| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Hallo ich einen trojaner.. TR/PSW.Zbot.5634Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.11.2012, 19:38
| #1 |
| |  Hallo ich einen trojaner.. TR/PSW.Zbot.5634 Hallo liebe community, Ich habe mir ich weiß nicht wie einen Trojaner eingefangen und seit dem stürtz mein pc ab und da kommt ein bluescreen mit "your computer shut down to prevent damge to your pc" ich weiß nicht wie ich den wegbekommen soll mein antivir avira hat zwar was gefunden aber ich weiß bzw bin mir nicht sicher was ich jez machen soll hier ist dier report datei.... bitte bitte helft mir! Avira Free Antivirus Erstellungsdatum der Reportdatei: Donnerstag, 1. November 2012 19:27 Es wird nach 4433793 Virenstämmen gesucht. Das Programm läuft als uneingeschränkte Vollversion. Online-Dienste stehen zur Verfügung. Lizenznehmer : Avira Free Antivirus Seriennummer : 0000149996-ADJIE-0000001 Plattform : Windows 7 Home Premium Windowsversion : (Service Pack 1) [6.1.7601] Boot Modus : Normal gebootet Benutzername : SYSTEM Computername : MERTKUMAK-PC Versionsinformationen: BUILD.DAT : 12.0.0.1199 40869 Bytes 07.09.2012 22:14:00 AVSCAN.EXE : 12.3.0.33 468472 Bytes 18.07.2012 16:04:24 AVSCAN.DLL : 12.3.0.15 66256 Bytes 18.07.2012 16:04:38 LUKE.DLL : 12.3.0.15 68304 Bytes 18.07.2012 16:04:31 AVSCPLR.DLL : 12.3.0.27 97064 Bytes 18.07.2012 16:04:24 AVREG.DLL : 12.3.0.33 232232 Bytes 18.07.2012 16:04:23 VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 18:18:34 VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 23:22:12 VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 23:31:36 VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 09:58:50 VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 22:37:35 VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 16:04:37 VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 17:12:51 VBASE007.VDF : 7.11.45.207 2363904 Bytes 11.10.2012 11:57:45 VBASE008.VDF : 7.11.45.208 2048 Bytes 11.10.2012 11:57:45 VBASE009.VDF : 7.11.45.209 2048 Bytes 11.10.2012 11:57:45 VBASE010.VDF : 7.11.45.210 2048 Bytes 11.10.2012 11:57:45 VBASE011.VDF : 7.11.45.211 2048 Bytes 11.10.2012 11:57:45 VBASE012.VDF : 7.11.45.212 2048 Bytes 11.10.2012 11:57:45 VBASE013.VDF : 7.11.45.213 2048 Bytes 11.10.2012 11:57:45 VBASE014.VDF : 7.11.46.65 220160 Bytes 16.10.2012 14:22:04 VBASE015.VDF : 7.11.46.153 173568 Bytes 18.10.2012 14:22:11 VBASE016.VDF : 7.11.46.223 162304 Bytes 19.10.2012 15:31:29 VBASE017.VDF : 7.11.47.35 126464 Bytes 22.10.2012 15:31:34 VBASE018.VDF : 7.11.47.95 175616 Bytes 24.10.2012 15:31:32 VBASE019.VDF : 7.11.47.177 164352 Bytes 26.10.2012 15:31:34 VBASE020.VDF : 7.11.47.229 143360 Bytes 28.10.2012 16:31:20 VBASE021.VDF : 7.11.48.47 138240 Bytes 30.10.2012 16:31:21 VBASE022.VDF : 7.11.48.135 122880 Bytes 01.11.2012 16:31:22 VBASE023.VDF : 7.11.48.136 2048 Bytes 01.11.2012 16:31:22 VBASE024.VDF : 7.11.48.137 2048 Bytes 01.11.2012 16:31:22 VBASE025.VDF : 7.11.48.138 2048 Bytes 01.11.2012 16:31:22 VBASE026.VDF : 7.11.48.139 2048 Bytes 01.11.2012 16:31:22 VBASE027.VDF : 7.11.48.140 2048 Bytes 01.11.2012 16:31:22 VBASE028.VDF : 7.11.48.141 2048 Bytes 01.11.2012 16:31:22 VBASE029.VDF : 7.11.48.142 2048 Bytes 01.11.2012 16:31:22 VBASE030.VDF : 7.11.48.143 2048 Bytes 01.11.2012 16:31:22 VBASE031.VDF : 7.11.48.152 23552 Bytes 01.11.2012 16:31:22 Engineversion : 8.2.10.187 AEVDF.DLL : 8.1.2.10 102772 Bytes 23.08.2012 08:56:31 AESCRIPT.DLL : 8.1.4.60 463227 Bytes 05.10.2012 15:51:38 AESCN.DLL : 8.1.9.2 131444 Bytes 27.09.2012 12:12:23 AESBX.DLL : 8.2.5.12 606578 Bytes 18.07.2012 16:04:20 AERDL.DLL : 8.1.9.15 639348 Bytes 20.01.2012 23:21:32 AEPACK.DLL : 8.3.0.38 811382 Bytes 28.09.2012 12:13:05 AEOFFICE.DLL : 8.1.2.48 201082 Bytes 25.09.2012 12:13:18 AEHEUR.DLL : 8.1.4.118 5423480 Bytes 11.10.2012 16:14:31 AEHELP.DLL : 8.1.25.2 258423 Bytes 11.10.2012 16:14:10 AEGEN.DLL : 8.1.5.38 434548 Bytes 27.09.2012 12:12:20 AEEXP.DLL : 8.2.0.6 115060 Bytes 11.10.2012 16:14:32 AEEMU.DLL : 8.1.3.2 393587 Bytes 23.08.2012 08:54:37 AECORE.DLL : 8.1.28.2 201079 Bytes 27.09.2012 12:12:16 AEBB.DLL : 8.1.1.3 53621 Bytes 19.10.2012 14:22:23 AVWINLL.DLL : 12.3.0.15 27344 Bytes 18.07.2012 16:04:25 AVPREF.DLL : 12.3.0.15 51920 Bytes 18.07.2012 16:04:23 AVREP.DLL : 12.3.0.15 179208 Bytes 18.07.2012 16:04:23 AVARKT.DLL : 12.3.0.15 211408 Bytes 18.07.2012 16:04:21 AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 18.07.2012 16:04:22 SQLITE3.DLL : 3.7.0.1 398288 Bytes 18.07.2012 16:04:34 AVSMTP.DLL : 12.3.0.32 63480 Bytes 18.07.2012 16:04:24 NETNT.DLL : 12.3.0.15 17104 Bytes 18.07.2012 16:04:31 RCIMAGE.DLL : 12.3.0.31 4444408 Bytes 18.07.2012 16:04:41 RCTEXT.DLL : 12.3.0.31 100088 Bytes 18.07.2012 16:04:41 Konfiguration für den aktuellen Suchlauf: Job Name..............................: AVGuardAsyncScan Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_5092bed5\guard_slideup.avp Protokollierung.......................: standard Primäre Aktion........................: reparieren Sekundäre Aktion......................: quarantäne Durchsuche Masterbootsektoren.........: ein Durchsuche Bootsektoren...............: aus Durchsuche aktive Programme...........: ein Durchsuche Registrierung..............: aus Suche nach Rootkits...................: aus Integritätsprüfung von Systemdateien..: aus Datei Suchmodus.......................: Alle Dateien Durchsuche Archive....................: ein Rekursionstiefe einschränken..........: 20 Archiv Smart Extensions...............: ein Makrovirenheuristik...................: ein Dateiheuristik........................: vollständig Beginn des Suchlaufs: Donnerstag, 1. November 2012 19:27 Der Suchlauf über gestartete Prozesse wird begonnen: Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'AlienFXHook32Mngr.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'vdDaemon.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'razerofa.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'razertra.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'WLanGUI.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'Updater.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'razerhid.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'reader_sl.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'IAStorIcon.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'ONENOTEM.EXE' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'Origin.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'Skype.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'AlienwareAlienFXController.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'STService.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'AVWEBGRD.EXE' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'nvSCPAPISvr.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'Updater.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'sftservice.EXE' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'PnkBstrA.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'mbamgui.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'NBService.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'mbamservice.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'mbamscheduler.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'WlanNetService.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht Der Suchlauf über die ausgewählten Dateien wird begonnen: Beginne mit der Suche in 'C:\Users\MertKumak\AppData\Roaming\Ysbo\wadoi.exe' C:\Users\MertKumak\AppData\Roaming\Ysbo\wadoi.exe [FUND] Ist das Trojanische Pferd TR/PSW.Zbot.5634 [HINWEIS] Der Registrierungseintrag <HKEY_USERS\S-1-5-21-2074212562-3771722251-1247847116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ivfeyqamz> wurde erfolgreich repariert. [HINWEIS] Der Registrierungseintrag <HKEY_USERS\S-1-5-21-2074212562-3771722251-1247847116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ivfeyqamz> wurde erfolgreich repariert. [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '56d71043.qua' verschoben! Ende des Suchlaufs: Donnerstag, 1. November 2012 19:27 Benötigte Zeit: 00:14 Minute(n) Der Suchlauf wurde vollständig durchgeführt. 0 Verzeichnisse wurden überprüft 30 Dateien wurden geprüft 1 Viren bzw. unerwünschte Programme wurden gefunden 0 Dateien wurden als verdächtig eingestuft 0 Dateien wurden gelöscht 0 Viren bzw. unerwünschte Programme wurden repariert 1 Dateien wurden in die Quarantäne verschoben 0 Dateien wurden umbenannt 0 Dateien konnten nicht durchsucht werden 29 Dateien ohne Befall 0 Archive wurden durchsucht 0 Warnungen 1 Hinweise |
