Hi ich habe seit Freitag (23.11) das Problehm das mein Computer sobalt ich das LAN Kabel reinstecke extrem langsam wird.
Ich kann den pc nichtmehr runterfahren und wen ich mal auf Start drücken kann stürtzt entweder der Explorer ab oder beim "Herunterfahren" Bilschirm kirege ich einen Bluscreen.

Ich habe schon mit CCleaner alle arten von Scans gemacht,einen Virenscan mit Avast und Kaspersky gemacht(nein ich habe nicht 2 Virenprogramme ich hab avast gelöscht und dan die Kapsersky Testversion runtergeladen) und den Grafiktreiber neu Instaliert.

Hi,


Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
• Kopiere nun den Inhalt aus der Codebox in die Textbox.

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
%windir%\installer\*. /5
%localappdata%\*. /5
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

• Starte die aswMBR.exe - (aswMBR.exe Anleitung)
  Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
• Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
  Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
• Klicke auf Scan.
• Warte bitte bis Scan finished successfully im DOS Fenster steht.
• Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

""Hier die OTL.txt""OTL Logfile:

OTL logfile created on: 27.11.2012 16:47:12 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Ace\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,51 Gb Available Physical Memory | 75,74% Memory free
4,00 Gb Paging File | 3,53 Gb Available in Paging File | 88,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,76 Gb Total Space | 244,99 Gb Free Space | 52,60% Space Free | Partition Type: NTFS
 
