:14:47 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Dropbox
[2012.08.27 17:15:26 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\Documents\Förderunterricht
[2012.08.24 00:41:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Guild Wars 2
[2012.08.24 00:40:42 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\Documents\Guild Wars 2
[2012.08.20 17:08:40 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Play withSIX
[2012.08.20 17:08:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SIX Networks
[2012.08.19 16:53:31 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.08.17 13:52:47 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Local\DayZCommander
[2012.08.15 00:39:30 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\Desktop\LU301 DAYZ server
[2012.08.05 22:48:44 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2012.08.05 22:29:11 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012.08.05 22:28:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe Media Player
[2012.08.05 22:28:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2012.08.05 22:27:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR
[2012.08.05 18:57:16 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Local\Chromium
[2012.08.03 17:35:03 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\4.0
[2012.08.03 17:35:03 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\.tfo4
[2012.08.01 22:54:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Infogrames
[2012.08.01 13:53:24 | 000,000,000 | ---D | C] -- C:\Users\Hendrik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[1 C:\Users\Hendrik\Documents\*.tmp files -> C:\Users\Hendrik\Documents\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.29 23:39:06 | 000,000,174 | ---- | M] () -- C:\Users\Hendrik\defogger_reenable
[2012.08.29 23:32:08 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.29 23:32:08 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.29 23:31:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.29 23:30:37 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.29 23:30:37 | 000,696,620 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.29 23:30:37 | 000,651,938 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.29 23:30:37 | 000,147,916 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.29 23:30:37 | 000,120,870 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.29 23:24:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.29 23:23:51 | 3220,074,496 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.29 22:17:27 | 000,061,088 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000005-00000000-00000009-00001102-00000005-00291102}.rfx
[2012.08.29 22:17:27 | 000,061,088 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000005-00000000-00000009-00001102-00000005-00291102}.rfx
[2012.08.29 22:17:27 | 000,000,788 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000005-00000000-00000009-00001102-00000005-00291102}.rfx
[2012.08.29 17:52:52 | 083,032,662 | ---- | M] () -- C:\Users\Hendrik\Documents\PraxisS2-1.psd
[2012.08.29 17:30:53 | 116,005,980 | ---- | M] () -- C:\Users\Hendrik\Documents\Praxis 1-1test.psd
[2012.08.29 13:04:16 | 004,971,888 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.28 21:48:44 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.28 16:17:25 | 000,001,043 | ---- | M] () -- C:\Users\Hendrik\Desktop\Dropbox.lnk
[2012.08.24 00:41:16 | 000,000,618 | ---- | M] () -- C:\Users\Public\Desktop\Guild Wars 2.lnk
[2012.08.20 16:16:47 | 000,000,841 | ---- | M] () -- C:\Users\Public\Desktop\DayZ Commander.lnk
[2012.08.19 16:53:28 | 498,678,663 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.08.17 16:42:56 | 000,173,114 | ---- | M] () -- C:\Users\Hendrik\Desktop\Arma2.jpg
[2012.08.10 18:40:58 | 005,721,943 | ---- | M] () -- C:\Users\Hendrik\Desktop\Praxis1-1.jpg
[2012.08.06 15:52:30 | 065,965,694 | ---- | M] () -- C:\Users\Hendrik\Documents\Praxis 2.psd
[2012.08.06 15:33:50 | 101,894,432 | ---- | M] () -- C:\Users\Hendrik\Documents\Praxis 1.psd
[1 C:\Users\Hendrik\Documents\*.tmp files -> C:\Users\Hendrik\Documents\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.29 23:39:05 | 000,000,174 | ---- | C] () -- C:\Users\Hendrik\defogger_reenable
[2012.08.28 21:48:44 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.28 16:17:25 | 000,001,043 | ---- | C] () -- C:\Users\Hendrik\Desktop\Dropbox.lnk
[2012.08.24 13:25:15 | 083,032,662 | ---- | C] () -- C:\Users\Hendrik\Documents\PraxisS2-1.psd
[2012.08.24 00:41:16 | 000,000,618 | ---- | C] () -- C:\Users\Public\Desktop\Guild Wars 2.lnk
[2012.08.19 16:53:28 | 498,678,663 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.08.17 16:42:56 | 000,173,114 | ---- | C] () -- C:\Users\Hendrik\Desktop\Arma2.jpg
[2012.08.17 13:50:55 | 000,000,841 | ---- | C] () -- C:\Users\Public\Desktop\DayZ Commander.lnk
[2012.08.10 18:40:53 | 005,721,943 | ---- | C] () -- C:\Users\Hendrik\Desktop\Praxis1-1.jpg
[2012.08.10 18:17:49 | 116,005,980 | ---- | C] () -- C:\Users\Hendrik\Documents\Praxis 1-1test.psd
[2012.08.06 12:30:53 | 065,965,694 | ---- | C] () -- C:\Users\Hendrik\Documents\Praxis 2.psd
[2012.08.06 09:57:16 | 101,894,432 | ---- | C] () -- C:\Users\Hendrik\Documents\Praxis 1.psd
[2012.08.05 22:30:50 | 000,000,923 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5 (64 Bit).lnk
[2012.08.05 22:30:25 | 000,000,878 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5.lnk
[2012.08.05 22:29:08 | 000,000,852 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.lnk
[2012.08.05 22:28:57 | 000,000,915 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.lnk
[2012.08.05 22:27:33 | 000,000,972 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2012.08.05 22:27:22 | 000,001,523 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2012.08.05 22:27:05 | 000,000,997 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2012.08.01 13:32:26 | 000,000,978 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader 2.lnk
[2012.07.21 17:36:26 | 001,588,762 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.07.20 19:12:13 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2012.07.20 19:12:13 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2012.07.20 19:12:01 | 000,003,072 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL
[2012.07.20 19:11:52 | 000,060,928 | ---- | C] ( ) -- C:\Windows\SysWow64\a3d.dll
[2012.07.20 19:11:52 | 000,012,800 | ---- | C] ( ) -- C:\Windows\SysWow64\killapps.exe
[2012.07.20 19:11:52 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\enlocstr.exe
[2012.07.20 19:11:52 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CtxfiRes.dll
[2012.07.20 19:11:49 | 000,321,512 | ---- | C] () -- C:\Windows\SysWow64\ctdlang.dat
[2012.07.20 19:11:49 | 000,056,509 | ---- | C] () -- C:\Windows\SysWow64\ctdnlstr.dat
[2012.07.20 19:11:49 | 000,021,204 | ---- | C] () -- C:\Windows\SysWow64\instwdm.ini
[2012.07.20 19:11:49 | 000,000,285 | ---- | C] () -- C:\Windows\SysWow64\kill.ini
[2012.07.20 19:11:49 | 000,000,054 | ---- | C] () -- C:\Windows\SysWow64\ctzapxx.ini
 