|
01.11.2012, 19:41
| #2 |
| /// Malware-holic   | Hallo ich einen trojaner.. TR/PSW.Zbot.5634 hi
__________________also läuft dein computer gar nicht mehr oder nur eingeschrenkt, falls er noch läuft, worauf zumindest das log hindeutet: Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
__________________ |
|
01.11.2012, 20:13
| #3 |
| | Hallo ich einen trojaner.. TR/PSW.Zbot.5634 hallo danke hab alles gemacht was du gesagt hast hier ist der normal otl reportOTL Logfile:
__________________Code:
ATTFilter OTL logfile created on: 01.11.2012 19:48:29 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\MertKumak\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,99 Gb Total Physical Memory | 3,25 Gb Available Physical Memory | 54,24% Memory free 11,98 Gb Paging File | 8,76 Gb Available in Paging File | 73,16% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 271,35 Gb Total Space | 97,76 Gb Free Space | 36,03% Space Free | Partition Type: NTFS Computer Name: MERTKUMAK-PC | User Name: MertKumak | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\MertKumak\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\WINDOWS\SysWOW64\PnkBstrA.exe () PRC - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe (Adobe Systems, Inc.) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\program files (x86)\avira\antivir desktop\avcenter.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) PRC - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe () PRC - C:\Program Files (x86)\Razer\DeathAdder\razertra.exe () PRC - C:\Program Files (x86)\Razer\DeathAdder\vdDaemon.exe () PRC - C:\Program Files (x86)\avmwlanstick\WLanGUI.exe (AVM Berlin) PRC - C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\AlienRespawn\sftservice.EXE (SoftThinks SAS) PRC - C:\Program Files (x86)\AlienRespawn\Components\Scheduler\STService.exe () PRC - C:\Program Files\Alienware\Command Center\AlienFXHook32Mngr.exe (Alienware) PRC - C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe (Alienware Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG) PRC - C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe (Razer Inc.) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Steam\bin\libcef.dll () MOD - C:\Program Files (x86)\Steam\bin\avcodec-53.dll () MOD - C:\Program Files (x86)\Steam\bin\chromehtml.DLL () MOD - C:\Program Files (x86)\Steam\bin\avformat-53.dll () MOD - C:\Program Files (x86)\Steam\bin\avutil-51.dll () MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\635b3aec298ad5e8c903b2323d79cc5a\IAStorUtil.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll () MOD - C:\program files (x86)\avira\antivir desktop\sqlite3.dll () MOD - C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe () MOD - C:\Program Files (x86)\Razer\DeathAdder\razertra.exe () MOD - C:\Program Files (x86)\Razer\DeathAdder\vdDaemon.exe () MOD - C:\Windows\assembly\GAC_MSIL\AlienLabs.MasterIOBoard.Communication.PID0x513\1.0.90.0__bebb3c8816410241\AlienLabs.MasterIOBoard.Communication.PID0x513.dll () MOD - C:\Windows\assembly\GAC_MSIL\LightFX\1.0.90.0__bebb3c8816410241\LightFX.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienLabs.MasterIOBoard.Communication\1.0.90.0__bebb3c8816410241\AlienLabs.MasterIOBoard.Communication.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienLabs.MasterIOBoard.Communication.Core\1.0.90.0__bebb3c8816410241\AlienLabs.MasterIOBoard.Communication.Core.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienwareAlienFXModelResources\1.0.90.0__bebb3c8816410241\AlienwareAlienFXModelResources.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienwareAlienFXTools\1.0.90.0__bebb3c8816410241\AlienwareAlienFXTools.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienLabsTools\1.0.90.0__bebb3c8816410241\AlienLabsTools.dll () MOD - C:\Windows\assembly\GAC_MSIL\Alienlabs.CommandCenter.Tools\1.0.90.0__bebb3c8816410241\Alienlabs.CommandCenter.Tools.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x511\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x511.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x514\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x514.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x512\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x512.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x516\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x516.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x515\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x515.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.XPS\1.0.90.0__bebb3c8816410241\AlienFX.Communication.XPS.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.DeviceDiscovery\1.0.90.0__bebb3c8816410241\AlienFX.DeviceDiscovery.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.PID0x513\1.0.90.0__bebb3c8816410241\AlienFX.Communication.PID0x513.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication.Core\1.0.90.0__bebb3c8816410241\AlienFX.Communication.Core.dll () MOD - C:\Windows\assembly\GAC_MSIL\AlienFX.Communication\1.0.90.0__bebb3c8816410241\AlienFX.Communication.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll () MOD - C:\Program Files (x86)\AlienRespawn\zlib1.dll () MOD - C:\Program Files (x86)\AlienRespawn\STPE.dll () MOD - C:\Program Files (x86)\AlienRespawn\STRegistry.dll () MOD - C:\Program Files (x86)\AlienRespawn\STFiles.dll () MOD - C:\Program Files (x86)\AlienRespawn\STLog.dll () MOD - C:\Program Files (x86)\AlienRespawn\STNLS.dll () MOD - C:\Program Files (x86)\AlienRespawn\LibXml2.dll () MOD - C:\Program Files (x86)\AlienRespawn\Components\Scheduler\STService.exe () MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll () ========== Services (SafeList) ========== SRV:64bit: - (AlienFusionService) -- C:\Program Files\Alienware\Command Center\AlienFusionService.exe (Alienware) SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (PnkBstrA) -- C:\WINDOWS\SysWOW64\PnkBstrA.exe () SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (AVM WLAN Connection Service) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (SftService) -- C:\Program Files (x86)\AlienRespawn\sftservice.EXE (SoftThinks SAS) SRV - (clr_optimization_v4.0.30319_32) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG) ========== Driver Services (SafeList) ========== DRV:64bit: - (MBAMProtector) -- C:\WINDOWS\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (avipbb) -- C:\WINDOWS\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avkmgr) -- C:\WINDOWS\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\WINDOWS\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (USBAAPL64) -- C:\WINDOWS\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (amdsata) -- C:\WINDOWS\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\WINDOWS\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (AWOPFilterDriver) -- C:\WINDOWS\SysNative\drivers\AWOPFilterDriver.sys () DRV:64bit: - (HpSAMD) -- C:\WINDOWS\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\WINDOWS\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (fwlanusb4) -- C:\WINDOWS\SysNative\drivers\fwlanusb4.sys (AVM GmbH) DRV:64bit: - (avmeject) -- C:\WINDOWS\SysNative\drivers\avmeject.sys (AVM Berlin) DRV:64bit: - (VKbms) -- C:\WINDOWS\SysNative\drivers\VKbms.