| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
10.10.2012, 16:23
| #1 |
| |  Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) Hallo zusammen, ich bräuchte dringend Hilfe bzgl. der im Titel genannten Hosts. Ich habe heute eine E-Mail von Twitter erhalten, dass mein Account wohl kompromittiert und deshalb vorsorglich das Passwort geändert wurde. Und tatsächlich hat jemand in meinem Namen Links zu chinesischen Malware-Seiten gepostet (Hab den Eintrag leider nicht notiert, bevor ich ihn gelöscht habe). Gestern ist mir allerdings schon aufgefallen, dass meine Internetverbindung sporadisch langsam ist und habe deshalb mal nach auffälligen Verbindungen geschaut. Dabei sind mir die o.g. Hosts aufgefallen, zu denen mein Computer (svchost.exe (NetworkService)) ab und zu Daten mit ziemlich genau 50000 Byte/s sendet. Daraufhin habe ich einen kompletten Virusscan mit Avast durchgeführt, der aber nichts gefunden hat. Ebenso habe ich Hijackthis, OTL, OSAM, Mbam und aswMBR ausgeführt. Keines der Programme hat irgendetwas entdeckt. Trotzdem sendet mein Computer immer noch Daten an diese Hosts (mehr an den *.your-server.de-Host). Ich habe jetzt beide Einträge in der hosts-Datei blockiert. Allerdings weiß ich nun immer noch nicht, was genau die Ursache dafür ist  Vielleicht habt jemand von euch eine Ahnung? |
|
10.10.2012, 16:26
| #2 | ||
| /// Helfer-Team    |  Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) Hallo und Herzlich Willkommen!
__________________ Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]: Zitat:
Für Vista und Win7: Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen! 1. Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
2. Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:
3. Lade dir von hier -> HijackThis herunter Keine offenen Fenster, solang bis HijackThis läuft!!-> HijackThis starten-> "Do a system scan and save a logfile" klicken (kurz warten) -> das erhaltene Logfile "markieren" -> "kopieren"-> hier in deinem Thread (rechte Maustaste) "einfügen" ► Vista und Win7 - Rechtsklick auf HijackThis-> "Als administrator ausführen" wählen... Zitat:
kira
__________________ |
|
10.10.2012, 16:49
| #3 |
| | Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) Edit:
__________________Mir ist gerade bei einem Blick in die Windows-Ereignisanzeige aufgefallen, dass ich seit dem 09.10. Fehlermeldungen von den Diensten Remotedesktop-Dienst, NLA (Network Location Awareness), Arbeitsstationsdienst, DNS-Client und Kryptografiedienste im Protokoll habe. Diese Fehlermeldungen kamen ziemlich genau zu dem Zeitpunkt, an denen ich die Netzwerkverbindung getrennt habe. Kann es vielleicht sein, dass jemand eine Remoteverbindung zu meinem Rechner aufbaut? ---------------- Okay, ich hoffe, ich habe alles richtig gemacht: OTL-Logfile: Code:
ATTFilter OTL logfile created on: 10.10.2012 16:53:44 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\meric\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 1,85 Gb Available Physical Memory | 46,27% Memory free 6,00 Gb Paging File | 3,77 Gb Available in Paging File | 62,91% Paging File free Paging file location(s): d:\pagefile.sys 2048 2048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 40,43 Gb Total Space | 0,63 Gb Free Space | 1,55% Space Free | Partition Type: NTFS Drive D: | 425,33 Gb Total Space | 30,41 Gb Free Space | 7,15% Space Free | Partition Type: NTFS Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\meric\Desktop\OTL.exe (OldTimer Tools) PRC - D:\Programme\Opera\opera.exe (Opera Software) PRC - D:\Programme\avast Antivirus\AvastUI.exe (AVAST Software) PRC - D:\Programme\avast Antivirus\AvastSvc.exe (AVAST Software) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - D:\Programme\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation) PRC - D:\Programme\DynDNS Updater\DynUpSvc.exe (Dyn, Inc.) PRC - D:\Programme\DynDNS Updater\DynTray.exe (Dyn, Inc.) PRC - D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG) PRC - C:\Windows\SysWOW64\CTxfispi.exe (Creative Technology Ltd) PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd) PRC - C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe (Realtime Soft Ltd) PRC - C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.) ========== Modules (No Company Name) ========== MOD - D:\Programme\Opera\gstreamer\plugins\gstoggdec.dll () MOD - D:\Programme\Opera\gstreamer\plugins\gstwebmdec.dll () MOD - D:\Programme\Opera\gstreamer\plugins\gstffmpegcolorspace.dll () MOD - D:\Programme\Opera\gstreamer\plugins\gstwavparse.dll () MOD - D:\Programme\Opera\gstreamer\plugins\gstdirectsound.dll () MOD - D:\Programme\Opera\gstreamer\plugins\gstdecodebin2.dll () MOD - D:\Programme\Opera\gstreamer\plugins\gstautodetect.dll () MOD - D:\Programme\Opera\gstreamer\plugins\gstwaveform.dll () MOD - D:\Programme\Opera\gstreamer\plugins\gsttypefindfunctions.dll () MOD - D:\Programme\Opera\gstreamer\gstreamer.dll () MOD - D:\Programme\Opera\gstreamer\plugins\gstcoreplugins.dll () MOD - D:\Programme\Opera\gstreamer\plugins\gstaudioresample.dll () MOD - D:\Programme\Opera\gstreamer\plugins\gstaudioconvert.dll () MOD - D:\Programme\avast Antivirus\aswOtl.dll () MOD - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL () MOD - D:\Programme\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll () MOD - C:\Windows\SysWOW64\APOMngr.DLL () MOD - D:\Programme\Samsung\Samsung PC Studio 7\PCSCM_Samsung.dll () MOD - D:\Programme\Microsoft Office\Office12\ADDINS\ColleagueImport.dll () MOD - C:\Windows\SysWOW64\CmdRtr.DLL () MOD - D:\Programme\Samsung\Samsung PC Studio 7\PhoneBrowser.dll () ========== Services (SafeList) ========== SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (Hamachi2Svc) -- D:\Programme\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.) SRV - (avast! Antivirus) -- D:\Programme\avast Antivirus\AvastSvc.exe (AVAST Software) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (HiPatchService) -- D:\Spiele\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios) SRV - (SkypeUpdate) -- D:\Programme\Skype\Updater\Updater.exe (Skype Technologies) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.) SRV - (wampmysqld) -- c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe () SRV - (Giraffic) -- C:\Program Files (x86)\Giraffic\Veoh_GirafficWatchdog.exe (Giraffic) SRV - (Dyn Updater) -- D:\Programme\DynDNS Updater\DynUpSvc.exe (Dyn, Inc.) SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs) SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs) SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.) SRV - (wampapache) -- c:\wamp\bin\apache\Apache2.2.21\bin\httpd.exe (Apache Software Foundation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia.) ========== Driver Services (SafeList) ========== DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software) DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software) DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software) DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software) DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software) DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software) DRV:64bit: - (EuMusDesignVirtualAudioCableWdm) -- C:\Windows\SysNative\drivers\vrtaucbl.sys (Eugene V. Muzychenko) DRV:64bit: - (aswKbd) -- C:\Windows\SysNative\drivers\aswKbd.sys (AVAST Software) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices) DRV:64bit: - (amd_xata) -- C:\Windows\SysNative\drivers\amd_xata.sys (Advanced Micro Devices) DRV:64bit: - (amd_sata) -- C:\Windows\SysNative\drivers\amd_sata.sys (Advanced Micro Devices) DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.) DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.) DRV:64bit: - (taphss) -- C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc) DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation) DRV:64bit: - (ssadbus) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation) DRV:64bit: - (ssadmdfl) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (LGBusEnum) -- C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.) DRV:64bit: - (LGVirHid) -- C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.) DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG) DRV:64bit: - (sscemdm) -- C:\Windows\SysNative\drivers\sscemdm.sys (MCCI Corporation) DRV:64bit: - (ssceserd) -- C:\Windows\SysNative\drivers\ssceserd.sys (MCCI Corporation) DRV:64bit: - (sscebus) -- C:\Windows\SysNative\drivers\sscebus.sys (MCCI Corporation) DRV:64bit: - (androidusb) -- C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc) DRV:64bit: - (sscemdfl) -- C:\Windows\SysNative\drivers\sscemdfl.sys (MCCI Corporation) DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation) DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation) DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation) DRV:64bit: - (vpcuxd) -- C:\Windows\SysNative\drivers\vpcuxd.sys (Microsoft Corporation) DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions) DRV:64bit: - (ha20x22k) -- C:\Windows\SysNative\drivers\ha20x22k.sys (Creative Technology Ltd) DRV:64bit: - (ha20x2k) -- C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd) DRV:64bit: - (emupia) -- C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd) DRV:64bit: - (ctsfm2k) -- C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd) DRV:64bit: - (ctprxy2k) -- C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd) DRV:64bit: - (ossrv) -- C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.) DRV:64bit: - (ctaud2k) -- C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd) DRV:64bit: - (ctac32k) -- C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd) DRV:64bit: - (CTEXFIFX.SYS) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.) DRV:64bit: - (CTEXFIFX) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.) DRV:64bit: - (CTHWIUT.SYS) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.) DRV:64bit: - (CTHWIUT) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.) DRV:64bit: - (CT20XUT.SYS) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.) DRV:64bit: - (CT20XUT) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.) DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie64.sys (Advanced Micro Devices Inc.) DRV:64bit: - (Revoflt) -- C:\Windows\SysNative\drivers\revoflt.sys (VS Revo Group) DRV:64bit: - (lowcdc) -- C:\Windows\SysNative\drivers\lowcdc.sys (hxxp://www.recursion.jp/avrcdc/) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (grmnusb) -- C:\Windows\SysNative\drivers\grmnusb.sys (GARMIN Corp.) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation ) DRV:64bit: - (VCSVADHWSer) -- C:\Windows\SysNative\drivers\vcsvad.sys (Avnex) DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia) DRV:64bit: - (nmwcdsax64) -- C:\Windows\SysNative\drivers\nmwcdsax64.sys (Nokia) DRV:64bit: - (nmwcdsacjx64) -- C:\Windows\SysNative\drivers\nmwcdsacjx64.sys (Nokia) DRV:64bit: - (nmwcdsacx64) -- C:\Windows\SysNative\drivers\nmwcdsacx64.sys (Nokia) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (UltraMonUtility) -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys (Realtime Soft Ltd) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 51 07 D0 4F 35 A4 CD 01 [binary data] IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{3D336522-0C99-4412-B500-3472495092DA}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul" FF - prefs.js..extensions.enabledAddons: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1 FF - prefs.js..extensions.enabledAddons: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.22.1 FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10 FF - prefs.js..extensions.enabledAddons: {dc572301-7619-498c-a57d-39143191b318}:0.4.0.3 FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.3 FF - prefs.js..extensions.enabledAddons: yetanothersmoothscrolling@kataho:3.0.24 FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.3 FF - prefs.js..extensions.enabledAddons: {64161300-e22b-11db-8314-0800200c9a66}:0.9.6.10 FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google) FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll () FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\meric\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.08.05 04:20:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: D:\Programme\avast Antivirus\WebRep\FF [2012.09.07 06:02:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.09.07 19:37:15 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.09.07 19:37:15 | 000,000,000 | ---D | M] [2011.02.19 06:14:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Extensions [2012.10.10 14:30:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions [2011.08.26 14:05:17 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2011.06.29 22:54:50 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055} [2012.09.16 02:47:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012.10.02 23:00:12 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\foxyproxy-basic@eric.h.jung [2012.09.15 12:21:45 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\ich@maltegoetz.de [2012.02.23 17:04:32 | 000,164,722 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\compatibility@addons.mozilla.org.xpi [2012.10.10 04:24:53 | 001,626,141 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\firebug@software.joehewitt.com.xpi [2012.09.15 12:21:45 | 000,066,522 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\yetanothersmoothscrolling@kataho.xpi [2012.10.10 14:30:49 | 000,281,285 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi [2012.10.10 04:24:51 | 000,529,404 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012.09.05 13:40:27 | 001,268,546 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi [2012.07.25 05:41:33 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011.11.05 14:28:38 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2012.07.21 13:05:28 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2012.09.13 01:44:36 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2012.10.03 12:46:51 | 000,257,937 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: chrome://speeddial/content/speeddial.xul CHR - plugin: Shockwave Flash (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin7.dll CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\np-mswmp.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\pdf.dll CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll CHR - plugin: Picasa (Enabled) = D:\Programme\Google\Picasa3\npPicasa3.dll CHR - plugin: iTunes Application Detector (Enabled) = D:\Programme\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.1_0\ CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.2_0\ CHR - Extension: Turn Off the Lights = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.0.0.81_0\ CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\ CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\~ CHR - Extension: SmoothScroll = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cccpiddacjljmfbbgeimpelpndgpoknn\1.0.6_0\ CHR - Extension: Adblock Plus f\u00FCr Google Chrome\u2122 (Beta) = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.1.3_0\ CHR - Extension: Session Buddy = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko\2.1.2_0\ CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.199_0\ CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.52_0\ CHR - Extension: AdBlock = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.33_0\ CHR - Extension: avast! WebRep = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\ CHR - Extension: Speed Dial 2 = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik\1.6.0.8_0\ CHR - Extension: Smooth Gestures = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld\0.15.4.13_0\ CHR - Extension: GC little helper = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nagohipignfajbmgdcedbnmafoebnnjg\1.0_0\ CHR - Extension: New Tabs Always Last = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nldmhfnlbkkdhboedalogjpeedjbmjgi\0.1_0\ CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\ O1 HOSTS File: ([2012.10.10 15:46:01 | 000,002,688 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 clients.your-server.de O1 - Hosts: 127.0.0.1 your-server.de O1 - Hosts: 127.0.0.1 rackcentre.redstation.net.uk O1 - Hosts: 127.0.0.1 redstation.net.uk O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software) O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software) O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software) O4:64bit: - HKLM..\Run: [EvtMgr6] D:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) O4 - HKLM..\Run: [avast] D:\Programme\avast Antivirus\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [VirtualCloneDrive] D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG) O4 - HKU\.DEFAULT..\Run: [Samsung.PCSync] D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe (Time Information Services Ltd.) O4 - HKU\S-1-5-18..\Run: [Samsung.PCSync] D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe (Time Information Services Ltd.