========== LOP Check ==========
 
[2012.08.29 16:13:57 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Amar
[2012.08.07 14:01:39 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\calibre
[2012.08.01 13:51:21 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\DAEMON Tools Lite
[2012.08.29 22:08:11 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Daiwpu
[2012.08.29 13:05:03 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Dropbox
[2012.08.29 17:35:46 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Ehluew
[2012.08.29 20:56:49 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Ehvyy
[2012.08.29 17:35:46 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Haed
[2012.08.29 22:07:39 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Mopiko
[2012.08.29 23:34:58 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Muurb
[2012.08.29 23:35:06 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Obabec
[2012.08.29 20:56:36 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Ogem
[2012.08.20 17:08:41 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Play withSIX
[2012.08.29 16:13:57 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Sesuq
[2012.07.23 23:50:39 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\six-updater
[2012.07.21 17:38:48 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\six-zsync
[2012.07.22 21:58:45 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\TS3Client
[2012.08.29 22:07:39 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Wyqyho
[2012.08.29 20:56:36 | 000,000,000 | ---D | M] -- C:\Users\Hendrik\AppData\Roaming\Ygumih
[2009.07.14 07:08:49 | 000,023,814 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         

OTL Extras logfile created on: 29.08.2012 23:41:52 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Hendrik\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,50 Gb Available Physical Memory | 62,59% Memory free
8,00 Gb Paging File | 6,09 Gb Available in Paging File | 76,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 78,03 Gb Total Space | 45,08 Gb Free Space | 57,77% Space Free | Partition Type: NTFS
Drive D: | 268,55 Gb Total Space | 261,55 Gb Free Space | 97,39% Space Free | Partition Type: NTFS
Drive E: | 119,08 Gb Total Space | 53,96 Gb Free Space | 45,32% Space Free | Partition Type: NTFS
Drive F: | 931,51 Gb Total Space | 276,58 Gb Free Space | 29,69% Space Free | Partition Type: NTFS
Drive I: | 2,38 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: HENDRIK-PC | User Name: Hendrik | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "E:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "E:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "E:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- E:\Programme\Photoshop CS5\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- E:\PROGRA~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "E:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "E:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "E:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "E:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- E:\Programme\Photoshop CS5\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- E:\PROGRA~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "E:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1CF85E56-F41B-4C47-9E46-6A95C7E264FB}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{3DAA8DE1-30E4-4BA2-83A4-120790EA9F6C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{42DA8B7D-2995-4782-B596-3F6B60613285}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{4CB5F346-9D92-49C6-9357-13C90251B399}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{4D244EBC-A5A7-4534-8838-0030CBB328AC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{63EAD83C-B2EB-442A-9DDD-3863C2BC0ED1}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{68CA39CE-8800-43AE-8D06-59D57346BA96}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{B37AD0C1-340C-4F78-A1F3-6D471EF91F2B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D478B3F3-72FD-4D79-A530-218CF01904BD}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{DA063979-2A9C-48C2-B715-6188812FA663}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{E228962A-DBC4-4A76-AB8A-AE25C83BAE21}" = lport=6004 | protocol=17 | dir=in | app=e:\programme\microsoft office\office12\outlook.exe | 