Computer Name: ACE-PC | User Name: Ace | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.11.27 16:43:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ace\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.11.22 12:07:42 | 000,539,984 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.11.20 07:17:34 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.11.14 21:02:20 | 000,744,856 | ---- | M] (Tunngle.net GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe -- (TunngleService)
SRV - [2012.11.09 14:25:41 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Stopped] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.10.02 23:21:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.09.23 19:43:34 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.08.30 13:37:15 | 000,076,888 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.08.29 11:03:36 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.07.17 14:14:44 | 002,292,480 | ---- | M] (Microsoft Corp.) [Auto | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.07.28 16:35:44 | 000,262,144 | ---- | M] (Arcai.com) [Auto | Stopped] -- C:\Program Files (x86)\netcut\services\aips.exe -- (AIPS)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.10.30 23:51:56 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2012.10.30 23:51:55 | 000,984,144 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2012.10.30 23:51:55 | 000,370,288 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2012.10.30 23:51:55 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2012.10.30 23:51:53 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012.10.15 17:59:28 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.16 13:42:00 | 000,676,968 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.15 17:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.16 23:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 12:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.10.22 01:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fwlanusb.sys -- (FWLANUSB)
DRV:64bit: - [2010.07.01 14:21:50 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2009.09.16 07:02:42 | 000,031,232 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901t.sys -- (tap0901t)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:35:48 | 000,378,368 | ---- | M] (Realtek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTL85n64.sys -- (RTL85n64)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.18 15:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=5b25c704-5774-4e30-896c-39179d703006&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=DE&userid=5b25c704-5774-4e30-896c-39179d703006&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=DE&userid=5b25c704-5774-4e30-896c-39179d703006&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = ED D2 95 8B 2F 6C CD 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=DE&userid=5b25c704-5774-4e30-896c-39179d703006&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=DE&userid=5b25c704-5774-4e30-896c-39179d703006&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKCU\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=DE&userid=5b25c704-5774-4e30-896c-39179d703006&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112542&tt=3112_3&babsrc=SP_ss&mntrId=d251e615000000000000002586d1041f
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.box
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3503.0728: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.11.11 17:28:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.11.24 12:55:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.29 12:57:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.11.08 22:17:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.07.28 12:45:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ace\AppData\Roaming\mozilla\Extensions
[2012.11.23 20:02:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ace\AppData\Roaming\mozilla\Firefox\Profiles\6i8esjaz.default\extensions
[2012.09.14 21:48:12 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Ace\AppData\Roaming\mozilla\Firefox\Profiles\6i8esjaz.default\extensions\ich@maltegoetz.de
[2012.11.22 20:56:44 | 000,530,519 | ---- | M] () (No name found) -- C:\Users\Ace\AppData\Roaming\mozilla\firefox\profiles\6i8esjaz.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.11.23 20:02:24 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Ace\AppData\Roaming\mozilla\firefox\profiles\6i8esjaz.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.10.28 22:15:55 | 000,002,529 | ---- | M] () -- C:\Users\Ace\AppData\Roaming\mozilla\firefox\profiles\6i8esjaz.default\searchplugins\aol-search.xml
[2012.11.24 12:55:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.11.20 07:17:52 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.07.31 13:38:55 | 000,002,349 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012.11.20 07:17:14 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.11.20 07:17:14 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Search the web (Babylon) (Enabled)
CHR - default_search_provider: search_url = hxxp://search.babylon.com/?q={searchTerms}&affID=112542&tt=3112_3&babsrc=SP_ss&mntrId=d251e615000000000000002586d1041f
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://search.babylon.com/?affID=112542&tt=3112_3&babsrc=HP_ss&mntrId=d251e615000000000000002586d1041f
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.83\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.83\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.83\gcswf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll
CHR - Extension: PriceGong = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.7_0\
CHR - Extension: YouTube = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: avast! WebRep = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\
CHR - Extension: SweetIM for Facebook = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of 
CHR - Extension: SweetIM for Facebook = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\
CHR - Extension: Google Mail = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: PriceGong = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.7_0\
CHR - Extension: YouTube = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: avast! WebRep = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\
CHR - Extension: SweetIM for Facebook = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of 
CHR - Extension: SweetIM for Facebook = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\
CHR - Extension: Google Mail = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKCU..\Run: [RocketDock] C:\Program Files (x86)\RocketDock\RocketDock.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B05CADB-D79A-43A1-9EC2-4548264F418B}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D57496B0-A6EC-405C-A32C-C895FE7841D2}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DBBBAC26-AAFA-4800-8CD4-712150E5CC9F}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E5FE76B5-2921-4741-A7D7-D9D1677A18CF}: DhcpNameServer = 7.254.254.254
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{637a9aa9-d822-11e1-9f42-4061862c989a}\Shell - "" = AutoRun
O33 - MountPoints2\{637a9aa9-d822-11e1-9f42-4061862c989a}\Shell\AutoRun\command - "" = J:\setup.exe
O33 - MountPoints2\{a466b8f4-203f-11e2-b09a-4061862c989a}\Shell - "" = AutoRun
O33 - MountPoints2\{a466b8f4-203f-11e2-b09a-4061862c989a}\Shell\AutoRun\command - "" = I:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: AVMWlanClient - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: CL2 Launcher - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Clownfish - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - StartUpReg: VirtualCloneDrive - hkey= - key= - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1084
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.27 16:43:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Ace\Desktop\OTL.exe
[2012.11.27 16:27:22 | 000,480,632 | ---- | C] (AVM Berlin) -- C:\Windows\instwcli.dex
[2012.11.24 23:01:06 | 000,676,968 | ---- | C] (Realtek                                            ) -- C:\Windows\SysNative\drivers\Rt64win7.sys
[2012.11.24 23:01:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2012.11.24 20:21:03 | 000,000,000 | -HSD | C] -- C:\found.001
[2012.11.24 14:36:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD
[2012.11.24 13:22:56 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2012.11.24 12:55:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.11.23 19:19:52 | 000,000,000 | -HSD | C] -- C:\found.000