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\launch.jnlp () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1 O8:64bit: - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta () O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites) O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites) O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites) O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites) O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites) O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites) O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites) O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites) O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in ) O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in ) O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in ) O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in ) O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in ) O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in ) O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in ) O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in ) O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab (Creative Software AutoUpdate Support Package) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\gopher - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\AutorunsDisabled: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell - "" = AutoRun O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell\AutoRun\command - "" = H:\iStudio.exe O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell - "" = AutoRun O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell\AutoRun\command - "" = G:\start.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.10.10 16:53:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe [2012.10.10 16:33:54 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\OSAM [2012.10.10 16:13:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe [2012.10.10 16:01:56 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Malwarebytes [2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.10.10 16:01:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.10.10 15:20:59 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\backups [2012.10.10 15:01:33 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe [2012.10.10 14:46:18 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll [2012.10.10 14:46:17 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll [2012.10.10 14:46:17 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe [2012.10.10 14:46:17 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll [2012.10.10 14:46:14 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll [2012.10.10 14:46:13 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2012.10.10 14:46:13 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll [2012.10.10 14:46:13 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2012.10.10 14:46:12 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll [2012.10.10 14:46:12 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll [2012.10.10 14:46:12 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2012.10.10 14:46:12 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2012.10.10 14:46:12 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll [2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll [2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.10.10 14:46:11 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll [2012.10.10 14:46:10 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll [2012.10.10 14:46:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll [2012.10.10 14:46:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll [2012.10.10 14:46:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll [2012.10.10 14:46:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll [2012.10.10 14:46:07 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll [2012.10.10 14:46:07 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll [2012.10.10 14:46:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll [2012.10.10 14:46:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll [2012.10.10 14:46:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll [2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll [2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll [2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll [2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll [2012.10.10 14:46:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2012.10.10 14:45:24 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2012.10.10 14:45:23 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2012.10.10 14:45:01 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll [2012.10.10 14:44:21 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2012.10.10 14:44:20 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2012.10.10 14:44:19 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\SCE [2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Crash [2012.10.05 17:44:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Logishrd [2012.10.03 16:44:17 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX [2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Xara [2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\MAGIX [2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Xara [2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xara [2012.09.29 15:31:59 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Solid State Networks [2012.09.29 15:31:52 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Meteor Entertainment [2012.09.27 00:02:30 | 000,000,000 | ---D | C] -- C:\Windows\rescache [2012.09.26 11:14:27 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe [2012.09.22 11:51:09 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.09.22 11:51:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.09.22 11:51:08 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.09.22 11:51:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.09.22 11:51:08 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.09.22 11:51:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.09.22 11:51:07 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.09.22 11:51:07 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.09.22 11:51:07 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.09.22 11:51:07 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.09.22 11:51:06 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.09.22 11:51:06 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2012.09.22 11:51:04 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.09.22 11:51:04 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.09.22 11:51:04 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2012.09.19 10:02:08 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys [2012.09.19 10:02:06 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys [2012.09.15 03:50:21 | 000,000,000 | --SD | C] -- C:\Users\meric\Documents\Eigene Datenquellen [2012.09.12 12:44:00 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys [2012.09.12 12:43:59 | 000,574,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll [2012.09.12 12:43:58 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys [2012.09.12 12:43:58 | 000,288,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe [2012.10.10 16:13:21 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe [2012.10.10 16:12:58 | 000,007,624 | ---- | M] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg [2012.10.10 16:06:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.10.10 16:02:47 | 000,646,577 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png [2012.10.10 15:03:31 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.10.10 15:03:31 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.10.10 15:01:34 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe [2012.10.10 14:56:58 | 000,000,306 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job [2012.10.10 14:55:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.10.10 14:55:00 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys [2012.10.10 14:54:26 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.10.10 14:54:26 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.10.10 14:54:26 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.10.10 01:34:04 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2012.10.09 18:10:11 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt [2012.10.09 17:14:28 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.10.09 17:14:28 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.10.08 09:04:12 | 000,053,095 | ---- | M] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf [2012.10.07 04:56:54 | 000,000,707 | ---- | M] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk [2012.10.05 17:45:08 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys [2012.10.05 14:01:11 | 004,977,352 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.10.03 17:07:09 | 000,010,387 | ---- | M] () -- C:\Users\meric\Desktop\sdfsdf.png [2012.10.01 23:26:20 | 001,517,344 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.10.01 23:26:20 | 000,653,918 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.10.01 23:26:20 | 000,614,770 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.10.01 23:26:20 | 000,129,718 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.10.01 23:26:20 | 000,106,012 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.10.01 21:13:21 | 001,594,114 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.10.01 21:13:08 | 000,265,598 | ---- | M] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip [2012.09.26 18:33:12 | 000,617,992 | ---- | M] () -- C:\Users\meric\Desktop\parken.jpg [2012.09.25 16:47:17 | 000,000,248 | ---- | M] () -- C:\Users\meric\Desktop\dbscheme.ase [2012.09.24 23:15:52 | 000,176,169 | ---- | M] () -- C:\Users\meric\Desktop\gangnamstyle.mp3 [2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys [2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys [2012.09.10 17:47:29 | 000,000,852 | ---- | M] () -- C:\Users\meric\Desktop\DayZ Commander.lnk [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.10.10 16:02:46 | 000,646,577 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png [2012.10.08 09:04:11 | 000,053,095 | ---- | C] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf [2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk [2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2 Beta.lnk [2012.10.03 17:05:26 | 000,010,387 | ---- | C] () -- C:\Users\meric\Desktop\sdfsdf.png [2012.10.01 21:13:24 | 000,265,598 | ---- | C] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip [2012.09.29 16:22:19 | 001,594,114 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.09.26 18:33:09 | 000,617,992 | ---- | C] () -- C:\Users\meric\Desktop\parken.jpg [2012.09.25 16:47:16 | 000,000,248 | ---- | C] () -- C:\Users\meric\Desktop\dbscheme.ase [2012.09.24 23:15:51 | 000,176,169 | ---- | C] () -- C:\Users\meric\Desktop\gangnamstyle.mp3 [2012.05.29 19:59:33 | 000,003,193 | ---- | C] () -- C:\Users\meric\.TransferManager.db [2012.05.14 04:45:43 | 000,000,703 | ---- | C] () -- C:\Windows\NewsRover.INI [2012.03.26 01:16:02 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2012.03.26 01:16:02 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2012.03.03 16:30:28 | 000,577,536 | ---- | C] () -- C:\Windows\SysWow64\ChilkatCsv.dll [2012.02.29 18:14:42 | 000,000,060 | ---- | C] () -- C:\Windows\picture2avi.ini [2011.10.15 15:41:55 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL [2011.10.15 14:24:42 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2011.10.15 14:24:42 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.09.22 12:29:58 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.09.19 09:07:46 | 000,015,360 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll [2011.09.19 09:07:32 | 000,058,368 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll [2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2011.09.14 11:36:30 | 000,000,184 | ---- | C] () -- C:\Users\meric\AppData\Roaming\3a99ed39.dat [2011.05.12 01:10:29 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Roaming\winscp.rnd [2011.04.22 01:53:09 | 000,010,240 | ---- | C] () -- C:\Users\meric\qlgt.db [2011.04.17 18:34:36 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe GIF Format CS5 Prefs [2011.04.16 16:16:51 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2011.04.03 20:23:51 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll [2011.03.10 22:53:14 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Local\PUTTY.RND [2011.03.05 00:41:26 | 000,007,624 | ---- | C] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg [2011.02.25 07:51:49 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe PNG Format CS5 Prefs [2011.02.19 19:30:01 | 000,281,120 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.02.19 19:30:00 | 000,837,192 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2011.02.19 19:30:00 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2011.11.22 23:53:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft [2011.11.22 23:47:21 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - 1.0 aktuell [2011.03.04 13:23:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - john smith texture pack v7 [2011.03.04 13:22:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - misa's texture pack [2012.09.24 23:28:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Audacity [2011.05.04 21:05:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Avnex [2012.04.28 05:12:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\BANDISOFT [2011.10.20 05:29:38 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Beat Hazard [2011.04.13 03:07:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Bridge! [2011.03.02 21:12:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Canon [2011.04.15 21:18:40 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2011.02.19 18:04:10 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\DAEMON Tools Lite [2012.03.03 21:42:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\EurekaLog [2012.06.27 14:44:30 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\FileZilla [2011.08.21 15:46:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\flightgear.org [2011.02.26 21:08:06 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GARMIN [2012.03.03 16:51:09 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GeoSetter [2011.02.21 19:32:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GetRight [2011.08.15 02:12:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GlarySoft [2012.05.17 19:30:34 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GrabIt [2012.07.17 17:53:03 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\gslist [2011.12.27 20:46:27 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Highresolution Enterprises [2012.05.29 13:49:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ijjigame [2011.02.23 18:24:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ImgBurn [2011.04.14 01:02:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JAM Software [2011.09.22 13:04:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JOSM [2011.02.19 05:17:20 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Leadertech [2012.07.13 21:51:22 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient [2012.06.04 00:45:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient2 [2012.10.03 16:44:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\MAGIX [2011.04.15 02:06:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\mirkes.de [2011.02.20 07:14:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Mp3tag [2011.03.12 16:55:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1 [2011.02.20 02:07:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Notepad++ [2011.06.05 16:36:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\OpenOffice.org [2011.02.26 20:56:52 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Opera [2011.04.15 20:58:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PACE Anti-Piracy [2011.03.18 19:27:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PC Suite [2011.02.24 18:28:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\POV-Ray [2011.11.20 03:52:57 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\pymclevel [2011.10.20 21:30:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Samsung [2012.07.17 03:41:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-updater [2012.07.17 02:38:53 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-zsync [2012.07.16 00:15:08 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\SplitMediaLabs [2012.06.02 14:43:42 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Spotify [2011.02.23 16:52:00 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2011.08.21 15:45:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Subversion [2011.08.03 23:55:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\System [2012.06.03 21:03:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\TeamViewer [2012.07.10 13:32:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Temp [2012.05.17 19:14:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Thunderbird [2011.08.11 02:27:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Tropico 4 Demo [2012.06.29 19:17:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ts3overlay [2011.10.07 23:33:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Unity [2011.08.15 02:26:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\uTorrent [2012.04.30 15:42:37 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Wireshark [2011.10.19 18:15:14 | 000,000,000 | -HSD | M] -- C:\Users\meric\AppData\Roaming\wyUpdate AU [2012.01.19 23:25:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\XMedia Recode ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 1225 bytes -> C:\Users\meric\AppData\Local\1vCCkxoreGSr:LmKM0wxK1yKopb7y44SV8UUG @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:5F64C164 @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:9D1B94FD < End of report > Code:
ATTFilter 7-Zip 9.20 (x64 edition) Igor Pavlov 15.09.2011 4,53MB 9.20.00.0 ABC Amber Nokia Converter 23.05.2012 Adobe AIR Adobe Systems Incorporated 02.12.2011 3.1.0.4880 Adobe Community Help Adobe Systems Incorporated 22.02.2011 3.0.0.400 Adobe Creative Suite 5 Master Collection Adobe Systems Incorporated 22.02.2011 8,46GB 5.0 Adobe Flash Media Live Encoder 3.2 Adobe Systems Incorporated 16.08.2011 14,0MB 3.2.0 Adobe Flash Player 11 ActiveX Adobe Systems Incorporated 09.10.2012 6,00MB 11.4.402.287 Adobe Flash Player 11 Plugin Adobe Systems Incorporated 09.10.2012 6,00MB 11.4.402.287 Adobe Media Player Adobe Systems Incorporated 22.02.2011 1.8 Adobe Reader X (10.1.4) - Deutsch Adobe Systems Incorporated 24.08.2012 169MB 10.1.4 Adobe Shockwave Player 11.6 Adobe Systems, Inc. 27.07.2012 11.6.5.635 AMD Catalyst Install Manager Advanced Micro Devices, Inc. 03.03.2012 26,2MB 3.0.859.0 Apple Application Support Apple Inc. 08.08.2011 60,1MB 2.0.1 Apple Mobile Device Support Apple Inc. 20.02.2011 22,3MB 3.3.1.3 Apple Software Update Apple Inc. 08.08.2011 2,38MB 2.1.3.127 ArmA 2 Uninstall 16.07.2012 ARMA 2: Operation Arrowhead Bohemia Interactive 16.07.2012 Audacity 2.0 Audacity Team 09.08.2012 42,8MB Audiosurf All of Nothing 21.10.2011 204MB 33 AutoHotkey 1.0.48.05 Chris Mallett 15.04.2011 1.0.48.05 avast! Free Antivirus AVAST Software 07.09.2012 7.0.1466.0 bada SDK 2.0.5 Samsung Electronics Co., Ltd. 09.06.2012 2.0.5 Bandicam Bandisoft.com 28.04.2012 Bandisoft MPEG-1 Decoder 28.04.2012 Battlelog Web Plugins EA Digital Illusions CE AB 29.09.2011 0.80.0 BattlEye for OA Uninstall 21.07.2012 Biet-O-Matic v2.14.8 BOM Development Team 03.04.2011 Biet-O-Matic v2.14.8 Boks UNKNOWN 12.03.2011 0.5.8 Canon IJ Network Scan Utility 23.02.2011 Canon IJ Network Tool 23.02.2011 Canon MP Navigator EX 2.0 23.02.2011 Canon MP620 series MP Drivers 23.02.2011 CCleaner Piriform 24.09.2012 3.23 Creative Audio-Systemsteuerung Creative Technology Limited 15.10.2011 3.00 Creative Software AutoUpdate Creative Technology Limited 15.10.2011 1.40 Creative Sound Blaster Properties x64 Edition Creative Technology Limited 15.10.2011 1.02 DayZ Commander Dotjosh Open Source 17.07.2012 2,86MB 1.09.39 Deus Ex - Human Revolution version 1.0 Square Enix 31.08.2011 1.0 DivX-Setup DivX, LLC 05.08.2011 2.6.0.34 Driver Sweeper Version 3.2.0 Phyxion.net 15.10.2011 13,0MB 3.2.0 DTS Connect Pack Creative Technology Limited 15.10.2011 1.00 Dyn Updater Dyn, Inc. 18.11.2011 4.1.10 EOSInfo astrojargon.net 22.05.2011 1,66MB 0.2.0 ESN Sonar ESN Social Software AB 29.09.2011 0.70.0 FastStone Image Viewer 4.3 FastStone Soft 23.02.2011 4.3 FileZilla Client 3.4.0 07.10.2012 3.4.0 Fraps (remove only) 16.03.2011 FWTools 2.4.7 22.04.2011 Garmin Communicator Plugin Garmin Ltd or its subsidiaries 24.03.2011 11,6MB 2.9.3 Garmin MapSource Garmin Ltd or its subsidiaries 23.02.2011 59,4MB 6.16.3 Garmin USB Drivers Garmin Ltd or its subsidiaries 25.10.2011 121KB 2.3.0.0 GeoSetter 3.4.16 Friedemann Schmidt 18.12.2011 28,1MB Glary Utilities 2.38.0.1288 Glarysoft Ltd 22.10.2011 22,1MB 2.38.0.1288 Google Chrome Google Inc. 15.06.2011 17.0.963.78 Google Earth Google 17.11.2011 92,7MB 6.1.0.5001 Google Talk Plugin Google 17.01.2012 18,9MB 2.6.1.5251 GPS-Track-Analyse.NET 6.0 15.07.2011 6,72MB GrabIt 1.7.2 Beta 6 (build 1008) Ilan Shemes 12.05.2012 7,38MB GSAK 8.1.0.10 (Final) CWE computer services 03.03.2012 42,1MB Hawken Meteor Entertainment 07.10.2012 1,34GB Hi-Rez Studios Authenticate and Update Service Hi-Rez Studios 15.07.2012 3.0.0.0 ImageShack Uploader 2.2.0 ImageShack Corp. 28.06.2011 26,3MB 2.2.0 ImgBurn LIGHTNING UK! 24.08.2012 2.5.7.0 Internet-TV für Windows Media Center Microsoft Corporation 14.03.2011 13,6MB 4.2.2.0 iTunes Apple Inc. 20.02.2011 145MB 10.1.2.17 iTunes Library Updater N/A 21.02.2011 1,86MB 1.2.2 Java(TM) 6 Update 31 Oracle 20.02.2012 97,2MB 6.0.310 Java(TM) 6 Update 31 (64-bit) Oracle 20.02.2012 91,8MB 6.0.310 JDownloader AppWork UG (haftungsbeschränkt) 24.02.2011 JOSM 4399 The OpenStreetMap developer community, hxxp://www.openstreetmap.org/ 22.09.2011 4399 Kies Air Discovery Service Samsung 07.10.2012 LAME v3.98.3 for Audacity 24.10.2011 1,16MB League of Legends Riot Games 03.06.2012 1.3 LightScribe Applications LightScribe 24.02.2012 12,6MB 1.18.15.1 LightScribe System Software LightScribe 24.02.2012 26,3MB 1.18.24.1 LightScribe Template Designs - Music Pack 1 LightScribe 24.02.2012 3,12MB 1.15.0.0 LightScribe Template Labeler LightScribe 24.02.2012 22,6MB 1.18.24.1 Logitech Gaming Software 8.20 Logitech Inc. 04.01.2012 76,6MB 8.20.74 Logitech MouseWare 9.79.1 19.02.2011 Logitech SetPoint 6.32 Logitech 05.10.2012 39,0MB 6.32.20 LogMeIn Hamachi LogMeIn, Inc. 30.08.2012 2.1.0.215 Malwarebytes Anti-Malware Version 1.65.0.1400 Malwarebytes Corporation 10.10.2012 19,3MB 1.65.0.1400 Mass Effect 2 Electronic Arts, Inc. 04.03.2012 1.02 Microsoft .NET Framework 4 Client Profile Microsoft Corporation 01.10.2012 38,8MB 4.0.30319 Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 20.10.2011 2,93MB 4.0.30320 Microsoft .NET Framework 4 Extended DEU Language Pack Microsoft Corporation 29.09.2012 10,6MB 4.0.30319 Microsoft Games for Windows - LIVE Redistributable Microsoft Corporation 14.03.2012 31,3MB 3.5.92.0 Microsoft Games for Windows Marketplace Microsoft Corporation 06.05.2011 6,03MB 3.5.50.0 Microsoft Office Enterprise 2007 Microsoft Corporation 22.01.2012 12.0.6612.1000 Microsoft Office File Validation Add-In Microsoft Corporation 15.09.2011 7,95MB 14.0.5130.5003 Microsoft Office Live Add-in 1.5 Microsoft Corporation 18.04.2012 508KB 2.0.4024.1 Microsoft Silverlight Microsoft Corporation 11.05.2012 100MB 5.1.10411.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 24.01.2012 250KB 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 15.06.2011 300KB 8.0.61001 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 Microsoft Corporation 13.04.2011 790KB 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Corporation 13.04.2011 598KB 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 19.02.2011 252KB 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 19.02.2011 788KB 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 15.06.2011 788KB 9.0.30729.6161 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Corporation 07.10.2011 222KB 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 19.02.2011 240KB 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 19.02.2011 596KB 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 15.06.2011 600KB 9.0.30729.6161 Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Corporation 30.09.2012 13,8MB 10.0.40219 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 20.08.2011 15,0MB 10.0.40219 Microsoft XNA Framework Redistributable 4.0 Microsoft Corporation 13.07.2011 9,17MB 4.0.20823.0 Miranda IM 0.10.4 Miranda IM Project 02.10.2012 0.10.4 mIRC mIRC Co. Ltd. 02.07.2012 7.25 Mozilla Firefox 15.0.1 (x86 de) Mozilla 07.10.2012 41,7MB 15.0.1 Mozilla Firefox 6.0 (x86 de) Mozilla 14.08.2011 34,5MB 6.0 Mp3tag v2.48 Florian Heidenreich 20.02.2011 v2.48 MSXML 4.0 SP2 (KB954430) Microsoft Corporation 14.07.2011 1,27MB 4.20.9870.0 MSXML 4.0 SP2 (KB973688) Microsoft Corporation 14.07.2011 1,33MB 4.20.9876.0 MSXML 4.0 SP2 Parser and SDK Microsoft Corporation 18.03.2011 1,22MB 4.20.9818.0 MSXML 4.0 SP3 Parser Microsoft Corporation 03.10.2012 1,47MB 4.30.2100.0 MSXML 4.0 SP3 Parser (KB2721691) Microsoft Corporation 04.10.2012 1,53MB 4.30.2114.0 NAVIGON Fresh 3.4.1 NAVIGON 25.05.2012 3.4.1 Notepad++ 20.02.2011 5.8.7 NVIDIA Grafiktreiber 301.42 NVIDIA Corporation 02.06.2012 301.42 NVIDIA PhysX-Systemsoftware 9.12.0213 NVIDIA Corporation 02.06.2012 9.12.0213 OpenAL 15.10.2011 OpenOffice.org 3.3 OpenOffice.org 05.06.2011 414MB 3.3.9567 Opera 12.02 Opera Software ASA 28.09.2012 12.02.1578 Pando Media Booster Pando Networks Inc. 03.06.2012 5,46MB 2.6.0.7 PC Connectivity Solution Nokia 18.08.2011 17,5MB 8.47.7.0 PDFCreator Frank Heindörfer, Philip Chinery 26.08.2011 1.2.2 Picasa 3 Google, Inc. 04.08.2011 3.8 PlanetSide 2 Beta Sony Online Entertainment 07.10.2012 POV-Ray for Windows v3.62 Persistence of Vision Raytracer Pty. Ltd. 24.02.2011 19,7MB 3.62 PunkBuster Services Even Balance, Inc. 29.09.2011 0.991 QLandkarte GT (remove only) 07.10.2012 QuickTime Apple Inc. 08.08.2011 73,0MB 7.70.80.34 RAD Video Tools 22.11.2011 Revo Uninstaller Pro 2.5.7 VS Revo Group, Ltd. 01.03.2012 54,2MB 2.5.7 SABnzbd 0.7.3 The SABnzbd Team 08.09.2012 28,9MB 0.7.3 Samsung Kies Samsung Electronics Co., Ltd. 20.10.2011 193MB 2.0.3.11082_152 Samsung PC Studio 7 Samsung 22.05.2012 7.2.20.9 SAMSUNG USB Driver for Mobile Phones SAMSUNG Electronics Co., Ltd. 27.09.2012 42,9MB 1.5.9.0 SamsungConnectivityCableDriver Samsung 22.05.2012 741KB 6.83.6.2.1 Sibelius Scorch (all browsers) Sibelius Software 26.02.2011 41,3MB 5.2.1 Sibelius Scorch (Firefox, Opera, Netscape only) Sibelius Software 26.02.2011 21,1MB 6.2.0 Six Updater Six Projects 25.07.2012 38,7MB 2.09.7016 Skype™ 5.10 Skype Technologies S.A. 27.07.2012 19,4MB 5.10.116 Sound Blaster X-Fi 15.10.2011 1.0 Spoiler Sync aRRKS 07.06.2011 3,99MB Spotify Spotify AB 15.05.2012 0.8.3.222.g317ab79d Stegano.Net Svenomenal.Net 07.10.2012 2.1.1.9 stolencamerafinder mattburns 07.10.2012 TeamSpeak 3 Client TeamSpeak Systems GmbH 07.10.2012 3.0.8.1 Topaz Adjust 4 Topaz Labs 03.02.2012 4.1.0 Topaz Adjust 4 (64-bit) Topaz Labs 03.02.2012 4.1.0 Topaz Adjust 4 (64-bit) 19.02.2011 Topaz Clean 3 Topaz Labs 03.02.2012 3.0.2 Topaz Clean 3 (64-bit) Topaz Labs 03.02.2012 3.0.2 Topaz Clean 3 (64-bit) 19.02.2011 Topaz DeJpeg 4 Topaz Labs 03.02.2012 4.0.2 Topaz DeJpeg 4 (64-bit) Topaz Labs 03.02.2012 4.0.2 Topaz DeJpeg 4 (64-bit) 19.02.2011 Topaz DeNoise 5 Topaz Labs 03.02.2012 5.0.1 Topaz DeNoise 5 (64-bit) 19.02.2011 Topaz DeNoise 5 (64-bit) Topaz Labs 03.02.2012 5.0.1 Topaz Detail 2 Topaz Labs 03.02.2012 2.0.5 Topaz Detail 2 (64-bit) Topaz Labs 03.02.2012 2.0.5 Topaz Detail 2 (64-bit) 19.02.2011 Topaz Fusion Express 2 Topaz Labs 03.02.2012 2.0.2 Topaz Fusion Express 2 (64-bit) Topaz Labs 03.02.2012 2.0.2 Topaz Fusion Express 2 (64-bit) 19.02.2011 Topaz InFocus Topaz Labs 03.02.2012 1.0.0 Topaz InFocus (64-bit) Topaz Labs 03.02.2012 1.0.0 Topaz InFocus (64-bit) 19.02.2011 Topaz Lens Effects Topaz Labs 03.02.2012 1.0.0 Topaz Lens Effects (64-bit) Topaz Labs 03.02.2012 1.0.0 Topaz Lens Effects (64-bit) 19.02.2011 Topaz ReMask 3 Topaz Labs 03.02.2012 3.1.0 Topaz ReMask 3 (64-bit) Topaz Labs 03.02.2012 3.1.0 Topaz ReMask 3 (64-bit) 19.02.2011 Topaz Simplify 3 Topaz Labs 03.02.2012 3.0.2 Topaz Simplify 3 (64-bit) Topaz Labs 03.02.2012 3.0.2 Topaz Simplify 3 (64-bit) 19.02.2011 Total Commander (Remove or Repair) Ghisler Software GmbH 12.03.2012 7.57a Tribes Ascend Hi-Rez Studios 15.07.2012 1.0.1016.7 TweetDeck Twitter, Inc. 14.02.2012 29,9MB 1.0.0 Ubisoft Game Launcher UBISOFT 21.08.2011 1.0.0.0 UltraMon Realtime Soft Ltd 28.01.2012 6,18MB 3.1.0 Unity Web Player Unity Technologies ApS 07.10.2012 12,0MB Veoh Giraffic Video Accelerator Giraffic 25.03.2012 0.86.192.230 Veoh Web Player Veoh Networks, Inc. 25.03.2012 1.1.2.0000 Virtual Audio Cable 4.10 26.07.2012 VirtualCloneDrive Elaborate Bytes 27.03.2011 VirtualDJ Home FREE Atomix Productions 29.02.2012 48,3MB 7.0.5 VLC media player 2.0.0 VideoLAN 19.02.2012 2.0.0 WampServer 2.2 Hervé Leclerc (HeL) 15.03.2012 225MB Winamp Nullsoft, Inc 12.03.2012 5.623 Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) Garmin 25.10.2011 06/03/2009 2.3.0.0 Windows Live ID Sign-in Assistant Microsoft Corporation 14.04.2011 10,0MB 6.500.3165.0 Windows Media Center Add-in for Silverlight Microsoft Corporation 14.03.2011 245KB 4.7.3.0 Windows Media Player Firefox Plugin Microsoft Corp 12.04.2011 296KB 1.0.0.8 Windows XP Mode Microsoft Corporation 26.04.2012 1,13GB 1.3.7600.16422 Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) Nokia 18.08.2011 08/22/2008 7.0.0.0 WinRAR 22.02.2011 WinSCP 4.3.7 Martin Prikryl 19.02.2012 8,76MB 4.3.7 WinUAE 2.3.3 Arabuusimiehet 19.01.2012 2.3.3 Wireshark 1.6.7 (64-bit) The Wireshark developer community, hxxp://www.wireshark.org 30.04.2012 80,9MB 1.6.7 XAMPP 1.7.4 14.03.2011 Xara 3D Maker 7 Xara Group Ltd 03.10.2012 7.0.0.415 XMedia Recode 3.0.7.0 Sebastian Dörfler 19.01.2012 3.0.7.0 xp-AntiSpy 3.97-11 Christian Taubenheim 01.03.2011 XSplit SplitMediaLabs 16.07.2012 47,8MB 1.0.1206.0203 Xvid Video Codec Xvid Team 26.03.2012 1.3.2 Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 17:45:19, on 10.10.2012 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v9.00 (9.00.8112.16450) Boot mode: Normal Running processes: D:\Programme\DynDNS Updater\DynTray.exe D:\Programme\VirtualCloneDrive\VCDDaemon.exe C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe D:\Programme\avast Antivirus\AvastUI.exe D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe C:\Windows\SysWOW64\CTXFISPI.EXE D:\Programme\Opera\opera.exe C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe C:\Windows\SysWOW64\NOTEPAD.EXE D:\Programme\Notepad++\notepad++.exe C:\Users\meric\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll O4 - HKLM\..\Run: [VirtualCloneDrive] "D:\Programme\VirtualCloneDrive\VCDDaemon.exe" /s O4 - HKLM\..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe -StartUpRun O4 - HKLM\..\Run: [avast] "D:\Programme\avast Antivirus\avastUI.exe" /nogui O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start O4 - HKUS\S-1-5-18\..\Run: [Samsung.PCSync] "D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe" /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Samsung.PCSync] "D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe" /NoDialog (User 'Default user') O4 - Startup: launch.jnlp O4 - Global Startup: Dyn Updater Tray Icon.lnk = D:\Programme\DynDNS Updater\DynTray.exe O4 - Global Startup: UltraMon.lnk = ? O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: avast! Antivirus - AVAST Software - D:\Programme\avast Antivirus\AvastSvc.exe O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe O23 - Service: Dyn Updater - Dyn, Inc. - D:\Programme\DynDNS Updater\DynUpSvc.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - D:\Programme\LogMeIn Hamachi\hamachi-2.exe O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - D:\Spiele\Hi-Rez Studios\HiPatchService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 9394 bytes  Geändert von meric (10.10.2012 um 17:04 Uhr) |
|
11.10.2012, 07:24
| #4 | |||
| /// Helfer-Team | Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) Systemreinigung und Prüfung: ► Wenn Du nun alle Schritte erledigt hast, melde dich mit die gewünschten Ergebnisse zurück! Nur bei Probleme inzwischen melden! 1. Deinstalliere - nicht empfohlen: Zitat:
Hinweis: Um den "Veoh Web Player" vollständig nutzen zu können, müssen Sie sich nach der Installation beim Hersteller mit einer E-Mail-Adresse registrieren. Während der Installation sollten Sie die angebotene Software abklicken, diese hat nichts mit dem eigentlichen Programm zu tun. Zudem empfehlen wir Ihnen, die ungefragt mitgelieferte Veoh-Toolbar gleich nach der Installation wieder aus dem System zu löschen. 2. Hast du es denn in der Hosts selbst eingetragen bzw absichtlich zugefügt? Wenn ja, warum? Code:
ATTFilter O1 - Hosts: 127.0.0.1 clients.your-server.de
O1 - Hosts: 127.0.0.1 your-server.de
O1 - Hosts: 127.0.0.1 rackcentre.redstation.net.uk
O1 - Hosts: 127.0.0.1 redstation.net.uk
Zitat:
Code:
ATTFilter :OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{3D336522-0C99-4412-B500-3472495092DA}: "URL" = http://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell - "" = AutoRun
O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell\AutoRun\command - "" = H:\iStudio.exe
O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell - "" = AutoRun
O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell\AutoRun\command - "" = G:\start.exe
@Alternate Data Stream - 1225 bytes -> C:\Users\meric\AppData\Local\1vCCkxoreGSr:LmKM0wxK1yKopb7y44SV8UUG
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:5F64C164
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:9D1B94FD
:Files
C:\Users\meric\AppData\Roaming\uTorrent
C:\Users\meric\AppData\Roaming\DAEMON Tools Lite
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
4. Hast Du zur Zone Vertrauenswürdige Sites absichtlich hinzugefügt? einer Reihe der von dir besuchten Websites vollständig vertrauen?: Zitat:
5. Deine Javaversion ist nicht aktuell! Da aufgrund alter Sicherheitslücken ist Java sehr anfällig, deinstalliere zunächst alle vorhandenen Java-Versionen: → Systemsteuerung → Software → deinstallieren... → Rechner neu aufstarten → Downloade nun die Offline-Version von Java "Empfohlen Version Java(TM) 7 Update 7 - von Oracle herunter Achte darauf, eventuell angebotene Toolbars abwählen (den Haken bei der Toolbar entfernen)! Tipp: -> Java-Updates konfigurieren 6. Aktualisieren: Code:
ATTFilter OpenOffice.org
Tipps - Der Internet Explorer von Microsoft gehört zur Grundausstattung unter Windows, somit wie alle andere installierte Software muss gepflegt werden! Auch bei Nicht-Verwendung!: -> Tipps zu Internet Explorer -> Standard Suchmaschine des Explorers ändern -> Ändern oder Auswählen eines Suchanbieters in Internet Explorer 7/8 -> Wie kann ich den Cache im Internet Explorer leeren? 8. Alle Programme/Fenster schliessen reinige dein System mit CCleaner:
9. Vorbereitung
Den PC NUR online scannen und NICHT ein zweites Antivirenprogramm installieren!!!
10. erneut einen Scan mit OTL:
► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?