"{ED37863E-60B3-414D-872C-21F99E3B2324}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0382D60E-B480-4E7A-9D82-9E1787A2067B}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe | 
"{06F6E034-9164-4937-BED1-E3CABE722428}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{10ED0097-FF56-46F9-8225-3C4FB3A236B4}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd | 
"{131C28B7-474E-45DE-88DD-CC3475DB0B25}" = protocol=6 | dir=in | app=c:\users\hendrik\documents\arma 2\expansion\beta\arma2oa.exe | 
"{1667CA78-ED6A-4A1E-B105-33634D3A7C44}" = protocol=6 | dir=in | app=c:\users\hendrik\appdata\roaming\dropbox\bin\dropbox.exe | 
"{1BF3F582-C77E-412C-A177-EC3CB70DDAE7}" = protocol=17 | dir=in | app=c:\program files (x86)\twonkymedia\twonkymediaserver.exe | 
"{1C2681C0-63F1-43F5-A89B-82AB0CBF87DB}" = protocol=6 | dir=out | app=system | 
"{1E1A9FEE-FCBA-4704-8BAA-24AC667F0CCB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{2E03E8DB-C88B-4FE6-8562-B8B5546919EC}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\demolitioninc\finaldgamegl.exe | 
"{329A3401-932E-401B-AB63-AA52AC541D40}" = protocol=6 | dir=in | app=c:\users\hendrik\appdata\roaming\dropbox\bin\dropbox.exe | 
"{32DA1F2C-11FA-4D81-BD03-018B4F1E0D2D}" = protocol=17 | dir=in | app=c:\users\hendrik\appdata\roaming\dropbox\bin\dropbox.exe | 
"{35077784-8306-4902-B596-BF11537E2D7C}" = protocol=6 | dir=in | app=e:\programme\microsoft office\office12\groove.exe | 
"{3A68D54D-C8F0-4BAB-8DE3-8987EF751438}" = protocol=17 | dir=in | app=c:\users\hendrik\appdata\roaming\dropbox\bin\dropbox.exe | 
"{3CB1FD5B-BFFF-4562-AFF4-21F6B82CC424}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\dota 2 beta\dota.exe | 
"{3D822F9D-E86B-4CDF-9F89-A963291CC8C1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{3F3DC29F-AA0D-4EDB-B3C7-D0455460753E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{4102C90B-3D89-4F02-A1EF-D09D902FBF55}" = protocol=17 | dir=in | app=c:\program files (x86)\twonkymedia\twonkymediaserverwatchdog.exe | 
"{45C070DE-F58C-4D2E-8E98-3A21FAB86591}" = protocol=17 | dir=in | app=c:\program files (x86)\twonkymedia\twonkymediaserver.exe | 
"{4654133C-6B25-484A-AE16-ED349ABD5F8D}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 free\arma2free.exe | 
"{4894C4E8-66BF-4088-BB49-E4B5AF5FC876}" = protocol=6 | dir=in | app=e:\spiele\six updater\tools\bin\rsync.exe | 
"{4A86F3AD-3150-463A-A047-0F7FD056A9E9}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\hendrik\team fortress 2\hl2.exe | 
"{4EAF62B5-BD1D-4427-96F8-42C37229BFDE}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\demolitioninc\finaldgamegl.exe | 
"{52918846-0BF4-4D58-A1C1-0EBC2D5FEEC0}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\dota 2 beta\dota.exe | 
"{541004E6-4E07-4FA7-B9E1-CD9238BFE25C}" = protocol=6 | dir=in | app=e:\spiele\guild wars 2\gw2.exe | 
"{543F6F8D-635B-4EC0-910A-14806BFADEBB}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\hoard\win32\reuben.exe | 
"{54620EE0-913D-40E1-B359-773E7F4998ED}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"{5705A149-7368-4CC8-8C5C-65502507658F}" = dir=in | app=e:\programme\itunes\itunes.exe | 
"{589B25BB-B5E1-4651-8C05-F8FD77C75AFF}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 free\arma2free.exe | 
"{58B0F153-4EB5-4AC1-A109-27574CF5989C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{5977DFB2-3452-45F8-B61C-8F66D4240CD7}" = protocol=17 | dir=in | app=e:\programme\microsoft office\office12\groove.exe | 