[2012.11.23 17:08:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2012.11.16 23:20:41 | 000,000,000 | ---D | C] -- C:\Users\Ace\AppData\Roaming\.minecraft
[2012.11.13 13:30:17 | 000,000,000 | ---D | C] -- C:\Users\Ace\AppData\Local\Diagnostics
[2012.11.10 22:46:16 | 000,000,000 | ---D | C] -- C:\Users\Ace\Documents\Telltale Games
[2012.10.30 18:38:15 | 000,000,000 | ---D | C] -- C:\Users\Ace\Documents\ArmA 2 Other Profiles
[2012.10.30 18:37:58 | 000,000,000 | ---D | C] -- C:\Users\Ace\Documents\ArmA 2
[2012.10.28 22:14:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine
[2012.10.28 22:14:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.27 16:43:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ace\Desktop\OTL.exe
[2012.11.27 16:37:30 | 000,276,552 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.11.27 16:37:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.27 16:37:12 | 1609,965,568 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.27 16:31:08 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.27 16:31:08 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.27 16:25:10 | 000,003,304 | ---- | M] () -- C:\bootsqm.dat
[2012.11.24 16:55:08 | 000,013,422 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121124_165500.reg
[2012.11.24 14:34:34 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.24 12:56:03 | 000,003,578 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121124_125601.reg
[2012.11.24 12:44:43 | 000,003,734 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121124_124440.reg
[2012.11.24 12:36:51 | 000,000,410 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121124_123647.reg
[2012.11.23 19:46:11 | 000,001,076 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121123_194608.reg
[2012.11.23 19:45:57 | 000,014,610 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121123_194546.reg
[2012.11.23 18:58:53 | 000,002,920 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121123_185850.reg
[2012.11.23 18:58:43 | 000,016,568 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121123_185824.reg
[2012.11.23 13:24:33 | 000,241,832 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121123_132418.reg
[2012.11.15 23:54:21 | 001,634,396 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.11.15 23:54:21 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.11.15 23:54:21 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.11.15 23:54:21 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.11.15 23:54:21 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.11.11 17:28:12 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.10.30 23:51:56 | 000,059,728 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2012.10.30 23:51:55 | 000,984,144 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2012.10.30 23:51:55 | 000,370,288 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2012.10.30 23:51:55 | 000,071,600 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012.10.30 23:51:53 | 000,025,232 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012.10.30 23:51:07 | 000,041,224 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.10.30 23:50:59 | 000,227,648 | ---- | M] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2012.10.30 23:50:30 | 000,285,328 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.27 16:37:20 | 000,276,552 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.11.27 16:25:10 | 000,003,304 | ---- | C] () -- C:\bootsqm.dat
[2012.11.24 16:55:05 | 000,013,422 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121124_165500.reg
[2012.11.24 12:56:02 | 000,003,578 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121124_125601.reg
[2012.11.24 12:55:24 | 000,001,123 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.11.24 12:44:41 | 000,003,734 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121124_124440.reg
[2012.11.24 12:36:50 | 000,000,410 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121124_123647.reg
[2012.11.23 19:46:09 | 000,001,076 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121123_194608.reg
[2012.11.23 19:45:52 | 000,014,610 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121123_194546.reg
[2012.11.23 18:58:51 | 000,002,920 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121123_185850.reg
[2012.11.23 18:58:28 | 000,016,568 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121123_185824.reg
[2012.11.23 13:24:22 | 000,241,832 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121123_132418.reg
[2012.11.15 23:52:25 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.15 23:44:25 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.10.25 19:48:45 | 000,582,661 | ---- | C] () -- C:\Users\Ace\AppData\Roaming\technic-launcher.jar
[2012.10.08 14:41:04 | 001,589,618 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.10.03 16:03:46 | 000,081,938 | ---- | C] () -- C:\Users\Ace\AppData\Roaming\.minecraftminecraft.jar
[2012.10.03 16:03:46 | 000,076,948 | ---- | C] () -- C:\Users\Ace\AppData\Roaming\.minecraftminecraft_modified.jar
[2012.09.28 17:13:27 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2012.09.27 22:18:01 | 000,002,769 | ---- | C] () -- C:\Users\Ace\AppData\Local\recently-used.xbel
[2012.09.18 18:25:00 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2012.08.20 02:51:45 | 000,041,182 | ---- | C] () -- C:\Users\Ace\AppData\Roaming\ascii
[2012.08.18 22:54:12 | 000,001,077 | ---- | C] () -- C:\Users\Ace\Dokumente.lnk
[2012.08.01 13:28:50 | 000,215,128 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.08.01 13:28:47 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.11.16 23:20:41 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\.minecraft
[2012.10.25 20:03:38 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\.techniclauncher
[2012.08.27 03:19:04 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Awesomium
[2012.11.23 19:53:45 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\BitTorrent
[2012.08.22 23:52:17 | 000,000,000 | -H-D | M] -- C:\Users\Ace\AppData\Roaming\D251E615
[2012.10.22 03:40:57 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Dwarfs
[2012.10.22 04:18:27 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\DwarfsF2P
[2012.08.16 03:07:42 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Java
[2012.10.25 20:03:11 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\logs
[2012.08.25 15:30:34 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\LolClient
[2012.11.24 12:58:45 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Notepad++
[2012.08.15 19:53:17 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\OpenCandy
[2012.10.15 19:59:32 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Origin
[2012.09.27 20:37:28 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Publish Providers
[2012.08.17 03:06:04 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Screaming Bee
[2012.07.31 01:14:38 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\six-zsync
[2012.09.27 20:43:34 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Sony
[2012.08.05 17:50:20 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Spirited Machine
[2012.09.28 14:35:04 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Thunderbird
[2012.11.19 17:13:57 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\TS3Client
[2012.11.22 22:16:12 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Tunngle
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2012.07.27 20:37:20 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2012.07.31 01:55:25 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.11.02 16:42:17 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2012.07.27 16:42:20 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2012.11.23 19:19:52 | 000,000,000 | -HSD | M] -- C:\found.000
[2012.11.24 20:21:03 | 000,000,000 | -HSD | M] -- C:\found.001
[2012.07.27 22:26:39 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.09.27 21:53:32 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.11.27 16:27:48 | 000,000,000 | ---D | M] -- C:\Program Files (x86)
[2012.11.24 13:22:56 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2012.07.27 16:42:20 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.07.27 20:34:47 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.11.26 19:54:55 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.11.24 13:27:20 | 000,000,000 | R--D | M] -- C:\Users
[2012.11.27 16:37:12 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %windir%\installer\*. /5 >
[2012.11.23 19:37:33 | 000,000,000 | ---D | M] -- C:\Windows\installer\{8E634921-4547-4CA9-AF79-08B735431C12}
[2012.11.24 14:37:01 | 000,000,000 | ---D | M] -- C:\Windows\installer\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}
 