__________________ Warnung!: Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein! Anhang nicht öffnen, in unserem Forum erst nachfragen! Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten! Bitte diese Warnung weitergeben, wo Du nur kannst! |
|
12.10.2012, 00:45
| #5 |
| | Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) 1. Hab den "Veoh Web Player" deinstalliert. Weiß selber nicht mehr so genau, warum der überhaupt drauf war. 2. Die Hosts hatte ich eingetrage, in der Hoffnung, dass mein Computer keine Verbindung mehr zu diesen herstellen kann. Hat aber nicht funktioniert. Hab die Einträge wieder entfernt. Allerdings haben die wohl über die Remotedesktopverbindung zugegriffen. Seit dem ich die deaktiviert hab, hatte ich keine Verbindung mehr von und zu diesen Hosts. 3. Hab OTL mit diesen Befehlen ausgeführt. Hier die Logdatei: Code:
ATTFilter OTL logfile created on: 11.10.2012 17:01:58 - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\meric\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 1,64 Gb Available Physical Memory | 40,95% Memory free 6,00 Gb Paging File | 3,86 Gb Available in Paging File | 64,33% Paging File free Paging file location(s): d:\pagefile.sys 2048 2048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 40,43 Gb Total Space | 2,29 Gb Free Space | 5,66% Space Free | Partition Type: NTFS Drive D: | 425,33 Gb Total Space | 30,44 Gb Free Space | 7,16% Space Free | Partition Type: NTFS Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe PRC - [2012.10.09 16:06:31 | 000,692,152 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe PRC - [2012.08.29 12:03:38 | 001,996,200 | ---- | M] (LogMeIn Inc.) -- D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe PRC - [2012.08.21 11:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastUI.exe PRC - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastSvc.exe PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynUpSvc.exe PRC - [2011.11.15 19:20:26 | 000,078,192 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynTray.exe PRC - [2011.03.07 15:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- D:\Programme\VirtualCloneDrive\VCDDaemon.exe PRC - [2010.07.07 21:27:16 | 001,268,224 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe PRC - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe PRC - [2009.12.21 09:00:50 | 000,081,920 | ---- | M] (Realtime Soft Ltd) -- C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe PRC - [2007.07.18 09:19:02 | 000,057,344 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe ========== Modules (No Company Name) ========== MOD - [2009.06.29 10:54:08 | 000,164,864 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL MOD - [2009.02.06 18:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL ========== Services (SafeList) ========== SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.10.09 17:14:30 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.09.15 02:02:29 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.08.29 12:03:36 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- D:\Programme\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- D:\Programme\avast Antivirus\AvastSvc.exe -- (avast! Antivirus) SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.12 15:16:56 | 000,008,704 | ---- | M] (Hi-Rez Studios) [On_Demand | Stopped] -- D:\Spiele\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService) SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- D:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2012.03.06 17:19:00 | 003,953,632 | ---- | M] (INCA Internet Co., Ltd.) [Disabled | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc) SRV - [2012.01.25 10:56:30 | 009,690,112 | ---- | M] () [On_Demand | Stopped] -- c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe -- (wampmysqld) SRV - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) [Auto | Running] -- D:\Programme\DynDNS Updater\DynUpSvc.exe -- (Dyn Updater) SRV - [2011.10.15 16:04:37 | 000,079,360 | ---- | M] (Creative Labs) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service) SRV - [2011.10.15 15:40:18 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service) SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2011.09.26 11:06:54 | 000,021,504 | ---- | M] (Apache Software Foundation) [On_Demand | Stopped] -- c:\wamp\bin\apache\Apache2.2.21\bin\httpd.exe -- (wampapache) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService) SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008.11.11 09:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) DRV:64bit: - [2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) DRV:64bit: - [2012.08.21 11:13:13 | 000,969,200 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx) DRV:64bit: - [2012.08.21 11:13:13 | 000,359,464 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP) DRV:64bit: - [2012.08.21 11:13:13 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi) DRV:64bit: - [2012.08.21 11:13:12 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt) DRV:64bit: - [2012.08.21 11:13:12 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr) DRV:64bit: - [2012.08.21 11:13:11 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk) DRV:64bit: - [2012.07.26 21:32:08 | 000,066,728 | ---- | M] (Eugene V. Muzychenko) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vrtaucbl.sys -- (EuMusDesignVirtualAudioCableWdm) DRV:64bit: - [2012.03.07 01:02:45 | 000,028,504 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswKbd.sys -- (aswKbd) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.11.16 15:35:58 | 000,054,400 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter) DRV:64bit: - [2011.10.29 03:41:28 | 000,042,624 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata) DRV:64bit: - [2011.10.29 03:41:26 | 000,080,512 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata) DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt) DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt) DRV:64bit: - [2011.07.26 19:49:12 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss) DRV:64bit: - [2011.06.02 07:47:22 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm) DRV:64bit: - [2011.06.02 07:47:22 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus) DRV:64bit: - [2011.06.02 07:47:22 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.02.19 05:18:18 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:64bit: - [2011.02.19 05:18:18 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid) DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone) DRV:64bit: - [2010.12.21 07:55:02 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdm.sys -- (sscemdm) DRV:64bit: - [2010.12.21 07:55:02 | 000,129,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssceserd.sys -- (ssceserd) DRV:64bit: - [2010.12.21 07:55:02 | 000,127,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscebus.sys -- (sscebus) DRV:64bit: - [2010.12.21 07:55:02 | 000,036,328 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadadb.sys -- (androidusb) DRV:64bit: - [2010.12.21 07:55:02 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdfl.sys -- (sscemdfl) DRV:64bit: - [2010.12.17 00:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2010.11.20 15:34:04 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm) DRV:64bit: - [2010.11.20 15:34:04 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus) DRV:64bit: - [2010.11.20 13:35:34 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb) DRV:64bit: - [2010.11.20 13:35:26 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpcuxd.sys -- (vpcuxd) DRV:64bit: - [2010.11.20 13:35:22 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr) DRV:64bit: - [2010.11.20 06:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 04:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.07.12 20:36:10 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2010.07.07 23:21:18 | 001,612,888 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x22k.sys -- (ha20x22k) DRV:64bit: - [2010.07.07 23:21:06 | 001,567,832 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k) DRV:64bit: - [2010.07.07 23:20:56 | 000,118,360 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia) DRV:64bit: - [2010.07.07 23:20:48 | 000,213,080 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k) DRV:64bit: - [2010.07.07 23:20:40 | 000,015,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k) DRV:64bit: - [2010.07.07 23:16:32 | 000,179,288 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv) DRV:64bit: - [2010.07.07 23:16:24 | 000,697,816 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k) DRV:64bit: - [2010.07.07 23:16:14 | 000,580,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k) DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX.SYS) DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX) DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT.SYS) DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT) DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT.SYS) DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT) DRV:64bit: - [2010.06.17 11:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) DRV:64bit: - [2009.12.30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt) DRV:64bit: - [2009.08.24 11:36:00 | 000,010,752 | ---- | M] (hxxp://www.recursion.jp/avrcdc/) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lowcdc.sys -- (lowcdc) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.05.08 17:08:00 | 000,020,520 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb) DRV:64bit: - [2009.03.18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2009.03.02 00:05:32 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer) DRV:64bit: - [2008.08.28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd) DRV:64bit: - [2007.05.02 16:34:30 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsax64.sys -- (nmwcdsax64) DRV:64bit: - [2007.05.02 16:33:38 | 000,017,408 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacjx64.sys -- (nmwcdsacjx64) DRV:64bit: - [2007.05.02 16:33:36 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacx64.sys -- (nmwcdsacx64) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2008.11.14 03:11:42 | 000,020,512 | ---- | M] (Realtime Soft Ltd) [Kernel | Auto | Running] -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys -- (UltraMonUtility) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 51 07 D0 4F 35 A4 CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul" FF - prefs.js..extensions.enabledAddons: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1 FF - prefs.js..extensions.enabledAddons: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.22.1 FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10 FF - prefs.js..extensions.enabledAddons: {dc572301-7619-498c-a57d-39143191b318}:0.4.0.3 FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.3 FF - prefs.js..extensions.enabledAddons: yetanothersmoothscrolling@kataho:3.0.24 FF - prefs.js..extensions.enabledAddons: {64161300-e22b-11db-8314-0800200c9a66}:0.9.6.10 FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.4 FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google) FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll () FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\meric\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.08.05 04:20:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: D:\Programme\avast Antivirus\WebRep\FF [2012.09.07 06:02:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M] [2011.02.19 06:14:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Extensions [2012.10.11 08:59:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions [2011.08.26 14:05:17 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2011.06.29 22:54:50 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055} [2012.09.16 02:47:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012.10.02 23:00:12 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\foxyproxy-basic@eric.h.jung [2012.09.15 12:21:45 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\ich@maltegoetz.de [2012.02.23 17:04:32 | 000,164,722 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\compatibility@addons.mozilla.org.xpi [2012.10.10 04:24:53 | 001,626,141 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\firebug@software.joehewitt.com.xpi [2012.09.15 12:21:45 | 000,066,522 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\yetanothersmoothscrolling@kataho.xpi [2012.10.10 14:30:49 | 000,281,285 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi [2012.10.10 04:24:51 | 000,529,404 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012.09.05 13:40:27 | 001,268,546 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi [2012.07.25 05:41:33 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011.11.05 14:28:38 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2012.07.21 13:05:28 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2012.09.13 01:44:36 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2012.10.11 08:59:30 | 000,252,340 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: chrome://speeddial/content/speeddial.xul CHR - plugin: Shockwave Flash (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin7.dll CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\np-mswmp.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\pdf.dll CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll CHR - plugin: Picasa (Enabled) = D:\Programme\Google\Picasa3\npPicasa3.dll CHR - plugin: iTunes Application Detector (Enabled) = D:\Programme\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.1_0\ CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.2_0\ CHR - Extension: Turn Off the Lights = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.0.0.81_0\ CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\ CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\~ CHR - Extension: SmoothScroll = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cccpiddacjljmfbbgeimpelpndgpoknn\1.0.6_0\ CHR - Extension: Adblock Plus f\u00FCr Google Chrome\u2122 (Beta) = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.1.3_0\ CHR - Extension: Session Buddy = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko\2.1.2_0\ CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.199_0\ CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.52_0\ CHR - Extension: AdBlock = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.33_0\ CHR - Extension: avast! WebRep = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\ CHR - Extension: Speed Dial 2 = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik\1.6.0.8_0\ CHR - Extension: Smooth Gestures = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld\0.15.4.13_0\ CHR - Extension: GC little helper = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nagohipignfajbmgdcedbnmafoebnnjg\1.0_0\ CHR - Extension: New Tabs Always Last = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nldmhfnlbkkdhboedalogjpeedjbmjgi\0.1_0\ CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\ O1 HOSTS File: ([2012.10.11 09:57:32 | 000,000,771 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software) O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software) O4:64bit: - HKLM..\Run: [EvtMgr6] D:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) O4 - HKLM..\Run: [avast] D:\Programme\avast Antivirus\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [VirtualCloneDrive] D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG) O4 - Startup: C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\launch.jnlp () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1 O8:64bit: - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta () O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab (Creative Software AutoUpdate Support Package) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\gopher - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\AutorunsDisabled: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.10.11 10:35:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2012.10.11 10:09:10 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4.1 [2012.10.11 10:05:34 | 001,034,216 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll [2012.10.11 10:05:34 | 000,289,768 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe [2012.10.11 10:05:29 | 000,189,416 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe [2012.10.11 10:05:29 | 000,188,904 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe [2012.10.11 10:05:29 | 000,108,008 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll [2012.10.11 10:05:17 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2012.10.11 10:04:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2012.10.11 10:04:29 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll [2012.10.11 10:04:29 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2012.10.11 10:04:21 | 000,095,208 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll [2012.10.11 10:04:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2012.10.11 09:26:20 | 000,000,000 | ---D | C] -- C:\_OTL [2012.10.10 17:38:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2012.10.10 17:38:39 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2012.10.10 17:38:22 | 003,941,312 | ---- | C] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe [2012.10.10 16:53:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe [2012.10.10 16:33:54 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\OSAM [2012.10.10 16:13:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe [2012.10.10 16:01:56 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Malwarebytes [2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.10.10 16:01:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.10.10 15:20:59 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\backups [2012.10.10 15:01:33 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe [2012.10.10 14:46:18 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll [2012.10.10 14:46:17 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll [2012.10.10 14:46:17 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe [2012.10.10 14:46:17 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll [2012.10.10 14:46:14 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll [2012.10.10 14:46:13 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2012.10.10 14:46:13 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll [2012.10.10 14:46:13 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2012.10.10 14:46:12 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll [2012.10.10 14:46:12 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll [2012.10.10 14:46:12 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2012.10.10 14:46:12 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2012.10.10 14:46:12 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll [2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll [2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.10.10 14:46:11 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll [2012.10.10 14:46:10 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll [2012.10.10 14:46:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll [2012.10.10 14:46:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll [2012.10.10 14:46:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll [2012.10.10 14:46:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll [2012.10.10 14:46:07 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll [2012.10.10 14:46:07 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll [2012.10.10 14:46:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll [2012.10.10 14:46:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll [2012.10.10 14:46:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll [2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll [2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll [2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll [2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll [2012.10.10 14:46:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2012.10.10 14:45:24 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2012.10.10 14:45:23 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2012.10.10 14:45:01 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll [2012.10.10 14:44:21 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2012.10.10 14:44:20 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2012.10.10 14:44:19 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\SCE [2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Crash [2012.10.05 17:44:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Logishrd [2012.10.03 16:44:17 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX [2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Xara [2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\MAGIX [2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Xara [2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xara [2012.09.29 15:31:59 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Solid State Networks [2012.09.29 15:31:52 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Meteor Entertainment [2012.09.26 11:14:27 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe [2012.09.22 11:51:09 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.09.22 11:51:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.09.22 11:51:08 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.09.22 11:51:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.09.22 11:51:08 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.09.22 11:51:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.09.22 11:51:07 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.09.22 11:51:07 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.09.22 11:51:07 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.09.22 11:51:07 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.09.22 11:51:06 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.09.22 11:51:06 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2012.09.22 11:51:04 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.09.22 11:51:04 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.09.22 11:51:04 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2012.09.19 10:02:08 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys [2012.09.19 10:02:06 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys [2012.09.15 03:50:21 | 000,000,000 | --SD | C] -- C:\Users\meric\Documents\Eigene Datenquellen [2012.09.12 12:44:00 