"{6289DA89-D17D-4FA3-8331-08C597A3D70E}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\fallout new vegas\falloutnvlauncher.exe | 
"{675517F0-4A7E-45E8-8C37-EC3CE2A78CF1}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd | 
"{72C8FB27-51B9-40E7-8CF0-CCCBD2A006FB}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\hoard\win32\reuben.exe | 
"{757709A7-E554-4999-94F0-41AD6BDCAA22}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"{78360915-1E55-433D-85D1-E32F51A9B469}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{82B97801-15A3-43E1-A869-D2039F5B0CCC}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe | 
"{87C1D726-E061-4415-B452-C75F6DE9A8F2}" = protocol=17 | dir=in | app=c:\users\hendrik\documents\arma 2\expansion\beta\arma2oa.exe | 
"{87C2140C-6674-4063-A34A-0D257F511192}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe | 
"{8A720967-8F80-4809-B775-AFB706FA5525}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{8D5F8CE3-31E4-4AE0-8437-E332024F680A}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{95B84D30-435D-48BF-A874-1AD7C1882668}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\fallout new vegas\falloutnvlauncher.exe | 
"{961CCAA6-9936-4E7C-AC37-B126099388BB}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{9844F427-D6DA-4D61-BC12-A540C820E50A}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{A5BFB82F-2930-49A8-AAA4-97E0A90230CA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{A628619F-6240-420F-A71D-22E51987C7A0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{A7E30300-46BA-4B26-9FC0-6CE2CFBBAE5D}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\the binding of isaac\isaac.exe | 
"{AB61652B-DF39-4334-B0D2-3F75C908FEFA}" = protocol=6 | dir=in | app=e:\programme\jdownloader 2\jdownloader 2\jdownloader 2.exe | 
"{AB6CD01C-92C9-4B6A-B738-41673B6740FC}" = protocol=17 | dir=in | app=e:\spiele\guild wars 2\gw2.exe | 
"{ACB28C44-559B-43AF-8733-868292DF2B41}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\hendrik\team fortress 2\hl2.exe | 
"{AD9A482B-3702-48D1-9CEA-BBBBFFD5A1C4}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{AEC8B433-7AB4-4D87-9210-02918FCB2D12}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{B04AEAB8-2D19-4946-B4A3-5B055EA163D6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B2E5C543-EA88-4E14-8D28-ACC78F101989}" = protocol=6 | dir=in | app=e:\programme\microsoft office\office12\onenote.exe | 
"{B32723D2-69E7-45A4-9190-D3D6508E4880}" = protocol=17 | dir=in | app=e:\programme\jdownloader 2\jdownloader 2\jdownloader 2.exe | 
"{B624070C-3177-4536-9FBD-076C49BE1ACB}" = protocol=6 | dir=in | app=c:\program files (x86)\twonkymedia\twonkymediaserver.exe | 
"{BBD79D51-E0F7-4EE5-8E89-E551612A1320}" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"{BE1DE1C6-192C-4D49-89CB-6CAD96727EBB}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{C07F8F12-EE5A-4460-8C2F-862F07F31742}" = protocol=17 | dir=in | app=c:\users\hendrik\appdata\local\temp\gw2.exe | 
"{C42383CA-272F-4E5D-A4DB-BE711817DAB0}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\swords and soldiers\swords and soldiers launcher.exe | 
"{C4B224ED-9132-4F73-92D4-BA711D65A7D6}" = protocol=6 | dir=in | app=c:\program files (x86)\twonkymedia\twonkymediaserverwatchdog.exe | 
"{C734EC87-8408-45C9-86E1-AD1DA84B6E25}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe | 
"{CC608EC5-AD00-4CF3-8D3D-7E1EC99F981F}" = protocol=6 | dir=in | app=e:\spiele\steam\steam.exe | 
"{D5FE62A9-D594-40B2-BC98-47FCD5252572}" = protocol=17 | dir=in | app=e:\spiele\steam\steam.exe | 
"{DB057AF0-DEC3-4036-844D-6C6A558E04C5}" = protocol=6 | dir=in | app=c:\users\hendrik\appdata\local\temp\gw2.exe | 
"{DC6E2021-1CD0-4D8D-9846-3DD9682813D8}" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"{DD73072C-B196-4313-AE84-D19589644AA0}" = protocol=17 | dir=in | app=e:\spiele\six updater\tools\bin\rsync.exe | 