< %localappdata%\*. /5 >
[2012.11.23 19:26:51 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Local\Conduit
[2012.11.23 18:51:25 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Local\LogMeIn Hamachi
[2012.11.23 18:51:18 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Local\Mozilla
[2012.11.27 16:43:12 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Local\Temp
 
<           >
[2009.07.14 06:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2009.07.14 06:08:49 | 000,032,632 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.07.28 12:47:32 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

< End of report >
         

--- --- ---


""Hier die Extras.txt""OTL EXTRAS Logfile:

OTL Extras logfile created on: 27.11.2012 16:47:12 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Ace\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,51 Gb Available Physical Memory | 75,74% Memory free
4,00 Gb Paging File | 3,53 Gb Available in Paging File | 88,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,76 Gb Total Space | 244,99 Gb Free Space | 52,60% Space Free | Partition Type: NTFS
 
Computer Name: ACE-PC | User Name: Ace | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B44518E-D3D4-4240-AF8F-E6776D5BF7BC}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{1E739C27-5588-4E29-AA5D-3DB3BC3E9F25}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2F71E932-BA48-4F3B-9BDC-1C652F0CF731}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{353C9565-0C75-4231-93F8-1354CDD8D9D5}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{3A6E48D0-31BA-4ABD-AD46-808E1D95A287}" = lport=445 | protocol=6 | dir=in | app=system | 
"{42FA5220-4619-4089-8B31-42E5A7801F74}" = rport=138 | protocol=17 | dir=out | app=system | 
"{565B1C24-8279-4716-9ED8-D72FD3D0F31B}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{6FBF540D-E509-46F8-A490-6E1DF97BA859}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{78D94656-D7FC-471D-95C3-C2853EF9461A}" = lport=139 | protocol=6 | dir=in | app=system | 
"{7943E46A-76DB-44E0-A4EC-000D8167FCAF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{7BDB03C9-3336-4694-884C-BEC9B346BAF4}" = rport=137 | protocol=17 | dir=out | app=system | 
"{7EDBB860-4030-44DB-891E-7551E720257A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8550C0C9-6947-4758-B802-95CD7D3D6DAF}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{B0EB4C6F-6B0B-4465-9AD2-1A12367428A9}" = rport=139 | protocol=6 | dir=out | app=system | 
"{B9C2C09A-B548-4C90-8CF5-697C623576CE}" = lport=137 | protocol=17 | dir=in | app=system | 
"{C937E2EC-A123-4122-B465-B2C1947C850B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{CA80D380-CB9E-4EF9-A0FB-E8ACCB9DEA89}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{CCD8CC94-3BB3-4A9D-9D18-FFF0177D4139}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D60E4DFE-75F9-458F-9E2E-918A0B4E0A29}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{D9F673D2-8773-4347-A052-DC6C2A51301C}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{ED3995D1-5D1B-46E6-AA98-3ADF698B9694}" = lport=138 | protocol=17 | dir=in | app=system | 
"{F71E5A5C-0052-4989-9DC7-C29AF6488612}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{FE6F7DC6-94CD-4965-8A4B-69E99F4FE25E}" = rport=445 | protocol=6 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{008178CE-77C6-4E30-8E7D-A2D692BC25F9}" = protocol=58 | dir=in | app=system | 
"{036B6425-8F55-4DD3-B5FB-F8FF921831E4}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{086E27B8-4AC6-434E-A94A-A174DBFD83C5}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{091163D2-7097-4EF7-91AA-A865363E668D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{094AA460-5FD6-4ACE-B8F2-C935A39C4120}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{0B540FDC-343C-4DFA-9195-C57C5AFD0BDD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{0D9906BF-FCC3-4F17-A0DA-2D4D625ED064}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{12452790-C9BF-41D4-B2BC-36445E9E6D76}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{15F6D9FD-D924-4900-AF4D-EAA4AE8FD4D8}" = protocol=17 | dir=in | app=c:\program files (x86)\tunngle\tnglctrl.exe | 
"{168955FB-78AF-44FB-A0AB-491B0F40CE53}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{26DCEEEB-DFAB-4D2E-83CC-A415CDA93048}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{2CD44F9E-9932-48C1-8346-4AC01D2C495D}" = protocol=17 | dir=in | app=c:\program files (x86)\tunngle\tnglctrl.exe | 
"{2D1D3DFB-C8FA-492A-8CBD-29CD127EB530}" = protocol=6 | dir=in | app=c:\program files (x86)\tunngle\tnglctrl.exe | 
"{34AD275E-16D7-4E73-993F-67FBAB2D3775}" = protocol=6 | dir=in | app=c:\program files (x86)\tunngle\tunngle.exe | 
"{36D3FCAD-DCBF-483B-82C4-D5E7E9C423F5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{37B581BC-B8A1-4120-9420-421D90F0B2D4}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{396DEC98-60DD-4294-B65E-2D3B62969E68}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{401F6C6C-5B7F-4DE0-B52E-2BC6C9493BEF}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\killingfloor\system\killingfloor.exe | 
"{4045F504-7D1C-4A46-B31C-DEAC065B3B33}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{432185B1-288D-4D88-9312-EA1858D465A7}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | 
"{4368805F-A207-4C11-A06E-0677A34E63A4}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe | 
"{44A8E817-BED4-4ABD-9960-6CAFAA5D3DA7}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\killingfloor\system\killingfloor.exe | 
"{46073D57-21EC-4BF6-9FC0-5E52483EC737}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\battlefield bad company 2\support\ea help\electronic_arts_technical_support.htm | 
"{4A4E03DE-53C9-4BF9-BBCF-DB0C620EB580}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{4C774D60-36A7-4FA0-9073-DAB248A0EDB5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{507ECE4D-38A1-4610-89C9-2DFB13A895F9}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{5081863E-D9A6-42CA-B064-465C420388A3}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\poker night at the inventory\celebritypoker.exe | 
"{5FB6A481-EABE-40E7-AE03-C3C123EA8863}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the binding of isaac\isaac.exe | 
"{66A9F450-D270-4F9C-956F-E7FD0FD18A5C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\payday the heist\payday_win32_release.exe | 
"{67031B80-D954-4C68-AE54-C2EF58937185}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{678EF3EF-8E97-4956-B4DF-018D56073387}" = protocol=17 | dir=in | app=c:\windows\syswow64\msiexec.exe | 
"{6811B18F-A0F6-4CA3-8544-0CE8D064F6ED}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe | 
"{69616121-7856-45E3-8961-7E83D423A354}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the binding of isaac\isaac.exe | 
"{735B1F7A-284D-497A-9291-7FD3FC0B634A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{7C8F0763-FA19-4A8D-A769-8C6FEFDD5B85}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{81B48EE3-3A13-4F1A-8939-CC4508CB9C57}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{83FEE66A-CB43-4D6C-9515-94708959C1E9}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{848FCA77-4F64-453D-B744-44DFB3341C91}" = protocol=6 | dir=in | app=c:\program files (x86)\tunngle\tnglctrl.exe | 
"{8B257E13-119E-49E3-BED4-C744055C894B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{8C6F46E3-E4FD-4BB9-A8A6-72595A9C9076}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\payday the heist\payday_win32_release.exe | 
"{8C9D38F5-CA23-40DC-AFE8-269C554927C2}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe | 
"{8D1C3BF5-C60B-4D52-9D55-143C8E82A64F}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{92546F29-9A2E-4998-ABBA-EFF0B0D1FC04}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\battlefield bad company 2\support\ea help\electronic_arts_technical_support.htm | 
"{93BC4E29-DAAA-4C99-AE64-8DEDC96E4488}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\fullpowerjulien\garrysmod\hl2.exe | 
"{9B647803-42B0-496C-99C8-7022786D29CF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{9C342E19-533A-4918-B735-44960D81F9CA}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\fullpowerjulien\garrysmod\hl2.exe | 
"{A6EA265A-AAC5-4665-A545-95329E02C211}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{AB44DB01-2F1B-42EC-ADA3-C3E1DBC600AC}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{AD9D5572-4701-4250-A8D9-DC1F64B3F7F3}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{AF176CA6-FD73-4166-BF5D-99CEFFB1BCAD}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\terraria\terraria.exe | 
"{AF6B0E9B-27E7-413F-AB2F-D9B9080EA631}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{B11FDFDA-A6F4-4BFA-BE7E-B68DA06BA474}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\fullpowerjulien\counter-strike source\hl2.exe | 
"{B426B7FA-5EB5-462F-8555-7ACF47F15442}" = protocol=6 | dir=out | app=system | 