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys [2012.09.12 12:43:59 | 000,574,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll [2012.09.12 12:43:58 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys [2012.09.12 12:43:58 | 000,288,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS ========== Files - Modified Within 30 Days ========== [2012.10.11 17:00:29 | 000,007,631 | ---- | M] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg [2012.10.11 16:06:27 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.10.11 10:29:42 | 000,000,306 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job [2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.10.11 10:16:56 | 004,983,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.10.11 10:16:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.10.11 10:16:32 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys [2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.10.11 10:15:59 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.10.11 10:13:46 | 000,376,550 | ---- | M] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg [2012.10.11 10:05:24 | 000,108,008 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll [2012.10.11 10:05:20 | 000,289,768 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe [2012.10.11 10:05:20 | 000,189,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe [2012.10.11 10:05:19 | 001,034,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll [2012.10.11 10:05:19 | 000,916,456 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll [2012.10.11 10:05:19 | 000,188,904 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe [2012.10.11 10:04:15 | 000,095,208 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll [2012.10.11 10:04:12 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2012.10.11 10:04:12 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2012.10.11 10:04:11 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2012.10.11 10:04:10 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll [2012.10.11 10:04:10 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll [2012.10.11 09:33:53 | 000,002,083 | ---- | M] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk [2012.10.10 20:56:20 | 000,986,624 | ---- | M] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi [2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.10.10 17:38:22 | 003,941,312 | ---- | M] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe [2012.10.10 17:00:10 | 000,856,244 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png [2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe [2012.10.10 16:13:21 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe [2012.10.10 16:02:47 | 000,646,577 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png [2012.10.10 15:01:34 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe [2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2012.10.09 18:10:11 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt [2012.10.09 17:14:28 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.10.09 17:14:28 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.10.08 09:04:12 | 000,053,095 | ---- | M] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf [2012.10.07 04:56:54 | 000,000,707 | ---- | M] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk [2012.10.05 17:45:08 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys [2012.10.03 17:07:09 | 000,010,387 | ---- | M] () -- C:\Users\meric\Desktop\sdfsdf.png [2012.10.01 23:26:20 | 001,517,344 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.10.01 23:26:20 | 000,653,918 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.10.01 23:26:20 | 000,614,770 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.10.01 23:26:20 | 000,129,718 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.10.01 23:26:20 | 000,106,012 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.10.01 21:13:21 | 001,594,114 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.10.01 21:13:08 | 000,265,598 | ---- | M] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip [2012.09.26 18:33:12 | 000,617,992 | ---- | M] () -- C:\Users\meric\Desktop\parken.jpg [2012.09.25 16:47:17 | 000,000,248 | ---- | M] () -- C:\Users\meric\Desktop\dbscheme.ase [2012.09.24 23:15:52 | 000,176,169 | ---- | M] () -- C:\Users\meric\Desktop\gangnamstyle.mp3 [2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys [2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys ========== Files Created - No Company Name ========== [2012.10.11 10:13:32 | 000,376,550 | ---- | C] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg [2012.10.11 09:33:53 | 000,002,083 | ---- | C] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk [2012.10.10 20:56:25 | 000,986,624 | ---- | C] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi [2012.10.10 17:00:10 | 000,856,244 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png [2012.10.10 16:02:46 | 000,646,577 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png [2012.10.08 09:04:11 | 000,053,095 | ---- | C] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf [2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk [2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2 Beta.lnk [2012.10.03 17:05:26 | 000,010,387 | ---- | C] () -- C:\Users\meric\Desktop\sdfsdf.png [2012.10.01 21:13:24 | 000,265,598 | ---- | C] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip [2012.09.29 16:22:19 | 001,594,114 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.09.26 18:33:09 | 000,617,992 | ---- | C] () -- C:\Users\meric\Desktop\parken.jpg [2012.09.25 16:47:16 | 000,000,248 | ---- | C] () -- C:\Users\meric\Desktop\dbscheme.ase [2012.09.24 23:15:51 | 000,176,169 | ---- | C] () -- C:\Users\meric\Desktop\gangnamstyle.mp3 [2012.05.29 19:59:33 | 000,003,193 | ---- | C] () -- C:\Users\meric\.TransferManager.db [2012.05.14 04:45:43 | 000,000,703 | ---- | C] () -- C:\Windows\NewsRover.INI [2012.03.26 01:16:02 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2012.03.26 01:16:02 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2012.03.03 16:30:28 | 000,577,536 | ---- | C] () -- C:\Windows\SysWow64\ChilkatCsv.dll [2012.02.29 18:14:42 | 000,000,060 | ---- | C] () -- C:\Windows\picture2avi.ini [2011.10.15 15:41:55 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL [2011.10.15 14:24:42 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2011.10.15 14:24:42 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.09.22 12:29:58 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.09.19 09:07:46 | 000,015,360 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll [2011.09.19 09:07:32 | 000,058,368 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll [2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2011.09.14 11:36:30 | 000,000,184 | ---- | C] () -- C:\Users\meric\AppData\Roaming\3a99ed39.dat [2011.05.12 01:10:29 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Roaming\winscp.rnd [2011.04.22 01:53:09 | 000,010,240 | ---- | C] () -- C:\Users\meric\qlgt.db [2011.04.17 18:34:36 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe GIF Format CS5 Prefs [2011.04.16 16:16:51 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2011.04.03 20:23:51 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll [2011.03.10 22:53:14 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Local\PUTTY.RND [2011.03.05 00:41:26 | 000,007,631 | ---- | C] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg [2011.02.25 07:51:49 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe PNG Format CS5 Prefs [2011.02.19 19:30:01 | 000,281,120 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.02.19 19:30:00 | 000,837,192 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2011.02.19 19:30:00 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2011.11.22 23:53:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft [2011.11.22 23:47:21 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - 1.0 aktuell [2011.03.04 13:23:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - john smith texture pack v7 [2011.03.04 13:22:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - misa's texture pack [2012.09.24 23:28:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Audacity [2011.05.04 21:05:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Avnex [2012.04.28 05:12:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\BANDISOFT [2011.10.20 05:29:38 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Beat Hazard [2011.04.13 03:07:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Bridge! [2011.03.02 21:12:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Canon [2011.04.15 21:18:40 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2012.03.03 21:42:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\EurekaLog [2012.10.11 10:12:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\FileZilla [2011.08.21 15:46:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\flightgear.org [2011.02.26 21:08:06 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GARMIN [2012.03.03 16:51:09 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GeoSetter [2011.02.21 19:32:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GetRight [2011.08.15 02:12:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GlarySoft [2012.05.17 19:30:34 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GrabIt [2012.07.17 17:53:03 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\gslist [2011.12.27 20:46:27 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Highresolution Enterprises [2012.05.29 13:49:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ijjigame [2011.02.23 18:24:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ImgBurn [2011.04.14 01:02:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JAM Software [2011.09.22 13:04:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JOSM [2011.02.19 05:17:20 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Leadertech [2012.07.13 21:51:22 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient [2012.06.04 00:45:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient2 [2012.10.03 16:44:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\MAGIX [2011.04.15 02:06:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\mirkes.de [2011.02.20 07:14:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Mp3tag [2011.03.12 16:55:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1 [2011.02.20 02:07:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Notepad++ [2011.06.05 16:36:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\OpenOffice.org [2011.02.26 20:56:52 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Opera [2011.04.15 20:58:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PACE Anti-Piracy [2011.03.18 19:27:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PC Suite [2011.02.24 18:28:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\POV-Ray [2011.11.20 03:52:57 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\pymclevel [2011.10.20 21:30:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Samsung [2012.07.17 03:41:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-updater [2012.07.17 02:38:53 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-zsync [2012.07.16 00:15:08 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\SplitMediaLabs [2012.06.02 14:43:42 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Spotify [2011.02.23 16:52:00 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2011.08.21 15:45:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Subversion [2011.08.03 23:55:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\System [2012.06.03 21:03:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\TeamViewer [2012.07.10 13:32:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Temp [2012.05.17 19:14:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Thunderbird [2011.08.11 02:27:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Tropico 4 Demo [2012.06.29 19:17:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ts3overlay [2011.10.07 23:33:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Unity [2012.04.30 15:42:37 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Wireshark [2011.10.19 18:15:14 | 000,000,000 | -HSD | M] -- C:\Users\meric\AppData\Roaming\wyUpdate AU [2012.01.19 23:25:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\XMedia Recode ========== Purity Check ========== < End of report > Nein, diese Sites hatte ich nicht zu den Vertrauenswürdigen hinzugefügt. Hab sie entfernt. 5. Die alten Java-Versionen (32bit/64bit) hab ich deinstalliert und nach einem Neustart die aktuellen aufgespielt. 6. Open Office ebenfalls aktualisiert. 7. Internet Explorer ist auf dem neusten Stand. 8. CCleaner hab ich laufenlassen. Hat etliche überflüssige Einträge entfernt. 9. ESET Online Scan hab ich laufen lassen. Hat fast 7 Stunden gedauert. Hier die gefundenen Schädlinge: Code:
ATTFilter C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\qlps-qlipso-sntb.exe Win32/Toolbar.Zugo application cleaned by deleting - quarantined
D:\Programme\PDFCreator\Toolbar\pdfforge Toolbar-4_4_0_setup.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined
D:\Programme\Win7codecs\Tools\Settings32.exe Win32/Packed.Autoit.C.Gen application cleaned by deleting - quarantined
D:\Progz\davinci_client_22.35.exe a variant of Win32/Packed.Themida application cleaned by deleting - quarantined
D:\Progz\gamebooster.exe a variant of Win32/Toolbar.Widgi application cleaned by deleting - quarantined
D:\Progz\HSS-1.30-install-anchorfree-76-conduit.exe a variant of Win32/HotSpotShield application cleaned by deleting - quarantined
D:\Progz\HSS-1.37-install-anchorfree-76-conduit.exe a variant of Win32/HotSpotShield application cleaned by deleting - quarantined
D:\Progz\JAF_Suite_Setup_1.1.1.exe a variant of Win32/Packed.Themida application cleaned by deleting - quarantined
D:\Progz\JAF_Virtual_PKEY_V5.zip a variant of Win32/Packed.Themida application deleted - quarantined
D:\Progz\PDFCreator-1_2_2_setup.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined
D:\Progz\picture2avi-setup_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
D:\Progz\RarRecoveryToolboxv1147.rar probably a variant of Win32/Agent.DJCXUEH trojan deleted - quarantined
D:\Progz\Setup_FreeFlvConverter.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined
D:\Progz\stylexp_Longhorn-Aero-PDC.exe multiple threats cleaned by deleting - quarantined
D:\Progz\VeohWebPlayer138Setup_eng.exe Win32/Toolbar.Zugo application cleaned by deleting - quarantined
D:\tmpDIR\BetterInstaller.exe a variant of Win32/Somoto.A application cleaned by deleting - quarantined
weiter im nächsten Posting => |
|
12.10.2012, 00:48
| #6 |
| | Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) 10. Hier die beiden Logfiles des OTL-Scans. OTL-Logfile: Code:
ATTFilter OTL logfile created on: 11.10.2012 17:01:58 - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\meric\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 1,64 Gb Available Physical Memory | 40,95% Memory free 6,00 Gb Paging File | 3,86 Gb Available in Paging File | 64,33% Paging File free Paging file location(s): d:\pagefile.sys 2048 2048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 40,43 Gb Total Space | 2,29 Gb Free Space | 5,66% Space Free | Partition Type: NTFS Drive D: | 425,33 Gb Total Space | 30,44 Gb Free Space | 7,16% Space Free | Partition Type: NTFS Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe PRC - [2012.10.09 16:06:31 | 000,692,152 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe PRC - [2012.08.29 12:03:38 | 001,996,200 | ---- | M] (LogMeIn Inc.) -- D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe PRC - [2012.08.21 11:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastUI.exe PRC - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastSvc.exe PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynUpSvc.exe PRC - [2011.11.15 19:20:26 | 000,078,192 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynTray.exe PRC - [2011.03.07 15:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- D:\Programme\VirtualCloneDrive\VCDDaemon.exe PRC - [2010.07.07 21:27:16 | 001,268,224 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe PRC - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe PRC - [2009.12.21 09:00:50 | 000,081,920 | ---- | M] (Realtime Soft Ltd) -- C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe PRC - [2007.07.18 09:19:02 | 000,057,344 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe ========== Modules (No Company Name) ========== MOD - [2009.06.29 10:54:08 | 000,164,864 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL MOD - [2009.02.06 18:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL ========== Services (SafeList) ========== SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.10.09 17:14:30 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.09.15 02:02:29 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.08.29 12:03:36 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- D:\Programme\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- D:\Programme\avast Antivirus\AvastSvc.exe -- (avast! Antivirus) SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.12 15:16:56 | 000,008,704 | ---- | M] (Hi-Rez Studios) [On_Demand | Stopped] -- D:\Spiele\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService) SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- D:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2012.03.06 17:19:00 | 003,953,632 | ---- | M] (INCA Internet Co., Ltd.) [Disabled | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc) SRV - [2012.01.25 10:56:30 | 009,690,112 | ---- | M] () [On_Demand | Stopped] -- c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe -- (wampmysqld) SRV - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) [Auto | Running] -- D:\Programme\DynDNS Updater\DynUpSvc.exe -- (Dyn Updater) SRV - [2011.10.15 16:04:37 | 000,079,360 | ---- | M] (Creative Labs) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service) SRV - [2011.10.15 15:40:18 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service) SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2011.09.26 11:06:54 | 000,021,504 | ---- | M] (Apache Software Foundation) [On_Demand | Stopped] -- c:\wamp\bin\apache\Apache2.2.21\bin\httpd.exe -- (wampapache) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService) SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008.11.11 09:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) DRV:64bit: - [2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) DRV:64bit: - [2012.08.21 11:13:13 | 000,969,200 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx) DRV:64bit: - [2012.08.21 11:13:13 | 000,359,464 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP) DRV:64bit: - [2012.08.21 11:13:13 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi) DRV:64bit: - [2012.08.21 11:13:12 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt) DRV:64bit: - [2012.08.21 11:13:12 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr) DRV:64bit: - [2012.08.21 11:13:11 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk) DRV:64bit: - [2012.07.26 21:32:08 | 000,066,728 | ---- | M] (Eugene V. Muzychenko) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vrtaucbl.sys -- (EuMusDesignVirtualAudioCableWdm) DRV:64bit: - [2012.03.07 01:02:45 | 000,028,504 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswKbd.sys -- (aswKbd) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.11.16 15:35:58 | 000,054,400 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter) DRV:64bit: - [2011.10.29 03:41:28 | 000,042,624 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata) DRV:64bit: - [2011.10.29 03:41:26 | 000,080,512 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata) DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt) DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt) DRV:64bit: - [2011.07.26 19:49:12 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss) DRV:64bit: - [2011.06.02 07:47:22 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm) DRV:64bit: - [2011.06.02 07:47:22 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus) DRV:64bit: - [2011.06.02 07:47:22 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.02.19 05:18:18 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:64bit: - [2011.02.19 05:18:18 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid) DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone) DRV:64bit: - [2010.12.21 07:55:02 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdm.sys -- (sscemdm) DRV:64bit: - [2010.12.21 07:55:02 | 000,129,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssceserd.sys -- (ssceserd) DRV:64bit: - [2010.12.21 07:55:02 | 000,127,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscebus.sys -- (sscebus) DRV:64bit: - [2010.12.21 07:55:02 | 000,036,328 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadadb.sys -- (androidusb) DRV:64bit: - [2010.12.21 07:55:02 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdfl.sys -- (sscemdfl) DRV:64bit: - [2010.12.17 00:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2010.11.20 15:34:04 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm) DRV:64bit: - [2010.11.20 15:34:04 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus) DRV:64bit: - [2010.11.20 13:35:34 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb) DRV:64bit: - [2010.11.20 13:35:26 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpcuxd.sys -- (vpcuxd) DRV:64bit: - [2010.11.20 13:35:22 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr) DRV:64bit: - [2010.11.20 06:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 04:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.07.12 20:36:10 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2010.07.07 23:21:18 | 001,612,888 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x22k.sys -- (ha20x22k) DRV:64bit: - [2010.07.07 23:21:06 | 001,567,832 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k) DRV:64bit: - [2010.07.07 23:20:56 | 000,118,360 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia) DRV:64bit: - [2010.07.07 23:20:48 | 000,213,080 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k) DRV:64bit: - [2010.07.07 23:20:40 | 000,015,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k) DRV:64bit: - [2010.07.07 23:16:32 | 000,179,288 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv) DRV:64bit: - [2010.07.07 23:16:24 | 000,697,816 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k) DRV:64bit: - [2010.07.07 23:16:14 | 