"{DF9627CD-B429-418B-B4DF-F78129A22CC1}" = protocol=6 | dir=in | app=e:\spiele\play with six\tools\bin\rsync.exe | 
"{E213A4C3-EB49-4BBF-B450-E29E8904A6A6}" = protocol=6 | dir=in | app=c:\program files (x86)\twonkymedia\twonkymediaserverwatchdog.exe | 
"{E229E7FF-D44B-4C0E-9881-1BE6122C710E}" = protocol=17 | dir=in | app=c:\program files (x86)\twonkymedia\twonkymediaserverwatchdog.exe | 
"{E34E835E-C03D-4C89-A1B0-6464DCBDCDBA}" = protocol=17 | dir=in | app=e:\spiele\play with six\tools\bin\rsync.exe | 
"{E3EBDF5A-9572-4870-BB19-EC1612CE2AF5}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\swords and soldiers\swords and soldiers launcher.exe | 
"{ED01796D-B684-4553-94AE-F0EEFAF27952}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F174063F-BB99-4EF1-B6FC-449B2A69B7B3}" = protocol=6 | dir=in | app=c:\program files (x86)\twonkymedia\twonkymediaserver.exe | 
"{F1C29EC5-8D2F-488F-A57C-BBC77E0F68A5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{F87BE825-4994-4547-AD93-118AA12F96EC}" = protocol=17 | dir=in | app=e:\programme\microsoft office\office12\onenote.exe | 
"{F9C12455-7518-48BF-A385-FC33AE29D28E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{FF89EA5F-61D9-4C97-8DCB-55B3615404AA}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\the binding of isaac\isaac.exe | 
"TCP Query User{11C8FA39-DF2D-4AA5-B98B-23DFB612AC5A}C:\users\hendrik\appdata\roaming\urhin\uqon.exe" = protocol=6 | dir=in | app=c:\users\hendrik\appdata\roaming\urhin\uqon.exe | 
"TCP Query User{17193EC4-A97F-4D35-8734-5DE5A64B3F8D}C:\users\hendrik\documents\arma 2\expansion\beta\arma2oa.exe" = protocol=6 | dir=in | app=c:\users\hendrik\documents\arma 2\expansion\beta\arma2oa.exe | 
"TCP Query User{2DC31C3B-E8A8-454B-B018-109AF6BFB56F}E:\spiele\guild wars 2\gw2.exe" = protocol=6 | dir=in | app=e:\spiele\guild wars 2\gw2.exe | 
"TCP Query User{3221737F-FDD4-4654-BF09-5BDE4CB50EBA}C:\users\hendrik\appdata\local\temp\gw2.exe" = protocol=6 | dir=in | app=c:\users\hendrik\appdata\local\temp\gw2.exe | 
"TCP Query User{3A309084-CBAE-4E96-B517-A6C7C2CC0FCA}C:\users\hendrik\appdata\roaming\biuz\wuavy.exe" = protocol=6 | dir=in | app=c:\users\hendrik\appdata\roaming\biuz\wuavy.exe | 
"TCP Query User{62D0CE0E-AB4F-4A84-9AA6-CBB89EB1C315}E:\programme\jdownloader 2\jdownloader 2\jdownloader 2.exe" = protocol=6 | dir=in | app=e:\programme\jdownloader 2\jdownloader 2\jdownloader 2.exe | 
"TCP Query User{7B869EA4-B8B2-427C-A96B-F78E3D57ECE8}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"TCP Query User{A5B00DD9-D67C-4324-A7A4-B5B2E37EAD20}E:\spiele\six updater\tools\bin\rsync.exe" = protocol=6 | dir=in | app=e:\spiele\six updater\tools\bin\rsync.exe | 
"TCP Query User{BA86912E-D2D1-4268-9E30-B994C3F9C1A8}E:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"TCP Query User{E11A8030-AF37-491E-85EC-A5C651535897}E:\spiele\play with six\tools\bin\rsync.exe" = protocol=6 | dir=in | app=e:\spiele\play with six\tools\bin\rsync.exe | 
"TCP Query User{F0BD2577-A573-406F-B460-009EF75F6DD8}C:\users\hendrik\appdata\roaming\waro\tofu.exe" = protocol=6 | dir=in | app=c:\users\hendrik\appdata\roaming\waro\tofu.exe | 
"TCP Query User{FD0706B1-BF21-44ED-B6C6-5F756BC9516B}E:\spiele\steam\steamapps\hendrik\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\hendrik\team fortress 2\hl2.exe | 
"UDP Query User{08F7E34F-93B8-41AB-A2BE-0D685BDEBBB1}E:\spiele\guild wars 2\gw2.exe" = protocol=17 | dir=in | app=e:\spiele\guild wars 2\gw2.exe | 
"UDP Query User{2036025C-CAAD-429A-86B5-975E5C81AB94}E:\spiele\steam\steamapps\hendrik\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\hendrik\team fortress 2\hl2.exe | 
"UDP Query User{2472CE6E-BB98-4114-B580-97EADD4EDDD3}C:\users\hendrik\appdata\roaming\waro\tofu.exe" = protocol=17 | dir=in | app=c:\users\hendrik\appdata\roaming\waro\tofu.exe | 