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (NVHDA) -- C:\WINDOWS\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (danewFltr) -- C:\WINDOWS\SysNative\drivers\danew.sys (Razer (Asia-Pacific) Pte Ltd) DRV:64bit: - (iaStor) -- C:\WINDOWS\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (k57nd60a) -- C:\WINDOWS\SysNative\drivers\k57nd60a.sys (Broadcom Corporation) DRV:64bit: - (xusb21) -- C:\WINDOWS\SysNative\drivers\xusb21.sys (Microsoft Corporation) DRV:64bit: - (SI3132) -- C:\WINDOWS\SysNative\drivers\SI3132.sys (Silicon Image, Inc) DRV:64bit: - (SiFilter) -- C:\WINDOWS\SysNative\drivers\SiWinAcc.sys (Silicon Image, Inc) DRV:64bit: - (SiRemFil) -- C:\WINDOWS\SysNative\drivers\SiRemFil.sys (Silicon Image, Inc) DRV:64bit: - (amdsbs) -- C:\WINDOWS\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\WINDOWS\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\WINDOWS\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (ebdrv) -- C:\WINDOWS\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\WINDOWS\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\WINDOWS\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\WINDOWS\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (WimFltr) -- C:\WINDOWS\SysNative\drivers\WimFltr.sys (Microsoft Corporation) DRV - (WIMMount) -- C:\WINDOWS\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IEAUTOBR IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.alienware.com/ IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://support.alienware.com [binary data] IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://support.alienware.com [binary data] IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2625848 IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&babsrc=SP_ss&mntrId=54f8262d000000000000f04da2dbc9c1 IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb165/?search={searchTerms}&loc=IB_DS&a=6R8votxexb&i=26 IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\..\SearchScopes\{D50B25D7-600D-4565-914D-9D38742D7BCF}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=d1facdd4-9d7a-4eeb-af5c-baca8ebac23b&apn_sauid=C2DAA5BE-E774-4150-A399-B24B9D60E918 IE - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.30 20:57:42 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.30 20:57:42 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\MertKumak\AppData\Roaming\12001.025 [2012.06.25 14:24:17 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\MertKumak\AppData\Roaming\14001.017 [2012.08.23 10:04:46 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.30 20:57:42 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.12 18:05:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MertKumak\AppData\Roaming\mozilla\Extensions [2012.10.30 20:57:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.05.12 18:15:40 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.07.13 21:29:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012.07.12 21:56:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\ffxtlbr@babylon.com [2012.07.26 23:00:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\staged [2012.10.24 18:50:04 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.10.24 23:03:12 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.07.12 21:56:02 | 000,002,313 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml [2012.10.24 23:03:11 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.10.24 23:03:12 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.10.24 23:03:12 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.10.24 23:03:12 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.10.24 23:03:11 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\WINDOWS\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found. O4:64bit: - HKLM..\Run: [] File not found O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [AlienFX Controller] C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe (Alienware Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [RunDLLEntry_EptMon] C:\Windows\SysNative\EptMon64.DLL (Creative Technology Ltd.) O4:64bit: - HKLM..\Run: [RunDLLEntry_THXCfg] C:\Windows\SysNative\THXCfg64.DLL (Creative Technology Ltd.) O4:64bit: - HKLM..\Run: [Thermal Controller] C:\Program Files\Alienware\Command Center\ThermalController.exe (Alienware Corp.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin) O4 - HKLM..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe () O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [THX Audio Control Panel] C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe (Creative Technology Ltd) O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000..\Run: [EADM] C:\Program Files (x86)\Origin\Origin.exe (Electronic Arts) O4 - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000..\Run: [Ivfeyqamz] C:\Users\MertKumak\AppData\Roaming\Ysbo\wadoi.exe File not found O4 - HKU\S-1-5-21-2074212562-3771722251-1247847116-1000..\Run: [Speech Recognition] C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\AlienRespawn\Components\Scheduler\Launcher.exe (Softthinks) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3352D870-3DA1-4F11-9DD7-F7E581E9D2B5}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3464E3FA-8024-4CD4-8CA0-F86435D2CF4E}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysWOW64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{259e9961-0bd8-11e2-a0ce-f04da2dbc9c1}\Shell - "" = AutoRun O33 - MountPoints2\{259e9961-0bd8-11e2-a0ce-f04da2dbc9c1}\Shell\AutoRun\command - "" = E:\pushinst.exe O33 - MountPoints2\{b5ce66ae-02f6-11e0-aaec-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{b5ce66ae-02f6-11e0-aaec-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe /autorun O33 - MountPoints2\{e674c781-a197-11e1-8bb2-f04da2dbc9c1}\Shell - "" = AutoRun O33 - MountPoints2\{e674c781-a197-11e1-8bb2-f04da2dbc9c1}\Shell\AutoRun\command - "" = E:\HTC_Sync_Manager_PC.