"{B4C7CC56-9F17-4F1C-A38E-E87206482AFE}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\fullpowerjulien\counter-strike source\hl2.exe | 
"{B5FF6E84-1EEA-4A2B-9F00-ED1F26D863E4}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{BD7F933B-8CFD-42ED-8E03-469772252F16}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{C2375DFF-AAAA-49F3-8BF6-FFB5B67AE861}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\terraria\terraria.exe | 
"{C7405DF1-B6C7-4A44-AD5A-35957C22D902}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe | 
"{C89A421D-7FA3-47F3-8BE9-CF702E8EF5F5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{CAE5EE57-0E1E-4E75-BBFD-312207C71810}" = protocol=17 | dir=in | app=c:\program files (x86)\tunngle\tunngle.exe | 
"{CAEEE8BD-730A-4984-8B87-191DC93C4EAC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{D0FE449D-7D4A-425A-8D0D-310A9BC3DE4C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{D1C87F82-0C41-4D3D-B576-2D52331C46A9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DCFC3882-3F62-4BC3-BC37-1AB11C289437}" = protocol=6 | dir=in | app=c:\windows\syswow64\msiexec.exe | 
"{DEDEF87C-774D-4C4B-94B7-B651062CB4A5}" = protocol=6 | dir=in | app=c:\program files (x86)\tunngle\tunngle.exe | 
"{DFE5A4E6-ADD2-47EF-AF40-E0B9971927D9}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\poker night at the inventory\celebritypoker.exe | 
"{E5BEC783-4EB8-4145-BC9C-A76638E7B15A}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{E9296EC4-491D-4FEA-A3F9-E9C97609FD58}" = dir=in | app=c:\users\ace\brickforce\brickforce.exe | 
"{F07FA99C-8774-411B-AD90-D9CC26388DEF}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{F54A7227-E5AD-4F27-8E80-7DC15BA46A73}" = protocol=17 | dir=in | app=c:\program files (x86)\tunngle\tunngle.exe | 
"{F9FB839F-6AAF-4F3A-8EE4-794BB69965BF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{FEC3F9A9-A3C0-4F1C-8B0C-6851DE2E0DA2}" = dir=in | app=c:\users\ace\brickforce\bflauncher.exe | 
"{FFDEB553-7AF5-4BA6-8959-E251E5EB4059}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"TCP Query User{0213A65F-712C-431C-A3A4-A82842EC25CF}C:\program files (x86)\steam\steamapps\fullpowerjulien\garrysmod\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\fullpowerjulien\garrysmod\hl2.exe | 
"TCP Query User{427FD518-40F8-47F2-96A6-B55FD5503C5D}C:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"TCP Query User{4ACE7DC1-9070-4FCF-87D9-78A2BF221DF8}C:\program files (x86)\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
"TCP Query User{81A1DE7A-FC86-459D-83BA-05BBDB19E41A}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"TCP Query User{90BFDE9C-DAFD-4FB4-A58F-5D655B65BD4C}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe | 
"TCP Query User{97A086FB-1D08-40D9-9A0F-EC8EAD8B363C}C:\program files (x86)\steam\steamapps\fullpowerjulien\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\fullpowerjulien\team fortress 2\hl2.exe | 
"TCP Query User{9A972E7F-59AA-4F99-B3AF-612244928DC1}C:\program files\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\java.exe | 
"TCP Query User{9B652728-5657-4072-BBD7-37DFD926D786}C:\program files (x86)\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe" = protocol=6 | dir=in | app=c:\program files (x86)\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe | 
"TCP Query User{E33B5147-9DBB-4D05-A1F9-BC602FCE8A33}C:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe | 
"TCP Query User{E4B15691-BF90-4F5F-BEA5-EC88212625F9}C:\program files (x86)\jdownloader 2\jdownloader 2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\jdownloader 2\jdownloader 2.exe | 
"TCP Query User{FAE3D10F-27F9-45FE-A55E-A3F36C22C088}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{06E03E46-4062-4378-BF46-E3E6A9DF5E1E}C:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"UDP Query User{1CF30AF0-8037-44AD-8D3E-12EC327803BE}C:\program files (x86)\jdownloader 2\jdownloader 2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\jdownloader 2\jdownloader 2.exe | 
"UDP Query User{45A86BA8-6401-4AAF-9722-2093162CDD39}C:\program files\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\java.exe | 
"UDP Query User{72C4A4D6-6141-4474-B9C1-1E1C6E279BF8}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe | 
"UDP Query User{95D476A9-63CD-405A-968F-F4E8FE818E11}C:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe | 
"UDP Query User{A61F8EE3-DEB5-4CE7-8528-3C0E2C53703D}C:\program files (x86)\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
"UDP Query User{AA1A2EDD-9B78-440B-BCD7-049EE618FCCD}C:\program files (x86)\steam\steamapps\fullpowerjulien\garrysmod\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\fullpowerjulien\garrysmod\hl2.exe | 
"UDP Query User{C4B6B178-30F0-4D26-B7E0-B52DE4C22D73}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{CC1D5622-6D86-4243-867F-196DB53A8566}C:\program files (x86)\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe" = protocol=17 | dir=in | app=c:\program files (x86)\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe | 
"UDP Query User{E432C8E2-E380-465C-B25D-77C0A5521A21}C:\program files (x86)\steam\steamapps\fullpowerjulien\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\fullpowerjulien\team fortress 2\hl2.exe | 
"UDP Query User{ED131B3A-0A08-4A9F-B17F-748D34553F20}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1730D13B-7517-4321-A88B-64627CF67CDC}_is1" = Logon Screen
"{26A24AE4-039D-4CA4-87B4-2F86417006FF}" = Java 7 Update 6 (64-bit)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A7C8BBDE-FE98-11E1-87C9-F04DA23A5C58}" = Vegas Pro 12.0 (64-bit)
"{AB085680-FE98-11E1-A232-F04DA23A5C58}" = MSVCRT Redists
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F842F8B0-6942-4930-821F-543E976B2C66}" = MSVCRT110_amd64
"CCleaner" = CCleaner
"GIMP-2_is1" = GIMP 2.8.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"VLC media player" = VLC media player 2.0.2
"WinRAR archiver" = WinRAR 4.20 (64-bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{1057511B-F8FE-4230-9ED3-AB949A57EE4A}" = Windows Live PIMT Platform
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5
"{29315CEC-E6CE-4394-84DC-6F862E8D9A52}" = Windows Live UX Platform
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2FAFE37E-D796-47B8-BA8F-D09819B12DF6}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F9A382F-4478-4036-905C-F77DF2EA0370}" = Windows Live SOXE
"{4FA8F084-C42F-45E1-B7E5-E0C8A1083DC5}" = Windows Live SOXE Definitions
"{553C904F-57A2-4113-888E-BA0C3D1C69C0}" = Microsoft VC9 runtime libraries
"{5C2B3F57-A149-4BFC-92DB-5AF59A707750}" = MorphVOX Pro
"{618F39BD-9720-47CF-A89C-108AB41B1493}" = Windows Live UX Platform Language Pack
"{64467D47-FFE4-4FBC-ABBA-A0DB829A17EB}" = NVIDIA PhysX
"{64DF7404-9D46-44AF-AFA1-A2F8D5648C2D}" = Windows Live Photo Common
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76EE8FE7-1957-4C51-9074-4930A8CFB1AF}" = Windows Live Installer
"{7F682A00-6497-4551-A2A6-063AE667D1CF}" = Movie Maker
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B2E55F8-5BA8-4A45-9682-ACB6F2CC0DA5}" = Photo Gallery
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI - Deutsch
"{B19E03EA-067C-412F-A81E-271720E601AB}" = Fotogalerie
"{B27FA0A3-D80F-41A9-8BAD-C5F2D859AB22}" = Photo Common
"{B8ABD8C7-991E-4A70-B5A3-20C6FC680680}" = LogMeIn Hamachi
"{BA73469B-D8C7-4FE3-B33C-1340D09F0709}" = Windows Live Communications Platform
"{D71BC54E-A4E6-4E06-866C-FD6EE16EA187}" = Movie Maker
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"0630-0716-3135-7887" = JDownloader 2
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"avast" = avast! Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"Borderlands-u-GOTY_is1" = Borderlands
"BrickForce" = BrickForce 1.9.87
"CrystalDiskInfo_is1" = CrystalDiskInfo 5.0.1
"LogMeIn Hamachi" = LogMeIn Hamachi
"LogonStudio" = LogonStudio
"Mozilla Firefox 17.0 (x86 en-US)" = Mozilla Firefox 17.0 (x86 en-US)
"Mozilla Thunderbird 16.0.2 (x86 de)" = Mozilla Thunderbird 16.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Notepad++" = Notepad++
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"RocketDock_is1" = RocketDock 1.3.5
"Steam App 105600" = Terraria
"Steam App 113200" = The Binding of Isaac
"Steam App 1250" = Killing Floor
"Steam App 218" = Source SDK Base 2007
"Steam App 218230" = PlanetSide 2
"Steam App 240" = Counter-Strike: Source
"Steam App 24240" = PAYDAY: The Heist
"Steam App 24960" = Battlefield: Bad Company 2
"Steam App 31280" = Poker Night at the Inventory
"Steam App 320" = Half-Life 2: Deathmatch
"Steam App 4000" = Garry's Mod
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Steam App 440" = Team Fortress 2
"Steam App 49520" = Borderlands 2
"Steam App 570" = Dota 2
"Tunngle beta_is1" = Tunngle beta
"VirtualCloneDrive" = VirtualCloneDrive
"WinLiveSuite" = Windows Live Essentials
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 24.11.2012 18:01:03 | Computer Name = Ace-PC | Source = System Restore | ID = 8193
Description = 
 