"UDP Query User{3E26AE0C-F42A-482F-95B3-7B3A4394E647}E:\programme\jdownloader 2\jdownloader 2\jdownloader 2.exe" = protocol=17 | dir=in | app=e:\programme\jdownloader 2\jdownloader 2\jdownloader 2.exe | 
"UDP Query User{4BA6E305-B7C5-4C4F-8B3B-90624758741F}E:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"UDP Query User{5C11CB53-2276-4A4E-9C6A-6737C89F1D36}E:\spiele\six updater\tools\bin\rsync.exe" = protocol=17 | dir=in | app=e:\spiele\six updater\tools\bin\rsync.exe | 
"UDP Query User{6001C12A-42E3-4686-A9C1-C962D9AC62A8}C:\users\hendrik\appdata\roaming\urhin\uqon.exe" = protocol=17 | dir=in | app=c:\users\hendrik\appdata\roaming\urhin\uqon.exe | 
"UDP Query User{8CEA7708-D00A-4F01-9368-1E2B4743459B}C:\users\hendrik\appdata\roaming\biuz\wuavy.exe" = protocol=17 | dir=in | app=c:\users\hendrik\appdata\roaming\biuz\wuavy.exe | 
"UDP Query User{8E62BA7F-B9A8-47ED-8BA3-0579898976B7}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{DEF15D79-FB34-47E1-8FE2-81C3A842726F}C:\users\hendrik\appdata\local\temp\gw2.exe" = protocol=17 | dir=in | app=c:\users\hendrik\appdata\local\temp\gw2.exe | 
"UDP Query User{F5471699-8531-4A8B-B94F-235EBBEE9071}E:\spiele\play with six\tools\bin\rsync.exe" = protocol=17 | dir=in | app=e:\spiele\play with six\tools\bin\rsync.exe | 
"UDP Query User{FAE10F22-3F05-46F5-8259-1BA2E59F68B4}C:\users\hendrik\documents\arma 2\expansion\beta\arma2oa.exe" = protocol=17 | dir=in | app=c:\users\hendrik\documents\arma 2\expansion\beta\arma2oa.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.8.15
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5
"{2D8CED57-CCDB-4D86-9087-3BBCAE8F8F22}" = Six Updater
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}" = Smite Closed Beta
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{61873A7A-38DD-4973-90A9-69E4560A1DC6}" = Play withSIX
"{628ED0F8-590B-49CF-A525-A1696BD79304}" = Cisco AnyConnect Secure Mobility Client
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{67BE448F-7813-4466-A767-85EF5BBAC1D1}" = DayZ Commander
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72DF62BD-FF36-424E-AA5F-D89BAFF2C249}" = RollerCoaster Tycoon 2
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{E64BA721-2310-4B55-BE5A-2925F9706192}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B364DC2A-9783-4737-B795-D6F0562A41C5}" = calibre
"{CC452A50-5C87-4A1F-B295-445C3C69BF7D}" = NVIDIA MediaShield
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"0630-0716-3135-7887" = JDownloader 2
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AudioCS" = Creative Audio-Systemsteuerung
"Avira AntiVir Desktop" = Avira Free Antivirus
"BattlEye A2 Free" = BattlEye (A2Free) Uninstall
"BattlEye for OA" = BattlEye for OA Uninstall
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Cisco AnyConnect Secure Mobility Client" = Cisco AnyConnect Secure Mobility Client 
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"DAEMON Tools Lite" = DAEMON Tools Lite
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Guild Wars 2" = Guild Wars 2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"OpenAL" = OpenAL
"Steam App 107400" = ARMA 2: Free
"Steam App 113200" = The Binding of Isaac
"Steam App 22380" = Fallout: New Vegas
"Steam App 33930" = ARMA 2: Operation Arrowhead
"Steam App 40800" = Super Meat Boy
"Steam App 440" = Team Fortress 2
"Steam App 570" = Dota 2
"Steam App 63000" = HOARD
"Steam App 63500" = Swords and Soldiers HD
"Steam App 98600" = Demolition, Inc.
"TwonkyMediaTwonkyMedia" = TwonkyMedia
"VLC media player" = VLC media player 2.0.3
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 29.08.2012 11:53:14 | Computer Name = Hendrik-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x003a000a  ID des fehlerhaften
 Prozesses: 0xf14  Startzeit der fehlerhaften Anwendung: 0x01cd85fe64054404  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: a40e6c24-f1f1-11e1-8ddd-00044b15fe73
 