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.11.01 13:47:53 | 042,389,504 | ---- | C] (Blizzard Entertainment) -- C:\Users\MertKumak\Desktop\StarCraft-II-Setup-enGB.exe [2012.10.30 20:57:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2012.10.30 20:56:46 | 018,090,960 | ---- | C] (Mozilla) -- C:\Users\MertKumak\Desktop\Firefox_Setup_16.0.2.exe [2012.10.30 20:52:07 | 000,000,000 | ---D | C] -- C:\Users\MertKumak\AppData\Roaming\Ysbo [2012.10.30 20:52:07 | 000,000,000 | ---D | C] -- C:\Users\MertKumak\AppData\Roaming\Iwwa [2012.10.30 20:52:07 | 000,000,000 | ---D | C] -- C:\Users\MertKumak\AppData\Roaming\Avofk [2012.10.26 20:56:05 | 020,626,992 | ---- | C] (DVDVideoSoft Ltd. ) -- C:\Users\MertKumak\Desktop\FreeYouTubeToMP3Converter34.exe [2012.10.26 00:10:57 | 000,000,000 | ---D | C] -- C:\Users\MertKumak\Documents\My Games [2012.10.23 20:19:50 | 000,000,000 | ---D | C] -- C:\Users\MertKumak\AppData\Local\THQ [2012.10.23 15:33:41 | 000,000,000 | ---D | C] -- C:\Users\MertKumak\AppData\Local\PunkBuster [2012.10.23 15:33:38 | 000,000,000 | ---D | C] -- C:\Users\MertKumak\Documents\BFBC2 [2012.10.19 16:53:04 | 000,000,000 | ---D | C] -- C:\Users\MertKumak\AppData\Roaming\2K Sports [2012.10.19 16:31:07 | 000,000,000 | ---D | C] -- C:\Users\MertKumak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\2K Sports [2012.10.19 16:18:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\2K Sports [2012.10.10 12:27:08 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2012.10.10 12:27:07 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2012.10.10 12:27:07 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2012.10.10 12:27:04 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll [2012.10.10 12:27:04 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll [2012.10.10 12:27:04 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe [2012.10.10 12:27:04 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll [2012.10.10 12:27:04 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll [2012.10.10 12:27:03 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll [2012.10.10 12:27:03 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2012.10.10 12:27:03 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll [2012.10.10 12:27:03 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2012.10.10 12:27:03 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll [2012.10.10 12:27:03 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2012.10.10 12:27:03 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll [2012.10.10 12:27:03 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll [2012.10.10 12:27:03 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll [2012.10.10 12:27:03 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2012.10.10 12:27:03 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll [2012.10.10 12:27:03 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll [2012.10.10 12:27:03 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll [2012.10.10 12:27:03 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll [2012.10.10 12:27:03 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll [2012.10.10 12:27:03 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll [2012.10.10 12:27:03 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll [2012.10.10 12:27:03 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll [2012.10.10 12:27:03 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll [2012.10.10 12:27:03 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll [2012.10.10 12:27:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll [2012.10.10 12:27:02 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll [2012.10.10 12:27:02 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll [2012.10.10 12:27:02 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll [2012.10.10 12:27:02 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll [2012.10.10 12:27:02 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll [2012.10.10 12:27:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll [2012.10.10 12:27:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll [2012.10.10 12:27:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll [2012.10.10 12:27:01 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2012.10.10 12:26:57 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll [2012.10.10 12:26:48 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2012.10.10 12:26:47 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2 C:\Users\MertKumak\AppData\Roaming\*.tmp files -> C:\Users\MertKumak\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.11.01 19:51:05 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.11.01 19:34:42 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.11.01 19:34:42 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.11.01 19:33:12 | 004,476,530 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.11.01 19:33:12 | 001,732,142 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.11.01 19:33:12 | 001,316,090 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.11.01 19:33:12 | 001,172,026 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.11.01 19:33:12 | 000,005,194 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.11.01 19:25:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.11.01 19:25:51 | 584,553,974 | ---- | M] () -- C:\Windows\MEMORY.DMP [2012.11.01 19:25:50 | 529,731,583 | -HS- | M] () -- C:\hiberfil.sys [2012.11.01 19:25:00 | 000,003,408 | ---- | M] () -- C:\bootsqm.dat [2012.11.01 13:47:53 | 042,389,504 | ---- | M] (Blizzard Entertainment) -- C:\Users\MertKumak\Desktop\StarCraft-II-Setup-enGB.exe [2012.10.30 20:57:44 | 000,001,153 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.10.30 20:56:51 | 018,090,960 | ---- | M] (Mozilla) -- C:\Users\MertKumak\Desktop\Firefox_Setup_16.0.2.exe [2012.10.29 11:56:40 | 000,215,128 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.10.29 11:56:40 | 000,215,128 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.10.28 21:15:18 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2012.10.26 21:02:20 | 006,265,891 | ---- | M] () -- C:\Users\MertKumak\Desktop\[Live HD 720p] 120715 - PSY - Gangnam style (Comeback stage) - Inkigayo.mp3 [2012.10.26 21:01:14 | 004,500,932 | ---- | M] () -- C:\Users\MertKumak\Desktop\NICKELBACK - When We Stand Together (HD).mp3 [2012.10.26 21:00:40 | 005,955,233 | ---- | M] () -- C:\Users\MertKumak\Desktop\Alex Clare - Too Close (OFFICIAL VIDEO).mp3 [2012.10.26 20:59:38 | 000,000,009 | ---- | M] () -- C:\END [2012.10.26 20:57:28 | 020,626,992 | ---- | M] (DVDVideoSoft Ltd. ) -- C:\Users\MertKumak\Desktop\FreeYouTubeToMP3Converter34.exe [2012.10.26 19:00:23 | 000,001,115 | ---- | M] () -- C:\Users\MertKumak\Desktop\ Malwarebytes Anti-Malware .lnk [2012.10.26 18:52:52 | 083,023,306 | ---- | M] () -- C:\ProgramData\0tbpw.pad [2012.10.23 20:03:28 | 000,076,888 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe [2012.10.19 16:31:07 | 000,001,164 | ---- | M] () -- C:\Users\MertKumak\Desktop\NBA 2K11.lnk [2012.10.16 15:26:32 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.10.16 15:26:32 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2 C:\Users\MertKumak\AppData\Roaming\*.tmp files -> C:\Users\MertKumak\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.11.01 19:25:00 | 000,003,408 | ---- | C] () -- C:\bootsqm.dat [2012.10.30 20:57:44 | 000,001,165 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.10.30 20:57:44 | 000,001,153 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.10.26 21:01:52 | 006,265,891 | ---- | C] () -- C:\Users\MertKumak\Desktop\[Live HD 720p] 120715 - PSY - Gangnam style (Comeback stage) - Inkigayo.mp3 [2012.10.26 21:00:56 | 004,500,932 | ---- | C] () -- C:\Users\MertKumak\Desktop\NICKELBACK - When We Stand Together (HD).mp3 [2012.10.26 21:00:16 | 005,955,233 | ---- | C] () -- C:\Users\MertKumak\Desktop\Alex Clare - Too Close (OFFICIAL VIDEO).mp3 [2012.10.26 20:59:38 | 000,000,009 | ---- | C] () -- C:\END [2012.10.26 18:22:15 | 083,023,306 | ---- | C] () -- C:\ProgramData\0tbpw.pad [2012.10.23 15:33:44 | 000,215,128 