Error - 24.11.2012 18:05:47 | Computer Name = Ace-PC | Source = Windows Search Service | ID = 9000
Description = 
 
Error - 24.11.2012 18:05:48 | Computer Name = Ace-PC | Source = Windows Search Service | ID = 7040
Description = 
 
Error - 24.11.2012 18:05:48 | Computer Name = Ace-PC | Source = Windows Search Service | ID = 9002
Description = 
 
Error - 24.11.2012 18:05:48 | Computer Name = Ace-PC | Source = Windows Search Service | ID = 3029
Description = 
 
Error - 24.11.2012 18:05:48 | Computer Name = Ace-PC | Source = Windows Search Service | ID = 3029
Description = 
 
Error - 24.11.2012 18:05:48 | Computer Name = Ace-PC | Source = Windows Search Service | ID = 3028
Description = 
 
Error - 24.11.2012 18:05:48 | Computer Name = Ace-PC | Source = Windows Search Service | ID = 3058
Description = 
 
Error - 24.11.2012 18:05:48 | Computer Name = Ace-PC | Source = Windows Search Service | ID = 7010
Description = 
 
Error - 24.11.2012 18:05:48 | Computer Name = Ace-PC | Source = Windows Search Service | ID = 7042
Description = 
 
[ System Events ]
Error - 24.11.2012 18:17:41 | Computer Name = Ace-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 24.11.2012 18:17:43 | Computer Name = Ace-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 24.11.2012 18:17:45 | Computer Name = Ace-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 24.11.2012 18:17:47 | Computer Name = Ace-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 24.11.2012 18:17:49 | Computer Name = Ace-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 24.11.2012 18:17:51 | Computer Name = Ace-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 24.11.2012 18:17:53 | Computer Name = Ace-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 25.11.2012 07:44:15 | Computer Name = Ace-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?24.?11.?2012 um 23:21:25 unerwartet heruntergefahren.
 