000,580,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k) DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX.SYS) DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX) DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT.SYS) DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT) DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT.SYS) DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT) DRV:64bit: - [2010.06.17 11:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) DRV:64bit: - [2009.12.30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt) DRV:64bit: - [2009.08.24 11:36:00 | 000,010,752 | ---- | M] (hxxp://www.recursion.jp/avrcdc/) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lowcdc.sys -- (lowcdc) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.05.08 17:08:00 | 000,020,520 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb) DRV:64bit: - [2009.03.18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2009.03.02 00:05:32 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer) DRV:64bit: - [2008.08.28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd) DRV:64bit: - [2007.05.02 16:34:30 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsax64.sys -- (nmwcdsax64) DRV:64bit: - [2007.05.02 16:33:38 | 000,017,408 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacjx64.sys -- (nmwcdsacjx64) DRV:64bit: - [2007.05.02 16:33:36 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacx64.sys -- (nmwcdsacx64) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2008.11.14 03:11:42 | 000,020,512 | ---- | M] (Realtime Soft Ltd) [Kernel | Auto | Running] -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys -- (UltraMonUtility) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 51 07 D0 4F 35 A4 CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul" FF - prefs.js..extensions.enabledAddons: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1 FF - prefs.js..extensions.enabledAddons: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.22.1 FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10 FF - prefs.js..extensions.enabledAddons: {dc572301-7619-498c-a57d-39143191b318}:0.4.0.3 FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.3 FF - prefs.js..extensions.enabledAddons: yetanothersmoothscrolling@kataho:3.0.24 FF - prefs.js..extensions.enabledAddons: {64161300-e22b-11db-8314-0800200c9a66}:0.9.6.10 FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.4 FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google) FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll () FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\meric\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.08.05 04:20:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: D:\Programme\avast Antivirus\WebRep\FF [2012.09.07 06:02:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M] [2011.02.19 06:14:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Extensions [2012.10.11 08:59:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions [2011.08.26 14:05:17 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2011.06.29 22:54:50 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055} [2012.09.16 02:47:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012.10.02 23:00:12 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\foxyproxy-basic@eric.h.jung [2012.09.15 12:21:45 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\ich@maltegoetz.de [2012.02.23 17:04:32 | 000,164,722 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\compatibility@addons.mozilla.org.xpi [2012.10.10 04:24:53 | 001,626,141 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\firebug@software.joehewitt.com.xpi [2012.09.15 12:21:45 | 000,066,522 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\yetanothersmoothscrolling@kataho.xpi [2012.10.10 14:30:49 | 000,281,285 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi [2012.10.10 04:24:51 | 000,529,404 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012.09.05 13:40:27 | 001,268,546 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi [2012.07.25 05:41:33 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011.11.05 14:28:38 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2012.07.21 13:05:28 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2012.09.13 01:44:36 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2012.10.11 08:59:30 | 000,252,340 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: chrome://speeddial/content/speeddial.xul CHR - plugin: Shockwave Flash (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin7.dll CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\np-mswmp.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\pdf.dll CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll CHR - plugin: Picasa (Enabled) = D:\Programme\Google\Picasa3\npPicasa3.dll CHR - plugin: iTunes Application Detector (Enabled) = D:\Programme\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.1_0\ CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.2_0\ CHR - Extension: Turn Off the Lights = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.0.0.81_0\ CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\ CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\~ CHR - Extension: SmoothScroll = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cccpiddacjljmfbbgeimpelpndgpoknn\1.0.6_0\ CHR - Extension: Adblock Plus f\u00FCr Google Chrome\u2122 (Beta) = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.1.3_0\ CHR - Extension: Session Buddy = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko\2.1.2_0\ CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.199_0\ CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.52_0\ CHR - Extension: AdBlock = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.33_0\ CHR - Extension: avast! WebRep = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\ CHR - Extension: Speed Dial 2 = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik\1.6.0.8_0\ CHR - Extension: Smooth Gestures = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld\0.15.4.13_0\ CHR - Extension: GC little helper = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nagohipignfajbmgdcedbnmafoebnnjg\1.0_0\ CHR - Extension: New Tabs Always Last = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nldmhfnlbkkdhboedalogjpeedjbmjgi\0.1_0\ CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\ O1 HOSTS File: ([2012.10.11 09:57:32 | 000,000,771 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software) O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software) O4:64bit: - HKLM..\Run: [EvtMgr6] D:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) O4 - HKLM..\Run: [avast] D:\Programme\avast Antivirus\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [VirtualCloneDrive] D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG) O4 - Startup: C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\launch.jnlp () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1 O8:64bit: - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta () O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab (Creative Software AutoUpdate Support Package) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\gopher - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\AutorunsDisabled: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.10.11 10:35:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2012.10.11 10:09:10 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4.1 [2012.10.11 10:05:34 | 001,034,216 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll [2012.10.11 10:05:34 | 000,289,768 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe [2012.10.11 10:05:29 | 000,189,416 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe [2012.10.11 10:05:29 | 000,188,904 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe [2012.10.11 10:05:29 | 000,108,008 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll [2012.10.11 10:05:17 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2012.10.11 10:04:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2012.10.11 10:04:29 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll [2012.10.11 10:04:29 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2012.10.11 10:04:21 | 000,095,208 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll [2012.10.11 10:04:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2012.10.11 09:26:20 | 000,000,000 | ---D | C] -- C:\_OTL [2012.10.10 17:38:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2012.10.10 17:38:39 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2012.10.10 17:38:22 | 003,941,312 | ---- | C] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe [2012.10.10 16:53:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe [2012.10.10 16:33:54 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\OSAM [2012.10.10 16:13:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe [2012.10.10 16:01:56 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Malwarebytes [2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.10.10 16:01:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.10.10 15:20:59 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\backups [2012.10.10 15:01:33 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe [2012.10.10 14:46:18 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll [2012.10.10 14:46:17 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll [2012.10.10 14:46:17 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe [2012.10.10 14:46:17 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll [2012.10.10 14:46:14 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll [2012.10.10 14:46:13 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2012.10.10 14:46:13 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll [2012.10.10 14:46:13 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2012.10.10 14:46:12 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll [2012.10.10 14:46:12 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll [2012.10.10 14:46:12 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2012.10.10 14:46:12 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2012.10.10 14:46:12 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll [2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll [2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll [2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.10.10 14:46:11 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll [2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll [2012.10.10 14:46:10 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll [2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll [2012.10.10 14:46:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll [2012.10.10 14:46:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll [2012.10.10 14:46:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll [2012.10.10 14:46:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll [2012.10.10 14:46:07 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll [2012.10.10 14:46:07 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll [2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll [2012.10.10 14:46:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll [2012.10.10 14:46:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll [2012.10.10 14:46:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll [2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll [2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll [2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll [2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll [2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll [2012.10.10 14:46:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2012.10.10 14:45:24 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2012.10.10 14:45:23 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2012.10.10 14:45:01 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll [2012.10.10 14:44:21 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2012.10.10 14:44:20 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2012.10.10 14:44:19 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\SCE [2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Crash [2012.10.05 17:44:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Logishrd [2012.10.03 16:44:17 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX [2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Xara [2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\MAGIX [2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Xara [2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xara [2012.09.29 15:31:59 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Solid State Networks [2012.09.29 15:31:52 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Meteor Entertainment [2012.09.26 11:14:27 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe [2012.09.22 11:51:09 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.09.22 11:51:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.09.22 11:51:08 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.09.22 11:51:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.09.22 11:51:08 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.09.22 11:51:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.09.22 11:51:07 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.09.22 11:51:07 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.09.22 11:51:07 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.09.22 11:51:07 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.09.22 11:51:06 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.09.22 11:51:06 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2012.09.22 11:51:04 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.09.22 11:51:04 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.09.22 11:51:04 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2012.09.19 10:02:08 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys [2012.09.19 10:02:06 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys [2012.09.15 03:50:21 | 000,000,000 | --SD | C] -- C:\Users\meric\Documents\Eigene Datenquellen [2012.09.12 12:44:00 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys [2012.09.12 12:43:59 | 000,574,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll [2012.09.12 12:43:58 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys [2012.09.12 12:43:58 | 000,288,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS ========== Files - Modified Within 30 Days ========== [2012.10.11 17:00:29 | 000,007,631 | ---- | M] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg [2012.10.11 16:06:27 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.10.11 10:29:42 | 000,000,306 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job [2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.10.11 10:16:56 | 004,983,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.10.11 10:16:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.10.11 10:16:32 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys [2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.10.11 10:15:59 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.10.11 10:13:46 | 000,376,550 | ---- | M] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg [2012.10.11 10:05:24 | 000,108,008 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll [2012.10.11 10:05:20 | 000,289,768 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe [2012.10.11 10:05:20 | 000,189,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe [2012.10.11 10:05:19 | 001,034,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll [2012.10.11 10:05:19 | 000,916,456 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll [2012.10.11 10:05:19 | 000,188,904 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe [2012.10.11 10:04:15 | 000,095,208 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll [2012.10.11 10:04:12 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2012.10.11 10:04:12 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2012.10.11 10:04:11 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2012.10.11 10:04:10 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll [2012.10.11 10:04:10 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll [2012.10.11 09:33:53 | 000,002,083 | ---- | M] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk [2012.10.10 20:56:20 | 000,986,624 | ---- | M] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi [2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.10.10 17:38:22 | 003,941,312 | ---- | M] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe [2012.10.10 17:00:10 | 000,856,244 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png [2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe [2012.10.10 16:13:21 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe [2012.10.10 16:02:47 | 000,646,577 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png [2012.10.10 15:01:34 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe [2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2012.10.09 18:10:11 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt [2012.10.09 17:14:28 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.10.09 17:14:28 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.10.08 09:04:12 | 000,053,095 | ---- | M] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf [2012.10.07 04:56:54 | 000,000,707 | ---- | M] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk [2012.10.05 17:45:08 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys [2012.10.03 17:07:09 | 000,010,387 | ---- | M] () -- C:\Users\meric\Desktop\sdfsdf.png [2012.10.01 23:26:20 | 001,517,344 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.10.01 23:26:20 | 000,653,918 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.10.01 23:26:20 | 000,614,770 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.10.01 23:26:20 | 000,129,718 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.10.01 23:26:20 | 000,106,012 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.10.01 21:13:21 | 001,594,114 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.10.01 21:13:08 | 000,265,598 | ---- | M] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip [2012.09.26 18:33:12 | 000,617,992 | ---- | M] () -- C:\Users\meric\Desktop\parken.jpg [2012.09.25 16:47:17 | 000,000,248 | ---- | M] () -- C:\Users\meric\Desktop\dbscheme.ase [2012.09.24 23:15:52 | 000,176,169 | ---- | M] () -- C:\Users\meric\Desktop\gangnamstyle.mp3 [2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys [2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys ========== Files Created - No Company Name ========== [2012.10.11 10:13:32 | 000,376,550 | ---- | C] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg [2012.10.11 09:33:53 | 000,002,083 | ---- | C] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk [2012.10.10 20:56:25 | 000,986,624 | ---- | C] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi [2012.10.10 17:00:10 | 000,856,244 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png [2012.10.10 16:02:46 | 000,646,577 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png [2012.10.08 09:04:11 | 000,053,095 | ---- | C] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf [2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk [2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2 Beta.lnk [2012.10.03 17:05:26 | 000,010,387 | ---- | C] () -- C:\Users\meric\Desktop\sdfsdf.png [2012.10.01 21:13:24 | 000,265,598 | ---- | C] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip [2012.09.29 16:22:19 | 001,594,114 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.09.26 18:33:09 | 000,617,992 | ---- | C] () -- C:\Users\meric\Desktop\parken.jpg [2012.09.25 16:47:16 | 000,000,248 | ---- | C] () -- C:\Users\meric\Desktop\dbscheme.ase [2012.09.24 23:15:51 | 000,176,169 | ---- | C] () -- C:\Users\meric\Desktop\gangnamstyle.mp3 [2012.05.29 19:59:33 | 000,003,193 | ---- | C] () -- C:\Users\meric\.TransferManager.db [2012.05.14 04:45:43 | 000,000,703 | ---- | C] () -- C:\Windows\NewsRover.INI [2012.03.26 01:16:02 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2012.03.26 01:16:02 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2012.03.03 16:30:28 | 000,577,536 | ---- | C] () -- C:\Windows\SysWow64\ChilkatCsv.dll [2012.02.29 18:14:42 | 000,000,060 | ---- | C] () -- C:\Windows\picture2avi.ini [2011.10.15 15:41:55 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL [2011.10.15 14:24:42 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2011.10.15 14:24:42 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.09.22 12:29:58 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.09.19 09:07:46 | 000,015,360 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll [2011.09.19 09:07:32 | 000,058,368 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll [2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2011.09.14 11:36:30 | 000,000,184 | ---- | C] () -- C:\Users\meric\AppData\Roaming\3a99ed39.dat [2011.05.12 01:10:29 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Roaming\winscp.rnd [2011.04.22 01:53:09 | 000,010,240 | ---- | C] () -- C:\Users\meric\qlgt.db [2011.04.17 18:34:36 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe GIF Format CS5 Prefs [2011.04.16 16:16:51 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2011.04.03 20:23:51 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll [2011.03.10 22:53:14 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Local\PUTTY.RND [2011.03.05 00:41:26 | 000,007,631 | ---- | C] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg [2011.02.25 07:51:49 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe PNG Format CS5 Prefs [2011.02.19 19:30:01 | 000,281,120 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.02.19 19:30:00 | 000,837,192 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2011.02.19 19:30:00 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2011.11.22 23:53:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft [2011.11.22 23:47:21 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - 1.0 aktuell [2011.03.04 13:23:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - john smith texture pack v7 [2011.03.04 13:22:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - misa's texture pack [2012.09.24 23:28:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Audacity [2011.05.04 21:05:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Avnex [2012.04.28 05:12:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\BANDISOFT [2011.10.20 05:29:38 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Beat Hazard [2011.04.13 03:07:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Bridge! [2011.03.02 21:12:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Canon [2011.04.15 21:18:40 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2012.03.03 21:42:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\EurekaLog [2012.10.11 10:12:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\FileZilla [2011.08.21 15:46:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\flightgear.org [2011.02.26 21:08:06 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GARMIN [2012.03.03 16:51:09 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GeoSetter [2011.02.21 19:32:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GetRight [2011.08.15 02:12:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GlarySoft [2012.05.17 19:30:34 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GrabIt [2012.07.17 17:53:03 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\gslist [2011.12.27 20:46:27 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Highresolution Enterprises [2012.05.29 13:49:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ijjigame [2011.02.23 18:24:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ImgBurn [2011.04.14 01:02:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JAM Software [2011.09.22 13:04:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JOSM [2011.02.19 05:17:20 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Leadertech [2012.07.13 21:51:22 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient [2012.06.04 00:45:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient2 [2012.10.03 16:44:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\MAGIX [2011.04.15 02:06:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\mirkes.de [2011.02.20 07:14:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Mp3tag [2011.03.12 16:55:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1 [2011.02.20 02:07:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Notepad++ [2011.06.05 16:36:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\OpenOffice.org [2011.02.26 20:56:52 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Opera [2011.04.15 20:58:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PACE Anti-Piracy [2011.03.18 19:27:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PC Suite [2011.02.24 18:28:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\POV-Ray [2011.11.20 03:52:57 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\pymclevel [2011.10.20 21:30:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Samsung [2012.07.17 03:41:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-updater [2012.07.17 02:38:53 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-zsync [2012.07.16 00:15:08 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\SplitMediaLabs [2012.06.02 14:43:42 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Spotify [2011.02.23 16:52:00 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2011.08.21 15:45:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Subversion [2011.08.03 23:55:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\System [2012.06.03 21:03:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\TeamViewer [2012.07.10 13:32:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Temp [2012.05.17 19:14:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Thunderbird [2011.08.11 02:27:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Tropico 4 Demo [2012.06.29 19:17:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ts3overlay [2011.10.07 23:33:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Unity [2012.04.30 15:42:37 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Wireshark [2011.10.19 18:15:14 | 000,000,000 | -HSD | M] -- C:\Users\meric\AppData\Roaming\wyUpdate AU [2012.01.19 23:25:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\XMedia Recode ========== Purity Check ========== < End of report > |
|
12.10.2012, 00:51
| #7 |
| | Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) Extras-Logfile: Code:
ATTFilter OTL Extras logfile created on: 11.10.2012 17:01:58 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\meric\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 1,64 Gb Available Physical Memory | 40,95% Memory free
6,00 Gb Paging File | 3,86 Gb Available in Paging File | 64,33% Paging File free
Paging file location(s): d:\pagefile.sys 2048 2048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 40,43 Gb Total Space | 2,29 Gb Free Space | 5,66% Space Free | Partition Type: NTFS
Drive D: | 425,33 Gb Total Space | 30,44 Gb Free Space | 7,16% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS
Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Programme\Mozilla Firefox 4\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- D:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with FastStone] -- "D:\Programme\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "D:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "D:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "D:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- D:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with FastStone] -- "D:\Programme\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "D:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "D:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "D:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00508039-7CF1-4A2C-9DDB-BA202FB11D07}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0AD1D6F1-8B78-4BE7-90E5-AA00AD50BB9B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{0E3E5C01-558C-4E58-AE8D-10A8FB13B6FC}" = lport=56406 | protocol=6 | dir=in | name=pando media booster |
"{19251F23-146A-4C42-BB9F-54C418947D24}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2497FCF4-0595-401D-A11C-CAF861688655}" = lport=138 | protocol=17 | dir=in | app=system |
"{41C26ECF-D38C-4A4C-9778-DF38B1A2FF6A}" = rport=137 | protocol=17 | dir=out | app=system |
"{50D58C32-8ED7-4F95-8A02-C2F11AB77006}" = lport=137 | protocol=17 | dir=in | app=system |
"{58A51194-6747-4239-A2CB-6614F91FF310}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{6886AE2F-C3B0-4EAC-B9D9-78ED8CF314EE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6B15977B-73D3-4063-A46C-1AF3C47B5653}" = lport=6004 | protocol=17 | dir=in | app=d:\programme\microsoft office\office12\outlook.exe |
"{74FF7201-FA07-4C18-A5C4-87CC4C1EE689}" = lport=10243 | protocol=6 | dir=in | app=system |
"{77431649-43C3-4F98-9AC6-D695D8226A80}" = rport=10243 | protocol=6 | dir=out | app=system |
"{78F06AC8-06FC-4048-868F-24037BE6BD73}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{7BB96959-6746-4BF3-96A3-D18A64D81F0B}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{857A2DB8-3106-42FF-B15B-77A0C3EB0A2D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8F431EC4-7011-4C0C-B714-BDF81538A796}" = rport=25565 | protocol=6 | dir=out | name=tcp 25565 |
"{A06D7DD6-593B-4E77-BDB1-B4672B0768C3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A5E152E1-AA2D-402D-B60F-9FE11CEC0C11}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A9DFEA34-35CB-4093-A081-15FFB425892C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AAA8F1D8-7F06-410A-8898-3446EB827C68}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=%systemroot%\microsoft.net\framework64\v3.0\windows communication foundation\smsvchost.exe |
"{AF560F43-DA77-4C76-8F2F-5DC06794EF6B}" = lport=56406 | protocol=6 | dir=in | name=pando media booster |
"{BEE8FAD8-E981-4A5F-ACCB-FC25CA2BB322}" = lport=445 | protocol=6 | dir=in | app=system |
"{D4A4AD24-E93A-4A7F-8BF4-A000252D4252}" = lport=56406 | protocol=17 | dir=in | name=pando media booster |
"{D833835F-EF23-4C01-973B-D8B1F0CC9C8D}" = lport=139 | protocol=6 | dir=in | app=system |
"{E5D6481D-9499-44FB-9CA7-05EF8D6BFCFC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E72DC097-A4B2-4A5D-8A53-FB7B15BE83F0}" = rport=139 | protocol=6 | dir=out | app=system |
"{ECCBCF7F-0229-4C71-843D-C1EC918EA5E3}" = rport=138 | protocol=17 | dir=out | app=system |
"{EE3D1011-B499-4C13-9AA1-0C92A5E588B9}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F5B4A3DB-C610-4892-8D0F-CC0531C4DC9B}" = rport=445 | protocol=6 | dir=out | app=system |
"{F7712D9A-C937-4CB9-85CA-6807BDA44E27}" = lport=25565 | protocol=6 | dir=in | name=tcp 25565 |
"{F8C72413-CFDF-47A0-830E-D61FC759BA73}" = lport=56406 | protocol=17 | dir=in | name=pando media booster |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0541A680-5679-46CD-9F05-6EA5C9FA9211}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{128ED864-5D52-4993-98FF-E984F9D0EB31}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe |
"{1B194C32-114B-4802-8788-32055BB3F9D3}" = protocol=17 | dir=in | app=d:\programme\utorrent\utorrent.exe |
"{1C7E83FF-1339-4FA9-A982-0A222EA37C40}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{1E7C91EC-F2AC-4223-A755-F5964A2BF6CE}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\counter-strike global offensive\csgo.exe |
"{232639FF-C8A5-49FB-A940-95D59001CD60}" = dir=in | app=d:\programme\itunes\itunes.exe |
"{292F9C47-D5FC-4755-8FD7-39E508D03779}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{2E2FABB2-E15E-4B55-9EED-5FD49CBEBAFC}" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe |
"{32D13DF9-16A0-4292-974D-CFF0B645CA1E}" = protocol=6 | dir=in | app=%appdata%\.minecraft\minecraft.exe |
"{38096B87-6A24-4179-B6D2-3397947EFC13}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3972BAE7-4924-4B2E-AC3F-F94C2E3A0E47}" = dir=out | app=d:\programme\bandicam\bdcam.exe |
"{3C18229F-BE22-4322-A59F-0DACFE1A71A7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3C9FE258-4B52-4DE5-B9AC-F908F7C5F393}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd |
"{3CA6BBF9-8ACC-482E-831A-0DFA9DB3E80B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3F85FBED-9575-4DA9-8F9D-7800EDE7259A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{409C291A-451E-4E66-9EB5-AFBDC0B6B8DD}" = protocol=17 | dir=in | app=d:\programme\utorrent\utorrent.exe |
"{42E35E42-03F2-4617-8CD0-0B474FC58F05}" = protocol=17 | dir=in | app=d:\programme\opera\opera.exe |
"{45795116-8D63-43E1-BEB7-33261B6AE7BA}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{45E2B776-DFE4-44EA-8DBF-638AA0403219}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.0\sonarhost.exe |
"{4600DB1D-4F72-4090-92C9-ABC11508C64E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{48AB5A0D-9B8C-49B0-AFDE-34306B020C06}" = protocol=6 | dir=in | app=d:\programme\mirc\mirc.exe |
"{4B1F2338-EA1A-4A3D-9EA0-A7F3D2976CBE}" = protocol=6 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe |
"{4D4A6D8C-4906-4CB7-A9E5-F55192EF1301}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{4E2CF5B4-AF4D-400C-921D-5EF72BE3288B}" = protocol=6 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe |
"{4F2C1B34-CB8F-4E14-8F47-F2A5190EE24E}" = dir=in | app=d:\programme\skype\phone\skype.exe |
"{50C9B3BD-6D71-4DC5-A8ED-46CC57FF85CC}" = protocol=6 | dir=in | app=d:\programme\utorrent\utorrent.exe |
"{51F73730-BAE1-4BD2-B9B8-F59D3B7E3239}" = protocol=6 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe |
"{523F97E7-CFF7-4639-A187-A475F58E9839}" = protocol=17 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe |
"{54C08B16-255F-4494-AD20-2181E309FEA5}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"{59AB37DC-D664-48D1-BD84-492322DFC932}" = protocol=6 | dir=in | app=d:\programme\utorrent\utorrent.exe |
"{60151BC5-6C29-4B16-807B-FDE600F9652C}" = protocol=6 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe |
"{6043A5D8-D09E-4D70-B126-394026DD94D9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{60BBE5AC-84C7-45D4-B7D9-8CA73AE4BF6D}" = protocol=17 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe |
"{63EEFB3D-47AD-44B8-846E-247C49834C1A}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{663BD697-6B65-4A4E-A4CF-3AD3BD05C3F4}" = protocol=6 | dir=out | app=system |
"{67228BA5-5C05-46B5-B203-608AA6689771}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\counter-strike global offensive\csgo.exe |
"{689556B1-0C8D-40D3-82DC-C663F5CFE5EF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6A9F9CA3-E1FD-42F3-8C59-B9D4FDF0EB90}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6BAF1994-7340-42AE-BCB6-E6711EB7119E}" = protocol=6 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe |
"{6D4065DD-76BC-49AC-B248-95E2277599D7}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe |
"{6EDABEEC-B0C3-46B0-928D-6ADFEE1034B7}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{6F34A2F6-228B-43C8-9380-7F7A6F4380CE}" = protocol=17 | dir=in | app=d:\programme\videolan\vlc\vlc.exe |
"{70DF4D72-5879-4E19-BD2B-B4330FCC4971}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{721E2DD3-3951-47BE-B89B-4D9DD49D9B77}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"{74B6C7ED-AEEC-402C-A6D6-1624F1521DFC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{759636B5-F6B9-4AC3-9EFD-76BEFB0E08C2}" = protocol=6 | dir=in | app=d:\programme\mirc nn\mirc.exe |
"{80DA9889-85BE-4011-9306-50E796B75DAF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{810B4719-9B73-4808-A668-875786030376}" = protocol=17 | dir=in | app=d:\programme\mirc\mirc.exe |
"{84C5E22B-0BCF-49EB-AF47-F54A53DC60CE}" = protocol=17 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe |
"{85573977-50B5-45E6-B256-724E3EE2763C}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{868939A6-920F-4F50-BC63-7C54FCA98051}" = protocol=17 | dir=in | app=d:\spiele\planetside 2\planetside2.exe |
"{873A0F0D-E456-4FFF-A4C7-8513376B6F22}" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe |
"{87BAEDE9-AE7B-43F3-8658-B7800C5EACB7}" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe |
"{88E1BCFE-9C27-4151-8481-30A791988AA4}" = protocol=6 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe |
"{90D1D022-5467-4478-AA78-5EF0B9672A5B}" = protocol=17 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"{92325F97-578F-4276-A205-CF98AFF17283}" = protocol=17 | dir=in | app=d:\programme\opera\opera.exe |
"{966637B1-0925-4932-A5FF-4749B3DD82C9}" = protocol=17 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe |
"{968E650E-E618-4143-A122-62CE5A24E800}" = protocol=17 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe |
"{97A1D593-C13D-4C9E-B2D7-3ED85EB0228B}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{9AAF83B3-8C5A-48B3-92BB-034D3C219BCE}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd |
"{9E41013B-8475-4B4F-8671-1AA42E30F40C}" = protocol=6 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"{A2933AA3-FDD8-4B43-B6BC-FC22EDCB22E0}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A3F03CE0-BDB8-405C-A52C-2A30108FE2B3}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{A6B38796-C8FA-4626-BD35-4ABBD9400A42}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{AB43B80F-3416-49FB-8350-6BD74E824EAC}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe |
"{B655970A-F4C8-47F0-8756-72E951D1D9C6}" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{BA2E2033-4E6E-42A4-A439-577820857BB8}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe |
"{BE852182-C99E-440B-A72D-CF65A1689D5D}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BF6923CA-DCA3-40A5-B25E-256E9A35530A}" = protocol=6 | dir=in | app=d:\programme\opera\opera.exe |
"{C07BC1CB-8676-44E2-BBB2-5EC5AE384D73}" = protocol=6 | dir=in | app=d:\programme\videolan\vlc\vlc.exe |
"{C2163DA1-099D-4523-9141-448007248F05}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{C7D0B286-8586-431B-B699-8FFA8A9E4AD9}" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe |
"{C8A68D35-64B2-42D9-BFDB-2D62766469AF}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"{C9817132-B0FC-481A-9FAE-0F2D8475005E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{CD583279-8BED-4288-9755-52497C9ABB3D}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{CD83B2F5-E38A-4280-9D1B-8AA6F08D9224}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{CFB7A880-EB69-4091-AE83-4069766BED99}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"{D074A86B-5CAB-4FB3-BBD1-30640CCAE9DE}" = protocol=6 | dir=in | app=d:\spiele\planetside 2\planetside2.exe |
"{D21A157A-4323-4ADF-B35A-523BDE243D34}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.0\sonarhost.exe |
"{D40B643E-17DB-4E0D-99CB-FF214CD82A30}" = protocol=6 | dir=in | app=d:\programme\opera\opera.exe |
"{D5249B07-BF7F-4C25-987B-9577F8A65085}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{D725C448-EC9C-424D-AB9E-9763F6BDDA75}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{DD4462C1-30AA-4B9E-A156-1B64AABC1FD8}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{DD6CA922-7A81-432B-AB49-A746F3E42ADD}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{E08287D2-0208-4270-B4C7-BE0035AE5F35}" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{E3195CC5-E600-46DC-8C42-93F557154CC1}" = protocol=6 | dir=out | app=%appdata%\.minecraft\minecraft.exe |
"{E7AA2864-DB9A-484D-B1BF-9F8B7C36FDED}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{E996E945-C9A1-4EDD-8702-191D3025ACCC}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{EB43F44C-93D2-4A17-8048-2C1E58A36AAE}" = protocol=58 | dir=in | app=system |
"{ECB965A3-C8AA-4572-B7C9-DA3961F97718}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe |
"{EF0B9A79-29A9-4E78-9E9C-970C2E459999}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{EFC8C6B2-EE97-4FBF-9F50-5E616F438881}" = protocol=6 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe |
"{EFCF9BE1-C770-4CC1-B092-E7C10CC64B5B}" = protocol=17 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe |
"{F14194A5-E314-4F85-B8C9-691D73A99E07}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{F41A5B11-2863-4CD7-95DA-21DE69D7702C}" = protocol=17 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe |
"{FAABDCD7-9C65-4EE8-849B-46E69CD4DC8A}" = protocol=17 | dir=in | app=d:\programme\mirc nn\mirc.exe |
"{FACCC685-62E7-46BF-ABD8-A18B2D8AEEDB}" = dir=out | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{FB348F75-F419-4743-8F5B-A30D546832DC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FD5093E3-1AD9-40BA-B5BF-B8E4C29F48A3}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FD559FD5-3238-44B0-AF56-FCC1D58A882E}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe |
"{FD779045-5162-4D23-A2C4-8F219AC0FD88}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"TCP Query User{00228D16-0FC3-4B3D-A5FD-13929B8C6324}D:\spiele\quake3arena\quake3.exe" = protocol=6 | dir=in | app=d:\spiele\quake3arena\quake3.exe |
"TCP Query User{00686F92-1199-49DF-AE15-941DF384A383}D:\spiele\audiosurf\engine\questviewer.exe" = protocol=6 | dir=in | app=d:\spiele\audiosurf\engine\questviewer.exe |
"TCP Query User{093C9511-899C-4C5C-A8FF-918747DC4839}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe |
"TCP Query User{0DF8A9B3-A9E7-4965-8AC1-B6A974438310}D:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe" = protocol=6 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe |
"TCP Query User{1FBF7D4A-4082-4DC0-8D17-4791D6A59DA9}D:\programme\six updater\tools\bin\rsync.exe" = protocol=6 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe |
"TCP Query User{25540708-4B09-4A79-AF1C-8C7371471CEA}C:\users\meric\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe |
"TCP Query User{25EF3598-AA5B-4CC1-ACF0-6A5B8BDBB654}C:\wamp\bin\apache\apache2.2.21\bin\httpd.exe" = protocol=6 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe |
"TCP Query User{2A3C6D7E-B4AA-4B8F-8DCC-8C74EAAAD168}D:\programme\mirc\mirc.exe" = protocol=6 | dir=in | app=d:\programme\mirc\mirc.exe |
"TCP Query User{4955611A-E2C2-43DD-9277-92C6605C2A16}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"TCP Query User{4F656317-8C2F-4634-ACB3-00CF5150DAFA}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe |
"TCP Query User{5B2AD425-4187-4D3A-B8C5-23E9773BBE63}D:\spiele\planetside 2\planetside2.exe" = protocol=6 | dir=in | app=d:\spiele\planetside 2\planetside2.exe |
"TCP Query User{6598E2D4-0561-4078-9CE8-262EDEB08865}D:\spiele\battlefield 2142 server\bf2142_w32ded.exe" = protocol=6 | dir=in | app=d:\spiele\battlefield 2142 server\bf2142_w32ded.exe |
"TCP Query User{71B20AAD-CFDD-4056-9DB3-431DC842585F}D:\programme\miranda im\miranda32.exe" = protocol=6 | dir=in | app=d:\programme\miranda im\miranda32.exe |
"TCP Query User{89F40BAE-FFFC-4610-B119-1F84E9695BB6}D:\programme\winamp\winamp.exe" = protocol=6 | dir=in | app=d:\programme\winamp\winamp.exe |
"TCP Query User{8D330ABB-CBB8-4576-928A-1883FEA113CA}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe |
"TCP Query User{99FA4863-BA1E-4C46-9BAD-B8D84FC2CAEC}D:\spiele\ghost recon online\pdc-live\ghostrecononline.exe" = protocol=6 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe |
"TCP Query User{AE648ADB-4A3D-433C-95A6-84D8E3A6BDEC}D:\programme\miranda im\miranda32.exe" = protocol=6 | dir=in | app=d:\programme\miranda im\miranda32.exe |
"TCP Query User{C0FDAA2B-F7ED-4FA6-9BE5-239E0FE27DA7}D:\programme\mirc nn\mirc.exe" = protocol=6 | dir=in | app=d:\programme\mirc nn\mirc.exe |
"TCP Query User{C70DCF43-6A94-409B-865F-636101A2D428}D:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=6 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"TCP Query User{C8B71324-13F8-41F8-AA89-1BEBB8D5084F}D:\programme\sabnzbd\sabnzbd.exe" = protocol=6 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe |
"TCP Query User{D094878D-0AA1-4CF6-9BA8-9ECB5084A5D1}D:\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=d:\xampp\mysql\bin\mysqld.exe |
"TCP Query User{D83A90D7-77CE-43FC-A4D4-C4AF8331D490}D:\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=d:\xampp\apache\bin\httpd.exe |
"TCP Query User{DD2A90FC-BA86-43B5-8AE9-426847F5A0A1}D:\spiele\battlefield 2142\bf2143.exe" = protocol=6 | dir=in | app=d:\spiele\battlefield 2142\bf2143.exe |
"TCP Query User{E6FBA2E8-F0F4-4FAC-9DAE-3B72B69E6DE2}D:\programme\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=d:\programme\videolan\vlc\vlc.exe |
"TCP Query User{ED739BF7-0345-4747-B859-EC2BA4F686CE}D:\programme\mozilla firefox 4\plugin-container.exe" = protocol=6 | dir=in | app=d:\programme\mozilla firefox 4\plugin-container.exe |
"TCP Query User{F7B90FAB-B8E8-46E5-92CA-D2DC939139A7}D:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe" = protocol=6 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe |
"UDP Query User{0712ABA5-2844-4017-B8E5-9F27E83BFC0E}D:\programme\mozilla firefox 4\plugin-container.exe" = protocol=17 | dir=in | app=d:\programme\mozilla firefox 4\plugin-container.exe |