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.10.19 16:31:07 | 000,001,164 | ---- | C] () -- C:\Users\MertKumak\Desktop\NBA 2K11.lnk [2012.10.16 15:26:32 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.10.03 20:10:13 | 000,013,189 | R--- | C] () -- C:\Windows\instwcli.inf [2012.09.17 16:54:03 | 000,215,128 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.09.17 16:54:01 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe [2012.09.17 16:54:01 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2012.08.23 14:19:12 | 000,007,626 | ---- | C] () -- C:\Users\MertKumak\AppData\Local\Resmon.ResmonCfg [2012.08.23 05:28:55 | 000,065,536 | ---- | C] () -- C:\Users\MertKumak\AppData\Roaming\ado7swrz.default.dat [2012.07.13 21:29:37 | 000,000,025 | ---- | C] () -- C:\Users\MertKumak\AppData\Roaming\urhtps.dat [2012.05.13 13:25:23 | 000,088,835 | ---- | C] () -- C:\Windows\War3Unin.dat [2012.05.12 18:18:29 | 000,000,600 | ---- | C] () -- C:\Users\MertKumak\AppData\Local\PUTTY.RND [2010.12.08 19:43:27 | 000,177,664 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2010.12.08 19:43:27 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2010.12.08 19:43:27 | 000,001,264 | ---- | C] () -- C:\Windows\THXCfg_SP_APOIM.ini [2010.12.08 19:43:27 | 000,001,247 | ---- | C] () -- C:\Windows\THXCfg_HP_APOIM.ini [2010.12.08 19:43:27 | 000,001,247 | ---- | C] () -- C:\Windows\THXCfg_APOIM.ini ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\WINDOWS\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\WINDOWS\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\WINDOWS\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.06.22 16:02:36 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12001.023 [2012.06.24 17:47:21 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12001.024 [2012.06.25 14:24:17 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12001.025 [2012.06.25 19:20:54 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12001.026 [2012.06.26 14:40:02 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12001.027 [2012.06.12 14:58:27 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12014 [2012.06.13 16:20:01 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12015 [2012.06.14 13:34:28 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12016 [2012.06.15 17:51:17 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12017 [2012.06.17 22:51:17 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12018 [2012.06.18 10:02:36 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12019 [2012.06.18 17:43:16 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12020 [2012.06.19 14:54:56 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12021 [2012.06.21 10:28:25 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\12022 [2012.06.26 20:22:55 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.011 [2012.06.29 13:19:26 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.012 [2012.07.01 12:41:57 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.013 [2012.07.03 12:31:12 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.014 [2012.07.04 17:52:25 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.015 [2012.07.05 15:18:48 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.016 [2012.07.06 15:46:31 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.017 [2012.07.07 16:04:46 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.018 [2012.07.08 14:21:10 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.019 [2012.07.09 12:29:23 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.020 [2012.07.10 17:37:19 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.021 [2012.07.11 13:54:53 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.022 [2012.07.12 19:32:25 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.023 [2012.07.13 17:01:49 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.024 [2012.07.14 20:03:48 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.025 [2012.07.17 16:50:16 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.026 [2012.07.18 11:10:02 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.027 [2012.07.20 22:17:56 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\13001.028 [2012.07.24 00:25:45 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.003 [2012.07.25 11:36:16 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.004 [2012.07.27 20:08:04 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.005 [2012.07.28 20:12:48 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.006 [2012.07.30 13:30:20 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.007 [2012.07.31 18:04:45 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.008 [2012.08.06 15:27:25 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.009 [2012.08.07 13:20:35 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.010 [2012.08.08 14:18:56 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.011 [2012.08.09 13:26:27 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.012 [2012.08.10 19:02:06 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.014 [2012.08.15 16:57:59 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.015 [2012.08.23 05:19:30 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.016 [2012.08.23 10:04:46 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\14001.017 [2012.10.19 16:53:04 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\2K Sports [2012.11.01 17:36:22 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\Avofk [2012.07.12 21:55:40 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\Babylon [2012.08.13 20:28:15 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\becker [2012.11.01 19:45:59 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\DVDVideoSoft [2012.06.10 22:59:47 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\FileZilla [2012.10.30 20:52:07 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\Iwwa [2012.08.23 05:28:54 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\kock [2012.11.01 14:10:11 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\Mumble [2012.07.26 23:03:26 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\Notepad++ [2012.09.16 19:14:11 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\Origin [2012.08.23 05:19:30 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\Razer [2012.07.19 16:09:24 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\Synthesia [2012.09.20 08:48:28 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\The Creative Assembly [2012.10.26 18:56:55 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\TS3Client [2012.07.09 19:30:19 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\UAs [2012.08.23 05:29:39 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\xmldm [2012.11.01 19:27:35 | 000,000,000 | ---D | M] -- C:\Users\MertKumak\AppData\Roaming\Ysbo ========== Purity Check ========== < End of report > und hier das Extra!OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 01.11.2012 19:48:29 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\MertKumak\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
5,99 Gb Total Physical Memory | 3,25 Gb Available Physical Memory | 54,24% Memory free
11,98 Gb Paging File | 8,76 Gb Available in Paging File | 73,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 271,35 Gb Total Space | 97,76 Gb Free Space | 36,03% Space Free | Partition Type: NTFS