Error - 29.08.2012 11:54:19 | Computer Name = Hendrik-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0411000a  ID des fehlerhaften
 Prozesses: 0xf2c  Startzeit der fehlerhaften Anwendung: 0x01cd85fe8a18abf4  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: cab847b4-f1f1-11e1-8ddd-00044b15fe73
 
Error - 29.08.2012 12:08:29 | Computer Name = Hendrik-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00af000a  ID des fehlerhaften
 Prozesses: 0x1230  Startzeit der fehlerhaften Anwendung: 0x01cd8600856990e4  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: c52f6e74-f1f3-11e1-8ddd-00044b15fe73
 
Error - 29.08.2012 13:30:01 | Computer Name = Hendrik-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0262000a  ID des fehlerhaften
 Prozesses: 0x13ac  Startzeit der fehlerhaften Anwendung: 0x01cd860be9b24aa4  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: 290b4534-f1ff-11e1-8ddd-00044b15fe73
 
Error - 29.08.2012 13:45:12 | Computer Name = Hendrik-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0109000a  ID des fehlerhaften
 Prozesses: 0x13e4  Startzeit der fehlerhaften Anwendung: 0x01cd860e0952e6b4  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: 4819f1e4-f201-11e1-8ddd-00044b15fe73
 
Error - 29.08.2012 14:56:38 | Computer Name = Hendrik-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x04cb000a  ID des fehlerhaften
 Prozesses: 0x1178  Startzeit der fehlerhaften Anwendung: 0x01cd860ec86eb2e4  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: 42ce37a4-f20b-11e1-8ddd-00044b15fe73
 
Error - 29.08.2012 14:56:48 | Computer Name = Hendrik-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x011d000a  ID des fehlerhaften
 Prozesses: 0x1674  Startzeit der fehlerhaften Anwendung: 0x01cd861807f3ef34  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: 48879c44-f20b-11e1-8ddd-00044b15fe73
 
Error - 29.08.2012 16:07:43 | Computer Name = Hendrik-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x03fd000a  ID des fehlerhaften
 Prozesses: 0xa34  Startzeit der fehlerhaften Anwendung: 0x01cd861b4ad71cd8  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: 30d6651c-f215-11e1-8ddd-00044b15fe73
 
Error - 29.08.2012 16:07:51 | Computer Name = Hendrik-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x03f5000a  ID des fehlerhaften
 Prozesses: 0x11b8  Startzeit der fehlerhaften Anwendung: 0x01cd8621f610873c  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: 35a9f5cc-f215-11e1-8ddd-00044b15fe73
 
Error - 29.08.2012 16:09:36 | Computer Name = Hendrik-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x03e8000a  ID des fehlerhaften
 Prozesses: 0x1248  Startzeit der fehlerhaften Anwendung: 0x01cd8622347e7e0c  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: 7469026c-f215-11e1-8ddd-00044b15fe73
 
[ Cisco AnyConnect Secure Mobility Client Events ]
Error - 29.08.2012 17:24:28 | Computer Name = Hendrik-PC | Source = acvpnagent | ID = 67108866
Description = Function: CCapiCertUtils::CCapiCertUtils File: .\Certificates\CapiCertUtils.cpp
Line:
 105 Invoked Function: CWinsecApiImpersonateUser::CWinsecApiImpersonateUser Return
 Code: -32833517 (0xFE0B0013) Description: WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED

 
Error - 29.08.2012 17:24:28 | Computer Name = Hendrik-PC | Source = acvpnagent | ID = 67108866
Description = Function: CCapiCertStore::CCapiCertStore File: .\Certificates\CapiCertStore.cpp
Line:
 57 Invoked Function: CapiCertUtils Return Code: -32833517 (0xFE0B0013) Description:
 WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED 
 
Error - 29.08.2012 17:24:28 | Computer Name = Hendrik-PC | Source = acvpnagent | ID = 67108866
Description = Function: CCapiCertSmartcardStore::CCapiCertSmartcardStore File: .\Certificates\CapiCertSmartcardStore.cpp
Line:
 39 Invoked Function: CCapiCertStore::CCapiCertStore Return Code: -32833517 (0xFE0B0013)
Description:
 WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED 
 
Error - 29.08.2012 17:24:28 | Computer Name = Hendrik-PC | Source = acvpnagent | ID = 67108866
Description = Function: CCollectiveCertStore::addCapiSmartcardStore File: .\Certificates\CollectiveCertStore.cpp
Line:
 1540 Invoked Function: CCapiCertSmartcardStore::CCapiCertSmartcardStore Return Code:
 -32833517 (0xFE0B0013) Description: WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED

 
Error - 29.08.2012 17:25:05 | Computer Name = Hendrik-PC | Source = acvpnagent | ID = 67108866
Description = Function: CThread::invokeRun File: .\Utility\Thread.cpp Line: 435 Invoked
 Function: IRunnable::Run Return Code: -32112629 (0xFE16000B) Description: BROWSERPROXY_ERROR_NO_PROXY_FILE

 
Error - 29.08.2012 17:29:27 | Computer Name = Hendrik-PC | Source = acvpnagent | ID = 67108865
Description = Function: CServicePluginMgr::GetSettings File: .\ServicePluginMgr.cpp
Line:
 274 m_pIServicePlugin is NULL
 
Error - 29.08.2012 17:29:27 | Computer Name = Hendrik-PC | Source = acvpnagent | ID = 67108865
Description = Function: CServicePluginMgr::GetSettings File: .\ServicePluginMgr.cpp
Line:
 274 m_pIServicePlugin is NULL
 
Error - 29.08.2012 17:29:27 | Computer Name = Hendrik-PC | Source = acvpnagent | ID = 67108865
Description = Function: CTelemetryPluginMgr::GetSettings File: .\TelemetryPluginMgr.cpp
Line:
 311 m_pITelemetryPlugin is NULL
 
Error - 29.08.2012 17:29:29 | Computer Name = Hendrik-PC | Source = acvpnagent | ID = 67108866
Description = Function: CFileUploader::PostDataGetResponse File: ..\FileUploader.cpp
Line:
 407 Invoked Function: CFileUploader::SendHttpRequest Return Code: -29032423 (0xFE450019)
Description:
 HTTP_SESSION_ERROR_DNS_RESOLUTION 
 
Error - 29.08.2012 17:29:29 | Computer Name = Hendrik-PC | Source = acvpnagent | ID = 67108866
Description = Function: CPhoneHomeAgent::PostDataFile File: ..\PhoneHomeAgent.cpp
Line:
 1649 Invoked Function: CFileUploader::PostDataGetResponse Return Code: -29032423 
(0xFE450019) Description: HTTP_SESSION_ERROR_DNS_RESOLUTION Failed to post customer
 experence feedback data (C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility 
Client\CustomerExperienceFeedback\outbound\feedback_data1.cef)
 
[ System Events ]
Error - 01.08.2012 10:51:50 | Computer Name = Hendrik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 19.08.2012 10:53:31 | Computer Name = Hendrik-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?19.?08.?2012 um 16:51:34 unerwartet heruntergefahren.
 
Error - 19.08.2012 10:53:34 | Computer Name = HENDRIK-PC | Source = BugCheck | ID = 1001
Description = 
 
Error - 22.08.2012 05:22:16 | Computer Name = Hendrik-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Steam Client Service erreicht.
 
Error - 22.08.2012 05:22:16 | Computer Name = Hendrik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 22.08.2012 11:08:48 | Computer Name = Hendrik-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Steam Client Service erreicht.
 
Error - 22.08.2012 11:08:48 | Computer Name = Hendrik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 23.08.2012 20:45:49 | Computer Name = Hendrik-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Steam Client Service erreicht.
 
Error - 23.08.2012 20:45:49 | Computer Name = Hendrik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 28.08.2012 16:50:07 | Computer Name = Hendrik-PC | Source = DCOM | ID = 10016
Description = 
 
 
< End of report >