"UDP Query User{073FB327-3CFC-4817-AE0F-E8DAF16BEF19}D:\programme\sabnzbd\sabnzbd.exe" = protocol=17 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe |
"UDP Query User{20218A3D-BE0F-433B-9C20-94015502C497}D:\spiele\planetside 2\planetside2.exe" = protocol=17 | dir=in | app=d:\spiele\planetside 2\planetside2.exe |
"UDP Query User{3105E842-AEAC-496B-A555-3B16C6B08DE4}D:\programme\miranda im\miranda32.exe" = protocol=17 | dir=in | app=d:\programme\miranda im\miranda32.exe |
"UDP Query User{3FE8DDEB-156E-491F-8EE7-9013CED354CB}D:\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=d:\xampp\mysql\bin\mysqld.exe |
"UDP Query User{48509221-2EA6-4C62-A7A8-B6A664230C51}D:\spiele\ghost recon online\pdc-live\ghostrecononline.exe" = protocol=17 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe |
"UDP Query User{5284B253-72A1-4C01-8BA4-87ACC24AB35E}D:\spiele\quake3arena\quake3.exe" = protocol=17 | dir=in | app=d:\spiele\quake3arena\quake3.exe |
"UDP Query User{6E389CBB-DE9B-4CC4-AB27-F289383B982F}D:\programme\miranda im\miranda32.exe" = protocol=17 | dir=in | app=d:\programme\miranda im\miranda32.exe |
"UDP Query User{78EED378-0881-4E04-8BE3-83DC037FAF27}D:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=17 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"UDP Query User{87E6F8C8-EF2C-422D-8EFF-D36B206074D5}C:\wamp\bin\apache\apache2.2.21\bin\httpd.exe" = protocol=17 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe |
"UDP Query User{903370A3-1F24-4559-99B0-C33B4577DF57}D:\spiele\battlefield 2142 server\bf2142_w32ded.exe" = protocol=17 | dir=in | app=d:\spiele\battlefield 2142 server\bf2142_w32ded.exe |
"UDP Query User{93E04D91-B7CC-45F7-86A2-16B8E4B7FC29}D:\spiele\audiosurf\engine\questviewer.exe" = protocol=17 | dir=in | app=d:\spiele\audiosurf\engine\questviewer.exe |
"UDP Query User{97F03256-44CC-47C8-8F40-48119749BA67}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe |
"UDP Query User{9886DE5C-F99C-4228-83D0-0DDF9331F4A6}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"UDP Query User{B5685612-6619-464A-8C3F-A410ED878C9D}D:\spiele\battlefield 2142\bf2143.exe" = protocol=17 | dir=in | app=d:\spiele\battlefield 2142\bf2143.exe |
"UDP Query User{C32B6DAE-356E-4556-A75C-04B89AAF6123}D:\programme\winamp\winamp.exe" = protocol=17 | dir=in | app=d:\programme\winamp\winamp.exe |
"UDP Query User{CF8B775D-4171-49A0-A3CD-9E361AD1C5BA}C:\users\meric\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe |
"UDP Query User{CFF0D63B-9B01-4FC4-B1F8-FC5B08111ECF}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe |
"UDP Query User{D30CB98B-7313-4281-A3CA-F895EA70FEDE}D:\programme\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=d:\programme\videolan\vlc\vlc.exe |
"UDP Query User{D6B4EAC1-74C7-4C49-A902-AF07210DBECB}D:\programme\mirc nn\mirc.exe" = protocol=17 | dir=in | app=d:\programme\mirc nn\mirc.exe |
"UDP Query User{D7D32004-D441-4877-9A42-AEDFFA95B4F7}D:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe" = protocol=17 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe |
"UDP Query User{DD17E047-308C-4CF4-AEB7-917D3D4B6B69}D:\programme\mirc\mirc.exe" = protocol=17 | dir=in | app=d:\programme\mirc\mirc.exe |
"UDP Query User{E53D7B6A-FFED-445F-800D-07E60C3683B9}D:\programme\six updater\tools\bin\rsync.exe" = protocol=17 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe |
"UDP Query User{EBB0E080-84A0-40E1-AD59-4841030ABEEE}D:\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=d:\xampp\apache\bin\httpd.exe |
"UDP Query User{F476BB7A-69FB-4746-8C12-3256CE4EAC8C}D:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe" = protocol=17 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe |
"UDP Query User{FA90199D-D869-4F86-957E-1F289B22F728}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{06B60360-9DBD-4593-90A0-FD237F0845A2}" = Topaz DeNoise 5 (64-bit)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP620_series" = Canon MP620 series MP Drivers
"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode
"{1CDE9DB9-7D47-46F8-83DC-9DD9899BBBFC}" = Topaz ReMask 3 (64-bit)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417007FF}" = Java 7 Update 7 (64-bit)
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{537056B7-32A4-4408-9B54-0341963C7C9C}" = UltraMon
"{574CFBE2-E50C-A112-EA65-BA5AE7C3AB2C}" = AMD Catalyst Install Manager
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7
"{68660049-8D48-427C-9FF7-139D8340CDC0}" = MSVC80_x64
"{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software
"{77B8B4A5-EE79-4907-A318-2DA86325B8D7}" = iTunes
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D93BD99-EECF-4812-B3BA-B8A2E7FEEA11}" = Topaz Simplify 3 (64-bit)
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{A981E64B-0F10-45D9-BD5C-A4DF7B87E218}" = Topaz Detail 2 (64-bit)
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{BA3D5FF2-A405-4654-826E-A09FABB01853}" = Topaz Fusion Express 2 (64-bit)
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D0CE053E-0E5E-4C12-9BAE-D0F36021E911}" = POV-Ray for Windows v3.62
"{DC8F0C18-E6B0-4722-A4AB-D134473091C2}" = Topaz DeJpeg 4 (64-bit)
"{E44D14E2-A6D0-4F38-BF06-2E4244E23FED}" = Topaz InFocus (64-bit)
"{E5C95CA5-4565-4B9D-97ED-05088D775614}" = Apple Mobile Device Support
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FA85C599-2569-4C48-9AA6-2B8D8F029FA7}" = Topaz Clean 3 (64-bit)
"{FB237A35-F491-4AC1-95E0-85118D6751D9}" = Topaz Adjust 4 (64-bit)
"{FF0EBE64-45AA-4B16-A0CC-945CECDCA0B6}" = Topaz Lens Effects (64-bit)
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"CCleaner" = CCleaner
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Logitech Gaming Software" = Logitech Gaming Software 8.20
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"sp6" = Logitech SetPoint 6.32
"Virtual Audio Cable 4.10" = Virtual Audio Cable 4.10
"WinRAR archiver" = WinRAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0659E943-DDF4-44FC-9FEE-A13B09F8BB08}" = Adobe Flash Media Live Encoder 3.2
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0EDBEB2B-7C8D-42E6-8312-0F84394A3223}" = Windows Media Center Add-in for Silverlight
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{10ABE49D-343A-463E-9753-C4C5A05ECEF9}" = Sibelius Scorch (Firefox, Opera, Netscape only)
"{15C49338-59E5-472E-94F7-D5AE15EE23C9}" = XSplit
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{19B9DAD6-5E6E-4B80-8EFE-314B5638D6D4}" = Xara 3D Maker 7
"{1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}" = Adobe Creative Suite 5 Master Collection
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20288888-A7AF-4B24-8AEB-398D20CD563C}" = Sound Blaster X-Fi
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{266D79A6-3857-8A1F-3200-325F318208B4}" = Boks
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2D8CED57-CCDB-4D86-9087-3BBCAE8F8F22}" = Six Updater
"{2FA75B40-17C9-4D22-88CA-80A5D52FAB13}" = LightScribe System Software
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{37EF63D9-3E31-45A9-A90F-BDE07CE88095}" = Sibelius Scorch (all browsers)
"{38EE230F-F631-451F-8800-E29F5E5C9E7D}" = iTunes Library Updater
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}" = Tribes Ascend
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4ECA4128-8B48-44A0-90E8-B93C6A69CE4B}" = LightScribe Template Designs - Music Pack 1
"{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.79.1
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5A67D2EA-FB70-4033-A6F3-606AD85B2015}_is1" = Driver Sweeper Version 3.2.0
"{5BDA2F58-1F21-4D10-9910-92B01EBCC958}" = AMD USB Filter Driver
"{5BDEA9E0-E55B-45A7-93F7-6B8F68F851E5}" = Topaz InFocus
"{5E1375CB-6792-4464-8715-CC3EC83D48FA}" = VirtualDJ Home FREE
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{61F25370-7465-4404-BE28-4629BF808699}" = LightScribe Applications
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6E07CF4B-A9EB-45BF-BE74-613B3D708E13}" = Topaz Lens Effects
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{73E80655-FB3C-46F4-BE00-62D248BC490A}" = Visual C++ 2008 Runtime (x64)
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{770D3BDC-19D7-49D0-B60B-C5BB77553FBB}" = Topaz Fusion Express 2
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{8117EA22-035F-4880-86AE-AC7C4F1FA3E2}" = Topaz ReMask 3
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{83721450-E604-4C37-ABEB-CE7F18C587C8}" = LightScribe Template Labeler
"{85E00941-FDFF-4796-A3B8-3ACC766FFCA5}" = Topaz Clean 3
"{86CE1746-9EFF-3C9C-8755-81EA8903AC34}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8A1EBF29-7CF8-471E-B90B-95FF36AC8248}" = Topaz Simplify 3
"{8BCD7AE7-F713-4D50-BAB9-7839B9386870}" = ImageShack Uploader 2.2.0
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{959FA9FB-ACFF-4C38-967E-5CB5DB3130AC}" = DayZ Commander
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{9E146BA1-26DD-4C3B-9F0F-90F2E3CEC9D2}" = Topaz DeJpeg 4
"{9E82D1DB-3AFB-4D18-A221-081F1B4B4789}" = Topaz DeNoise 5
"{9FDC7042-CB9F-4336-A14C-DF10F53762E2}" = Topaz Adjust 4
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB6F6C80-1C35-4672-BDEF-F26FF214C409}" = Samsung PC Studio 7
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AFBAB9A0-DDE8-49AE-8C17-A01B61BEE64B}" = Garmin MapSource
"{B1EE1CC5-6CED-4801-BFFF-8454F21A245A}" = Garmin Communicator Plugin
"{B8ABD8C7-991E-4A70-B5A3-20C6FC680680}" = LogMeIn Hamachi
"{C5AC39F1-001D-4338-84C6-35109525588A}" = TweetDeck
"{C921D7C4-24D7-4210-AEE9-DFC5DDC78428}" = Topaz Detail 2
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CC23FF9A-989C-4DEB-8970-50E6E4862315}" = EOSInfo
"{CCF13D13-A87B-34E8-B689-1896D0C2DBA2}" = Google Talk Plugin
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D801B39E-CE01-409F-8E7C-B7976EA3C9DC}_is1" = Audiosurf
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"ABC Amber Nokia Converter" = ABC Amber Nokia Converter
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"ArmA 2" = ArmA 2 Uninstall
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.14 (Unicode)
"Audacity_is1" = Audacity 2.0
"AudioCS" = Creative Audio-Systemsteuerung
"AutoHotkey" = AutoHotkey 1.0.48.05
"avast" = avast! Free Antivirus
"AVI Joiner_is1" = AVI Joiner
"bada SDK 2.0.5" = bada SDK 2.0.5
"Bandicam" = Bandicam
"BandiMPEG1" = Bandisoft MPEG-1 Decoder
"Battlelog Web Plugins" = Battlelog Web Plugins
"BattlEye for OA" = BattlEye for OA Uninstall
"Biet-O-Matic v2.14.8" = Biet-O-Matic v2.14.8
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"DivX Setup" = DivX-Setup
"DTS Connect Pack" = DTS Connect Pack
"DynUpdater" = Dyn Updater
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"ESN Sonar-0.70.0" = ESN Sonar
"FastStone Image Viewer" = FastStone Image Viewer 4.3
"Fraps" = Fraps (remove only)
"FWTools247" = FWTools 2.4.7
"GeoSetter_is1" = GeoSetter 3.4.16
"Glary Utilities_is1" = Glary Utilities 2.38.0.1288
"GPS-Track-Analyse.NET 6.0_is1" = GPS-Track-Analyse.NET 6.0
"GrabIt_is1" = GrabIt 1.7.2 Beta 6 (build 1008)
"GSAK_is1" = GSAK 8.1.0.10 (Final)
"ImgBurn" = ImgBurn
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"JDownloader" = JDownloader
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"LogMeIn Hamachi" = LogMeIn Hamachi
"MAGIX_MSI_Xara3D7" = Xara 3D Maker 7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Miranda IM" = Miranda IM 0.10.4
"mIRC" = mIRC
"Mozilla Firefox 6.0 (x86 de)" = Mozilla Firefox 6.0 (x86 de)
"MP Navigator EX 2.0" = Canon MP Navigator EX 2.0
"Mp3tag" = Mp3tag v2.48
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1" = Boks
"Notepad++" = Notepad++
"OpenAL" = OpenAL
"Opera 12.02.1578" = Opera 12.02
"OSM" = JOSM 4399
"Picasa 3" = Picasa 3
"PunkBusterSvc" = PunkBuster Services
"RADVideo" = RAD Video Tools
"SABnzbd" = SABnzbd 0.7.3
"Samsung PC Studio 7" = Samsung PC Studio 7
"Spoiler Sync_is1" = Spoiler Sync
"Steam App 33930" = ARMA 2: Operation Arrowhead
"Steam App 730" = Counter-Strike: Global Offensive
"Time Stopper4.0" = Time Stopper
"Topaz Adjust 4" = Topaz Adjust 4
"Topaz Adjust 4 (64-bit)" = Topaz Adjust 4 (64-bit)
"Topaz Clean 3" = Topaz Clean 3
"Topaz Clean 3 (64-bit)" = Topaz Clean 3 (64-bit)
"Topaz DeJpeg 4" = Topaz DeJpeg 4
"Topaz DeJpeg 4 (64-bit)" = Topaz DeJpeg 4 (64-bit)
"Topaz DeNoise 5" = Topaz DeNoise 5
"Topaz DeNoise 5 (64-bit)" = Topaz DeNoise 5 (64-bit)
"Topaz Detail 2" = Topaz Detail 2
"Topaz Detail 2 (64-bit)" = Topaz Detail 2 (64-bit)
"Topaz Fusion Express 2" = Topaz Fusion Express 2
"Topaz Fusion Express 2 (64-bit)" = Topaz Fusion Express 2 (64-bit)
"Topaz InFocus" = Topaz InFocus
"Topaz InFocus (64-bit)" = Topaz InFocus (64-bit)
"Topaz Lens Effects" = Topaz Lens Effects
"Topaz Lens Effects (64-bit)" = Topaz Lens Effects (64-bit)
"Topaz ReMask 3" = Topaz ReMask 3
"Topaz ReMask 3 (64-bit)" = Topaz ReMask 3 (64-bit)
"Topaz Simplify 3" = Topaz Simplify 3
"Topaz Simplify 3 (64-bit)" = Topaz Simplify 3 (64-bit)
"Totalcmd" = Total Commander (Remove or Repair)
"uTorrent" = µTorrent
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 2.0.0
"WampServer 2_is1" = WampServer 2.2
"Winamp" = Winamp
"winscp3_is1" = WinSCP 4.3.7
"WinUAE" = WinUAE 2.3.3
"Wireshark" = Wireshark 1.6.7 (64-bit)
"xampp" = XAMPP 1.7.4
"XMedia Recode" = XMedia Recode 3.0.7.0
"xp-AntiSpy" = xp-AntiSpy 3.97-11
"Xvid Video Codec 1.3.2" = Xvid Video Codec
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{87686C21-8A15-4b4d-A3F1-11141D9BE094}" = Battlefield Play4Free
"d734575cd6cff35b" = Stegano.Net
"FileZilla Client" = FileZilla Client 3.4.0
"Google Chrome" = Google Chrome
"Hawken" = Hawken
"Kies Air Discovery Service" = Kies Air Discovery Service
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
"QLandkarte GT" = QLandkarte GT (remove only)
"SOE-PlanetSide 2 Beta" = PlanetSide 2 Beta
"Spotify" = Spotify
"stolencamerafinder" = stolencamerafinder
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"UnityWebPlayer" = Unity Web Player
"uTorrent" = µTorrent
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 01.10.2012 15:40:53 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 01.10.2012 15:43:48 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\Samsung\Samsung
PC Studio 7\TIS_VistaPIM.dll". Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 01.10.2012 18:48:19 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 02.10.2012 19:58:47 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 04.10.2012 19:25:00 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 06.10.2012 19:25:20 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 07.10.2012 17:12:24 | Computer Name = ChosenOne | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: PlanetSide2.exe, Version: 0.0.0.0,
Zeitstempel: 0x5070c049 Name des fehlerhaften Moduls: PlanetSide2.exe, Version:
0.0.0.0, Zeitstempel: 0x5070c049 Ausnahmecode: 0xc0000005 Fehleroffset: 0x012e61eb
ID
des fehlerhaften Prozesses: 0x1824 Startzeit der fehlerhaften Anwendung: 0x01cda4ce24367f69
Pfad
der fehlerhaften Anwendung: D:\Spiele\PlanetSide 2\PlanetSide2.exe Pfad des fehlerhaften
Moduls: D:\Spiele\PlanetSide 2\PlanetSide2.exe Berichtskennung: aff5d9ed-10c3-11e2-bae0-00241ddbd724
Error - 08.10.2012 13:52:07 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 09.10.2012 18:32:00 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 10.10.2012 18:31:52 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
[ Media Center Events ]
Error - 29.03.2011 12:11:19 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 18:11:19 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)
Error - 31.03.2011 17:30:53 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 23:30:53 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)
Error - 01.05.2011 06:21:56 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 12:21:56 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)
Error - 05.05.2011 07:15:47 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 13:15:47 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)
Error - 10.05.2011 10:33:27 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 16:33:26 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)
Error - 17.05.2011 08:01:39 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 14:01:28 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)
Error - 24.05.2011 16:08:28 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 22:08:19 - Broadband konnte nicht abgerufen werden (Fehler: Die Verbindung
mit dem Remoteserver kann nicht hergestellt werden.)
Error - 26.05.2011 08:49:00 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 14:48:59 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)
Error - 18.09.2011 21:02:33 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 03:01:59 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)
Error - 23.09.2011 05:23:06 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 11:23:06 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)
[ OSession Events ]
Error - 09.03.2011 22:15:11 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 35530
seconds with 60 seconds of active time. This session ended with a crash.
Error - 18.03.2011 01:11:34 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 50556
seconds with 120 seconds of active time. This session ended with a crash.
Error - 28.03.2011 15:56:35 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 25290
seconds with 360 seconds of active time. This session ended with a crash.
Error - 05.05.2011 09:20:07 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6555.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 501
seconds with 120 seconds of active time. This session ended with a crash.
Error - 08.12.2011 15:48:26 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 6515
seconds with 120 seconds of active time. This session ended with a crash.
Error - 16.09.2012 16:13:29 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 6
seconds with 0 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 10.10.2012 11:51:04 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7031
Description = Der Dienst "NLA (Network Location Awareness)" wurde unerwartet beendet.
Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden
durchgeführt: Neustart des Diensts.
Error - 10.10.2012 11:51:04 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Remotedesktopdienste" wurde unerwartet beendet. Dies ist
bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
durchgeführt: Neustart des Diensts.
Error - 10.10.2012 11:53:04 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
des Dienstes "DNS-Client" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen,
ist fehlgeschlagen. Fehler: %%1056
Error - 10.10.2012 13:57:19 | Computer Name = ChosenOne | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error - 10.10.2012 15:51:14 | Computer Name = ChosenOne | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error - 11.10.2012 02:51:58 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet
beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error - 11.10.2012 03:26:20 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7034
Description = Dienst "Creative Audio Service" wurde unerwartet beendet. Dies ist
bereits 1 Mal passiert.
Error - 11.10.2012 04:01:14 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Windows Live ID Sign-in Assistant erreicht.
Error - 11.10.2012 04:01:14 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows Live ID Sign-in Assistant" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1053
Error - 11.10.2012 11:03:57 | Computer Name = ChosenOne | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
< End of report >
 Falls ich es noch nicht gesagt habe: Ein wirklich dickes, dickes Dankeschön für deine Hilfe!!! |
|
12.10.2012, 07:29
| #8 | ||
| /// Helfer-Team | Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) ** Lass dein System in der nächste Zeit noch unter Beobachtung! wenn alles gut verlaufen ist und dein System läuft stabil,mache folgendes: 1. Programme deinstallieren/entfernen, die wir verwendet haben und nicht brauchst, bis auf: Code:
ATTFilter CCleaner
2. Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
3. Windows legt beispielsweise regelmäßig Schattenkopien an (mindestens einmal täglich), die im Notfall zur Wiederherstellung des Systems und zum Zugriff auf ältere Dateiversionen dienen. Diese Funktion belegt sehr viel Speicherplatz. Standardmäßig beträgt der für Schattenkopien reservierte Speicherplatz 15 % der Volumegröße, so dass die Systemleistung auch beeinträchtigt wird. Außerdem gelöschte und ev. schädliche Objekte, die in der Systemwiederherstellung sitzen, müssen auch entfernt werden: Also mach bitte folgendes:
4. Ich würde Dir vorsichtshalber raten, dein Passwort zu ändern (man sollte alle 3-4 Monate machen) z.B. Login-, Mail- oder Website-Passwörter Tipps: Die sichere Passwort-Wahl - (sollte man eigentlich regelmäßigen Abständen ca. alle 3-5 Monate ändern) auch noch hier unter: Sicheres Kennwort (Password) 5. ► Schaue bitte nach, ob für Windows neue Update gibt?!:-> - Microsoft Update hält Ihren Computer auf dem neuesten Stand! -> Installiere jedes Update das Dir angeboten wird, wiederhole den Vorgang so oft, bis nicht mehr gibt Lesestoff Nr.1: Gib Kriminellen Handlungen keine Chance! Zitat:
** Der gesunde Menschenverstand, Windows und Internet-Software sicher konfigurieren ist der beste Weg zur Sicherheit im Webverkehr ist !! Zitat:
► Kann sich auf Dauer eine Menge Datenmüll ansammeln, sich Fehlermeldungen häufen, der PC ist wahrscheinlich nicht mehr so schnell, wie früher:
Wenn Du uns unterstützen möchtest→ Spendekonto gruß kira
__________________ Warnung!: Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein! Anhang nicht öffnen, in unserem Forum erst nachfragen! Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten! Bitte diese Warnung weitergeben, wo Du nur kannst! |
|
12.10.2012, 20:37
| #9 |
| | Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) So, habe alles genaustens befolgt!  Passwörter sind geändert. System bereinigt. Fühlt sich alles sogar einen Hauch weniger träge an  Habe heute während des Tages immer ein halbes Auge auf den Ressourcenmonitor gehabt und es sind keine verdächtigen Verbindungen mehr aufgetaucht (Hab alle IPs mit tracert überprüft )!Ich werd das ganze jetzt noch mal ein paar Tage weiter beobachten, aber momentan sieht alles wieder echt gut aus! Noch einmal vielen Dank für die Hilfe!!! |
|
| Themen zu Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) |
| aswmbr, avast, bräuchte, computer, dringend, e-mail, entdeck, gelöscht, hallo zusammen, hijack, hijackthis, hosts-datei, internetverbindung, langsam, links, malware, mbam, namen, nichts, passwort, programme, trojaner, verbindung, verbindungen, virusscan, wurm |
.
Linear-Darstellung