Computer Name: MERTKUMAK-PC | User Name: MertKumak | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-2074212562-3771722251-1247847116-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{008245B1-FF7B-4F90-8F99-8E299F22571F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0D13DA6F-9C95-4778-B5EF-21B10E3A72C3}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{0DF42FAD-E796-435B-B321-C2A4F5005483}" = lport=138 | protocol=17 | dir=in | app=system |
"{11443B33-2C67-433D-BE42-6DD030710A6E}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{1394530F-29FA-420A-8187-631FF935216F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{17198728-056E-467C-B032-788319280F5C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{1F4A4E3A-3AB5-4006-A444-BF428C062754}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{22F1E2FC-1ED4-443A-B99D-77B5D38C7F79}" = rport=10243 | protocol=6 | dir=out | app=system |
"{2EC3085F-192D-4D4D-A96D-C1230E2C38AB}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{39AA2079-2A65-49EC-AB82-FCEC7521F913}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3DA379BE-8A4D-4AB8-B5EA-39F32B80D23F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4719676A-E8C4-42F9-8A8B-7063CFAFB941}" = rport=445 | protocol=6 | dir=out | app=system |
"{4F8D5B52-8315-43EE-B4CE-876A1ED9216A}" = lport=10243 | protocol=6 | dir=in | app=system |
"{52A22C4C-E913-48DB-8D6E-EE985982C655}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{5E15054D-DA2B-4955-9CFC-0D014EE6CF1B}" = lport=139 | protocol=6 | dir=in | app=system |
"{67897795-FBC5-41CA-B6E4-92379EA72C66}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{68C84EE7-BEFF-45EB-9A38-FB94F1F98BC7}" = lport=137 | protocol=17 | dir=in | app=system |
"{70C11752-EBA2-4EB1-9301-D2733687099C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{82CA2133-D9D3-459E-8E08-86CE4A240B94}" = rport=138 | protocol=17 | dir=out | app=system |
"{85CE5DAF-396F-4396-BEA7-12F4AFD61D2D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{927A2061-B92B-4384-9B77-5E3EAA6DD656}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BBA2F21E-CCD5-4C72-9456-8AA3F5B1B6EB}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C3AB7B83-D703-41FF-B1FB-5B9E64D03013}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{C84C2C30-4A5C-489E-860E-29D1811F32A7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C9A83BD9-5D5A-46E7-9715-A32E6FB090DD}" = rport=139 | protocol=6 | dir=out | app=system |
"{D12697B7-86F0-41DD-BC31-C0F26F81581D}" = rport=137 | protocol=17 | dir=out | app=system |
"{D27753AB-E1F7-4870-8A62-81D6B4732284}" = lport=445 | protocol=6 | dir=in | app=system |
"{D2FAAB57-2D5E-4854-984F-C2F9FD1C73EF}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EF583757-3813-482D-AC03-C6B43B85D556}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FD766F2D-4EAE-499D-A84D-4551FDB51259}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{013E8BB0-73F2-4B0C-8ABB-55F6704E1003}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\data\encyclopedia\how_to_play.html |
"{02B93B23-4915-407C-8642-B9DA027AFCCC}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{06C9A984-DC49-4591-BBA1-F46C612A260C}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{0C610B73-183D-4081-B187-882E32A10DB3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{0D43FA39-2114-4A30-8786-0E32D82D6108}" = protocol=17 | dir=in | app=c:\program files (x86)\konami\pro evolution soccer 2011\pes2011.exe |
"{0D6809BD-9548-4DBE-98A7-345CF98F655D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0F985EE6-4093-445D-B288-B5A95F535613}" = protocol=6 | dir=in | app=c:\program files (x86)\2k sports\nba 2k11\nba2k11.exe |
"{1151FC02-441C-4E7C-9A87-1A3BC87DCA80}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{149E7B49-5E95-4763-BB3E-707330223244}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\shogun2.exe |
"{18CE5A87-840D-4EFA-A783-3946B5D30172}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\fifa 12\game\fifa.exe |
"{192B5B49-3665-4111-9BFA-F28BD3F8A9FF}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\shogun2.exe |
"{1A5FC527-905D-48C3-88A1-F2A134131BDC}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_specify_properties.bat |
"{1A6A324D-79CE-460F-8340-9426B3A3979D}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{1D6D5828-D621-4011-AF2C-6FB4EBD5E915}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{233CFA12-4A97-4A2E-892F-2ED61FB3FA8F}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base22612\sc2.exe |
"{240F426E-7A26-4D21-B276-23223A45069A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\napoleon total war\napoleon.exe |
"{25CF1198-4430-419E-94D1-4B196DE54662}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\shogun2.exe |
"{280CCA8D-96B1-48ED-90EA-7DD10A50063D}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2updater.exe |
"{28F1953F-4E30-4C5E-8B67-8D141F7AC39C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_current_settings.bat |
"{2C04552C-FF90-4441-9835-5AF64711D786}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{3D4A1D90-C7B8-44E8-BCD6-D7E8A9FC0C24}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{3F6BFCFD-6245-45A2-ABCA-22D486912360}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\data\encyclopedia\how_to_play.html |
"{40A76BF7-411E-4CA5-AF90-B984BC68B205}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{47EB6859-7DB1-4280-A9B4-B92DF66B02B3}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\fifa 12\game\fifa.exe |
"{49550203-5B59-4A76-835B-F91B8D1A62D5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4D673770-45C6-4A88-9C97-A4CE123FC006}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\data\encyclopedia\how_to_play.html |
"{51F524EC-406C-49DD-BA98-45265605DC32}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe |
"{54719788-A570-49D7-9643-F0BE1E378604}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5E5A07EE-0B05-4C3B-A44F-DA074BF77821}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\data\encyclopedia\how_to_play.html |
"{5E98A2EE-3B44-4571-B33A-79D07F5C571E}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{5FEC004C-98F5-4ED2-BD37-58242FF3EE63}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{61226138-17D6-4312-BA5C-5E00B371C4D5}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{63B5DD9F-E898-4EFA-806B-6355925017C9}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{68907106-6C25-4790-BF98-8C00144853E6}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{6AA50CED-8FFD-40FA-9F5E-3EDDFD92BC39}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{6FE495D6-3128-434F-AD8E-2D3361EF4514}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_specify_properties.bat |
"{70D272EB-04EB-46C5-9295-57C67822CF24}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{72CA59CC-0AC8-432A-844E-9FC2A417AD80}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_specify_properties.bat |
"{76375BFC-1087-46CB-8DA1-6151A37F8839}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{7796B306-976A-4087-99B5-6A745D9D8F32}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_current_settings.bat |
"{77FB8AC6-922B-4AEC-BBC8-0A73C0AB8A45}" = protocol=17 | dir=in | app=c:\program files (x86)\wb games\batman arkham city\binaries\win32\batmanac.exe |
"{7809E1A9-6E5E-4817-B8DD-27A05B2DBEEB}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{7D93D4F7-7F7C-461C-AA24-297FF3944CAA}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe |
"{892CA4F4-B542-4E42-A28D-383881485498}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{8B19D3A7-A7B4-42AD-A71D-E3BB9F6F21A3}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{9259EFD9-8DD3-4D36-A497-2F8C1DE8FDE0}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\shogun2.exe |
"{93D2D7CE-8EA7-4FEB-9E9F-0ADB75A5BDA8}" = protocol=17 | dir=in | app=c:\program files (x86)\2k sports\nba 2k11\nba2k11.exe |
"{95394A2A-86A4-4514-BC1E-EB62C8983598}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{96CDC591-666B-4D4B-BCA9-6EC5ADE89BDD}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{9BD0BE16-372A-47F3-A3BD-C0CEF017431F}" = protocol=6 | dir=in | app=c:\program files (x86)\konami\pro evolution soccer 2011\pes2011.exe |
"{9D6B21C7-2BCC-43FB-B27A-8BA6F77AC3AF}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{A0004921-0F9B-49F4-8908-F4BDEA5DC3E6}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{A0B4E33A-F197-492D-B758-D135210DA405}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{A1B460AA-DA78-47FA-A93B-E0E2FC06A8C7}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{A7250315-C643-4474-A272-6851C823DB41}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{AE3A1B39-2C29-4FC7-AB6C-5A80741AB132}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\napoleon total war\napoleon.exe |
"{AF44CA81-8DF3-4F83-B3BE-202A7529EC6A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_specify_properties.bat |
"{B54938D3-8A35-49D6-A687-F40DB3A70266}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base22612\sc2.exe |
"{B793CBEF-561D-4E58-BAFF-4520A75E6AC1}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{B97DF3A5-DAC3-490F-B738-4B3DAD856F1F}" = protocol=6 | dir=out | app=system |
"{B9FDC95B-47DA-4DEC-99E4-15CE548F779D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C0F1CC08-1EC2-4555-9CDE-EF9C042B16D6}" = protocol=6 | dir=in | app=c:\program files (x86)\wb games\batman arkham city\binaries\win32\batmanac.exe |
"{C1DFDC87-1F30-4D89-804A-16AEC3A3439A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{C45B6B00-E5E0-40EB-AB4E-B27B5CEE21DE}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C62015C6-92BF-489A-9F72-A13A6270065C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C88DDDF2-6235-4416-BE8E-096B00617126}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_current_settings.bat |
"{CB7BA48A-B23C-4D35-B691-AB0DEC832464}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{D3FD3A39-1A51-4890-B736-3DED9BF1BAB9}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D76E48C0-D5B1-473B-B1EA-53E9C7D7DF9D}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe |
"{D8DEC07A-F51D-4E2B-A329-EC2D50A44DDA}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{DAC87708-4BC3-4966-95E3-632ABD4166E7}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{DB75167F-D24A-423C-9C5E-FB0C4702672B}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe |
"{DDC3EE3F-D16E-426E-944F-6E8B9119D82D}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe |
"{DEFEA361-9465-420C-A76C-34C5450A7A1A}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe |
"{DF68D172-1C11-4E19-A133-064A2CAAA54C}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_current_settings.bat |
"{E5C1891A-DA26-467E-896C-8292A990A983}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{E8C527CB-1524-417A-B6A4-F5F787D07FD1}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2updater.exe |
"{ED8DDB5E-A64A-4CFA-8CDB-3DD4841A25B9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F29EF537-67B1-4369-81C5-F2AC9335339C}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F3D64971-F938-4543-ABE1-175568E29E42}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{F58B206F-F9ED-4B20-AC0B-4E408B9071C4}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{FD7C8BAB-7417-4F17-9305-DB1BC54D2F86}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{FF8FB7CD-828D-4D28-9C50-09B985262EDF}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"TCP Query User{0D312753-156B-44A8-BDD6-A114466DD723}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe |
"TCP Query User{1889A184-DAB1-43E4-9B1B-F10CB26F6B8B}C:\program files (x86)\dotalicious gaming client\client.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dotalicious gaming client\client.exe |
"TCP Query User{1E5297C6-A491-45E4-903E-AFEEFD9F1F67}C:\program files (x86)\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe |
"TCP Query User{2308E3D8-9FA8-4979-B2C4-A74BBB216685}C:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe |
"TCP Query User{2BD03EFB-8D80-43E7-B9F4-73070DC6DDE3}C:\programdata\battle.net\agent\agent.976\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"TCP Query User{30E2D71D-4FE5-4461-ADE2-5C153A40CA91}C:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe |
"TCP Query User{5AFDCF1D-A8F5-4DB7-AA71-9246F38F18D8}C:\program files (x86)\origin games\fifa 12\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\fifa 12\game\fifa.exe |
"TCP Query User{81FBECA5-63E8-427D-A42B-E9D1A2BCE158}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"TCP Query User{8FB11933-E4AE-4645-ADC8-465C5121BC5C}C:\program files (x86)\steam\steam.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"TCP Query User{C4D621F2-1062-4CD4-B515-91F5F008B98C}C:\users\mertkumak\desktop\left 4 dead 2\left4dead2.exe" = protocol=6 | dir=in | app=c:\users\mertkumak\desktop\left 4 dead 2\left4dead2.exe |
"TCP Query User{CF85A8FB-CABC-45B4-90DC-B21775054BBD}C:\users\mertkumak\appdata\roaming\ysbo\wadoi.exe" = protocol=6 | dir=in | app=c:\users\mertkumak\appdata\roaming\ysbo\wadoi.exe |
"TCP Query User{D4894945-BE0D-4CA4-8686-27FA0C2D3709}C:\program files (x86)\wb games\batman arkham city\binaries\win32\batmanac.exe" = protocol=6 | dir=in | app=c:\program files (x86)\wb games\batman arkham city\binaries\win32\batmanac.exe |
"TCP Query User{E4D43486-07BC-48A5-A122-E6D7113C5AFF}C:\program files (x86)\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"TCP Query User{F2C5C583-B33B-4BF2-A753-B08C99E7FC40}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"TCP Query User{F416FEBB-1C47-48D0-AFFB-2F9940650A14}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe |
"UDP Query User{0033E6BA-9E26-4220-814F-CF2D9A6FF873}C:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe |
"UDP Query User{0CE715E3-ADC3-496A-A245-60894D9D62CE}C:\program files (x86)\steam\steam.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"UDP Query User{18D53BF4-AE96-4EF1-922F-08973C948940}C:\program files (x86)\origin games\fifa 12\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\fifa 12\game\fifa.exe |
"UDP Query User{25F2B1EE-2C69-4DDB-8A36-F9303A2F30E7}C:\program files (x86)\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe |
"UDP Query User{3D5F5864-98D9-49B1-9EAA-AE18F645C224}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"UDP Query User{5A12D1B9-569C-4FEA-88A1-65DEA00BC730}C:\program files (x86)\dotalicious gaming client\client.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dotalicious gaming client\client.exe |
"UDP Query User{6C278824-2CED-4183-8219-9361B345DE7A}C:\program files (x86)\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"UDP Query User{7CA7BFBD-C349-4D2E-981F-2CE36BF90FD9}C:\users\mertkumak\appdata\roaming\ysbo\wadoi.exe" = protocol=17 | dir=in | app=c:\users\mertkumak\appdata\roaming\ysbo\wadoi.exe |
"UDP Query User{829D0B8F-4C5A-4DD4-AB26-8BA84BF5E146}C:\users\mertkumak\desktop\left 4 dead 2\left4dead2.exe" = protocol=17 | dir=in | app=c:\users\mertkumak\desktop\left 4 dead 2\left4dead2.exe |
"UDP Query User{990FC89F-04E5-4B7E-9D27-B458921621B3}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe |
"UDP Query User{AC6555EC-11E5-4FC5-86E9-03A6AF5856E8}C:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe |
"UDP Query User{B364B19D-4F14-4D92-8E55-59F81FC4D849}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe |
"UDP Query User{BB4B6971-E6AB-4A8E-88D4-CB337464D211}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"UDP Query User{BCBBED34-93BA-4CAC-AF06-B409EAAFF697}C:\program files (x86)\wb games\batman arkham city\binaries\win32\batmanac.exe" = protocol=17 | dir=in | app=c:\program files (x86)\wb games\batman arkham city\binaries\win32\batmanac.exe |
"UDP Query User{E2667756-AF7B-4C8C-9C49-E46DD76CBA65}C:\programdata\battle.net\agent\agent.976\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{26A24AE4-039D-4CA4-87B4-2F86416021FF}" = Java(TM) 6 Update 21 (64-bit)
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{AE1E0DFB-A3D9-451C-AA7F-46FD390400D4}" = Command Center
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Display Control Panel
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR 4.11 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{010A785B-F920-4350-821B-6309909C20BB}" = THX TruStudio PC
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = AlienRespawn
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{2f9f9d00-e6be-4262-b051-62362acc00f5}" = Nero 9 Essentials
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57520FA0-AC56-469B-9983-FF1000008300}" = Batman: Arkham City™
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{81DD0597-29EB-4FA0-8223-4F41362B2E72}" = NBA 2K11
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.SingleImage_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = AlienRespawn - Support Software
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1.2 - Deutsch
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{C3E9887A-23BA-4777-8080-191A5AFCAB74}" = Mumble 1.2.3
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{EA8ADAA9-6671-4839-A51E-0C6792B78F3E}" = FIFA 12
"{EB1B8449-CD8F-485B-ADB6-02FBCFE180D3}" = Razer DeathAdder(TM) Mouse
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F9766AC1-1461-1033-B862-DF8FE1C033BE}" = Adobe InDesign CS5
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Diablo III" = Diablo III
"GFWL_{57520FA0-AC56-469B-9983-FF1000008300}" = Batman: Arkham City™
"InstallShield_{AE1E0DFB-A3D9-451C-AA7F-46FD390400D4}" = Command Center
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"StarCraft II" = StarCraft II
"Steam App 34030" = Napoleon: Total War
"Steam App 34330" = Total War: SHOGUN 2
"Steam App 570" = Dota 2
"VLC media player" = VLC media player 2.0.1
"Warcraft III" = Warcraft III
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2074212562-3771722251-1247847116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
"Warcraft III" = Warcraft III: All Products
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 24.10.2012 17:17:35 | Computer Name = MertKumak-PC | Source = Application Hang | ID = 1002
Description = Programm dota.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt
werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1044 Startzeit:
01cdb2125b720cbe Endzeit: 0 Anwendungspfad: C:\Program Files (x86)\Steam\steamapps\common\dota
2 beta\dota.exe Berichts-ID:
Error - 25.10.2012 05:17:39 | Computer Name = MertKumak-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 25.10.2012 05:17:39 | Computer Name = MertKumak-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 25.10.2012 05:17:39 | Computer Name = MertKumak-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error - 25.10.2012 05:43:53 | Computer Name = MertKumak-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: dota.exe, Version: 0.0.0.0, Zeitstempel:
0x50803000 Name des fehlerhaften Moduls: XAudio2_7.dll_unloaded, Version: 0.0.0.0,
Zeitstempel: 0x4c0641e5 Ausnahmecode: 0xc0000005 Fehleroffset: 0x63c2a5e0 ID des fehlerhaften
Prozesses: 0x13b4 Startzeit der fehlerhaften Anwendung: 0x01cdb294ad1bd0fb Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\dota.exe
Pfad
des fehlerhaften Moduls: XAudio2_7.dll Berichtskennung: 7c3407cd-1e88-11e2-97bf-f04da2dbc9c1
Error - 25.10.2012 19:12:57 | Computer Name = MertKumak-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 25.10.2012 19:12:57 | Computer Name = MertKumak-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 25.10.2012 19:12:57 | Computer Name = MertKumak-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error - 26.10.2012 06:36:55 | Computer Name = MertKumak-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 26.10.2012 06:36:55 | Computer Name = MertKumak-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 26.10.2012 06:36:55 | Computer Name = MertKumak-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
[ Dell Events ]
Error - 13.05.2012 06:53:28 | Computer Name = MertKumak-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 13.05.2012 07:13:27 | Computer Name = MertKumak-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 13.05.2012 07:13:27 | Computer Name = MertKumak-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 13.07.2012 16:26:37 | Computer Name = MertKumak-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 13.07.2012 16:26:37 | Computer Name = MertKumak-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 23.08.2012 08:30:35 | Computer Name = MertKumak-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 23.08.2012 08:30:35 | Computer Name = MertKumak-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 29.09.2012 11:27:20 | Computer Name = MertKumak-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
[ System Events ]
Error - 20.09.2012 16:08:46 | Computer Name = MertKumak-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 20.09.2012 16:08:54 | Computer Name = MertKumak-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 20.09.2012 16:09:03 | Computer Name = MertKumak-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 20.09.2012 16:09:12 | Computer Name = MertKumak-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 20.09.2012 16:09:20 | Computer Name = MertKumak-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 20.09.2012 16:09:29 | Computer Name = MertKumak-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 20.09.2012 16:09:38 | Computer Name = MertKumak-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 20.09.2012 16:09:46 | Computer Name = MertKumak-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 20.09.2012 16:09:53 | Computer Name = MertKumak-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
Error - 20.09.2012 16:10:02 | Computer Name = MertKumak-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
< End of report >
'????? was nun? |
|
02.11.2012, 17:55
| #4 |
| /// Malware-holic | Hallo ich einen trojaner.. TR/PSW.Zbot.5634 nutzt du den pc für onlinebanking zum einkaufen für sonstige zahlungsabwicklungen, oder ähnlich wichtigem, wie beruflichem?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
02.11.2012, 18:51
| #5 |
| | Hallo ich einen trojaner.. TR/PSW.Zbot.5634 Nein tue ich nicht ich mache kein onlinebanking zum einkaufen also keines davon |
|
| Themen zu Hallo ich einen trojaner.. TR/PSW.Zbot.5634 |
| .dll, antivir, appdata, avira, bluescreen, bytes, computer, desktop, down, free, gen, home, microsoft, modul, namen, programm, prozesse, roaming, service.exe, shut down, software, temp, tr/psw.zbot., trojaner, trojanische pferd, updater.exe, windows |
Linear-Darstellung