Error - 25.11.2012 07:49:34 | Computer Name = Ace-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x800b0100 fehlgeschlagen: Update für Windows 7 für x64-basierte Systeme
 (KB2505438)
 
Error - 25.11.2012 13:50:07 | Computer Name = Ace-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x800b0100 fehlgeschlagen: Update für Windows 7 für x64-basierte Systeme
 (KB2505438)
 
 
< End of report >
         

--- --- ---

""Und hier die aswMBR.txt. Leider hat mich das programm nicht gefragt ob ich das programm mit der aktuellen VIrendefinition scannen will (liegt dies evt. am abgesichertem Modus?)""


aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-27 17:16:39
-----------------------------
17:16:39.896 OS Version: Windows x64 6.1.7601 Service Pack 1
17:16:39.896 Number of processors: 4 586 0x502
17:16:39.896 ComputerName: ACE-PC UserName: Ace
17:16:40.505 Initialize success
17:16:40.536 AVAST engine defs: 12112200
17:22:52.753 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
17:22:52.753 Disk 0 Vendor: WDC_WD5000AAKS-00V1A0 05.01D05 Size: 476940MB BusType: 3
17:22:52.768 Disk 0 MBR read successfully
17:22:52.768 Disk 0 MBR scan
17:22:52.987 Disk 0 Windows 7 default MBR code
17:22:53.002 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 476938 MB offset 2048
17:22:53.205 Disk 0 scanning C:\Windows\system32\drivers
17:23:03.735 Service scanning
17:23:18.165 Modules scanning
17:23:18.165 Disk 0 trace - called modules:
17:23:18.181 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
17:23:18.181 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80028b0060]
17:23:18.196 3 CLASSPNP.SYS[fffff8800160143f] -> nt!IofCallDriver -> [0xfffffa8002665520]
17:23:18.196 5 ACPI.sys[fffff88000fac7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8002661680]
17:23:18.664 AVAST engine scan C:\Windows
17:23:20.255 AVAST engine scan C:\Windows\system32
17:25:05.103 AVAST engine scan C:\Windows\system32\drivers
17:25:12.825 AVAST engine scan C:\Users\Ace
17:26:20.233 AVAST engine scan C:\ProgramData
17:26:38.282 Scan finished successfully
17:27:25.269 Disk 0 MBR has been saved successfully to "C:\Users\Ace\Desktop\MBR.dat"
17:27:25.269 The log file has been saved successfully to "C:\Users\Ace\Desktop\aswMBR.txt"

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Combofix Logfile:

ComboFix 12-11-27.01 - Ace 27.11.2012  20:29:00.1.4 - x64 NETWORK
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.2047.1251 [GMT 1:00]
ausgeführt von:: c:\users\Ace\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-10-27 bis 2012-11-27  ))))))))))))))))))))))))))))))
.
.
2012-11-27 16:17 . 2012-11-27 16:17	--------	d-----w-	c:\users\Ace\AppData\Local\ElevatedDiagnostics
2012-11-27 15:27 . 2010-10-22 00:00	480632	------w-	c:\windows\instwcli.dex
2012-11-24 22:01 . 2012-02-16 12:42	74344	----a-w-	c:\windows\system32\RtNicProp64.dll
2012-11-24 22:01 . 2012-02-16 12:42	676968	----a-w-	c:\windows\system32\drivers\Rt64win7.sys
2012-11-24 22:01 . 2012-02-16 12:42	107624	----a-w-	c:\windows\system32\RTNUninst64.dll
2012-11-24 22:01 . 2012-11-24 22:10	--------	d-----w-	c:\program files (x86)\Realtek
2012-11-24 19:21 . 2012-11-24 19:21	--------	d-----w-	C:\found.001
2012-11-24 13:36 . 2012-11-24 13:36	--------	d-----w-	c:\program files (x86)\AMD
2012-11-24 12:27 . 2012-11-25 11:46	--------	d-----w-	c:\users\UpdatusUser
2012-11-24 12:26 . 2012-10-02 19:51	3293544	----a-w-	c:\windows\system32\nvsvc64.dll
2012-11-24 12:26 . 2012-10-02 19:50	891240	----a-w-	c:\windows\system32\nvvsvc.exe
2012-11-24 12:26 . 2012-10-02 19:50	63336	----a-w-	c:\windows\system32\nvshext.dll
2012-11-24 12:26 . 2012-10-02 19:50	2557800	----a-w-	c:\windows\system32\nvsvcr.dll
2012-11-24 12:26 . 2012-10-02 19:51	6200680	----a-w-	c:\windows\system32\nvcpl.dll
2012-11-24 12:26 . 2012-10-02 19:50	118120	----a-w-	c:\windows\system32\nvmctray.dll
2012-11-24 12:22 . 2012-11-24 12:22	--------	d-----w-	c:\programdata\NVIDIA Corporation
2012-11-23 23:17 . 2012-10-27 00:07	917984	----a-w-	c:\program files (x86)\Mozilla Firefox\nsyF24C.tmp\firefox.exe
2012-11-23 18:19 . 2012-11-23 18:19	--------	d-----w-	C:\found.000
2012-11-23 16:08 . 2012-11-23 16:08	--------	d-----w-	c:\programdata\Kaspersky Lab
2012-11-20 12:25 . 2012-11-08 17:24	9125352	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{05E897C8-048D-4569-82FB-B06C9330875D}\mpengine.dll
2012-11-16 22:20 . 2012-11-16 22:20	--------	d-----w-	c:\users\Ace\AppData\Roaming\.minecraft
2012-11-15 22:52 . 2012-07-26 07:46	2560	----a-w-	c:\windows\system32\drivers\de-DE\wdf01000.sys.mui
2012-11-15 22:52 . 2012-07-26 04:55	785512	----a-w-	c:\windows\system32\drivers\Wdf01000.sys
2012-11-15 22:52 . 2012-07-26 04:55	54376	----a-w-	c:\windows\system32\drivers\WdfLdr.sys
2012-11-15 22:52 . 2012-07-26 02:36	9728	----a-w-	c:\windows\system32\Wdfres.dll
2012-11-15 22:44 . 2012-07-26 02:26	87040	----a-w-	c:\windows\system32\drivers\WUDFPf.sys
2012-11-15 22:44 . 2012-07-26 02:26	198656	----a-w-	c:\windows\system32\drivers\WUDFRd.sys
2012-11-15 22:44 . 2012-07-26 03:08	84992	----a-w-	c:\windows\system32\WUDFSvc.dll
2012-11-15 22:44 . 2012-07-26 03:08	194048	----a-w-	c:\windows\system32\WUDFPlatform.dll
2012-11-15 22:44 . 2012-07-26 03:08	45056	----a-w-	c:\windows\system32\WUDFCoinstaller.dll
2012-11-15 22:44 . 2012-07-26 03:08	229888	----a-w-	c:\windows\system32\WUDFHost.exe
2012-11-15 22:44 . 2012-07-26 03:08	744448	----a-w-	c:\windows\system32\WUDFx.dll
2012-11-15 21:26 . 2012-10-03 17:44	70656	----a-w-	c:\windows\system32\nlaapi.dll
2012-11-15 21:26 . 2012-10-03 17:44	18944	----a-w-	c:\windows\system32\netevent.dll
2012-11-15 21:26 . 2012-10-03 16:42	18944	----a-w-	c:\windows\SysWow64\netevent.dll
2012-11-15 21:26 . 2012-09-25 22:47	78336	----a-w-	c:\windows\SysWow64\synceng.dll
2012-11-15 21:26 . 2012-09-25 22:46	95744	----a-w-	c:\windows\system32\synceng.dll
2012-11-13 12:30 . 2012-11-13 12:30	--------	d-----w-	c:\users\Ace\AppData\Local\Diagnostics
2012-11-10 00:38 . 2009-09-04 16:44	517960	----a-w-	c:\windows\system32\XAudio2_5.dll
2012-11-10 00:37 . 2007-10-22 02:37	17928	----a-w-	c:\windows\SysWow64\X3DAudio1_2.dll
2012-11-10 00:36 . 2005-02-05 18:45	3544272	----a-w-	c:\windows\system32\d3dx9_24.dll
2012-10-28 21:14 . 2012-10-28 21:14	--------	d-----w-	c:\program files (x86)\Common Files\PX Storage Engine
2012-10-28 21:14 . 2012-10-29 11:57	--------	d-----w-	c:\program files (x86)\Winamp
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-15 22:45 . 2010-02-09 22:33	66395536	----a-w-	c:\windows\system32\MRT.exe
2012-11-09 13:25 . 2012-07-28 11:47	73656	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-11-09 13:25 . 2012-07-28 11:47	697272	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-10-30 22:51 . 2012-07-27 19:50	59728	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2012-10-30 22:51 . 2012-07-27 19:50	370288	----a-w-	c:\windows\system32\drivers\aswSP.sys
2012-10-30 22:51 . 2012-07-27 19:50	984144	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2012-10-30 22:51 . 2012-07-27 19:50	71600	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2012-10-30 22:51 . 2012-07-27 19:50	25232	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2012-10-30 22:51 . 2012-07-27 19:49	41224	----a-w-	c:\windows\avastSS.scr
2012-10-30 22:50 . 2012-07-27 19:49	227648	----a-w-	c:\windows\SysWow64\aswBoot.exe
2012-10-30 22:50 . 2012-07-27 19:50	285328	----a-w-	c:\windows\system32\aswBoot.exe
2012-10-15 16:59 . 2012-07-27 19:50	54072	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2012-10-02 12:15 . 2012-10-02 12:15	430952	----a-w-	c:\windows\SysWow64\nvStreaming.exe
2012-09-19 15:21 . 2012-08-30 13:39	215128	----a-w-	c:\windows\SysWow64\PnkBstrB.xtr
2012-09-19 15:21 . 2012-08-01 12:28	215128	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2012-09-18 17:25 . 2012-08-01 12:28	189248	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2012-09-18 17:25 . 2012-09-18 17:25	2434856	----a-w-	c:\windows\SysWow64\pbsvc_bc2.exe
2012-09-14 19:19 . 2012-10-10 13:17	2048	----a-w-	c:\windows\system32\tzres.dll
2012-09-14 18:28 . 2012-10-10 13:17	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2012-08-31 18:19 . 2012-10-10 13:18	1659760	----a-w-	c:\windows\system32\drivers\ntfs.sys
2012-08-30 18:03 . 2012-10-10 13:18	5559664	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-08-30 17:12 . 2012-10-10 13:18	3914096	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-08-30 17:12 . 2012-10-10 13:18	3968880	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-08-30 13:26 . 2012-08-30 13:27	1058304	----a-w-	C:\Dual-Core Optimizer.msi
2012-08-30 12:37 . 2012-08-01 12:28	76888	----a-w-	c:\windows\SysWow64\PnkBstrA.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [2010-10-22 460800]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe [2012-11-14 744856]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [x]
R3 X6va008;X6va008;c:\windows\SysWOW64\Drivers\X6va008 [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AIPS;Arp Intelligent Protection Service;c:\program files (x86)\netcut\services\AIPS.exe [2011-07-28 262144]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-08-29 2369960]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-02 382824]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-02-16 676968]
S3 RTL85n64;Realtek 8180/8185 Extensible 802.11-Drahtlosgerätetreiber;c:\windows\system32\DRIVERS\RTL85n64.sys [2009-06-10 378368]
S3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys [2010-07-01 38992]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 31232]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-11-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-28 13:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50	133400	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = fritz.box
uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=DE&userid=5b25c704-5774-4e30-896c-39179d703006&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
FF - ProfilePath - c:\users\Ace\AppData\Roaming\Mozilla\Firefox\Profiles\6i8esjaz.default\
FF - ExtSQL: 2012-10-02 13:14; {73a6fe31-595d-460b-a920-fcc0f8843232}; c:\users\Ace\AppData\Roaming\Mozilla\Firefox\Profiles\6i8esjaz.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112542&tt=3112_3
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=
FF - user.js: extensions.BabylonToolbar.id - d251e615000000000000002586d1041f
FF - user.js: extensions.BabylonToolbar.instlDay - 15552
FF - user.js: extensions.BabylonToolbar.vrsn - 1.5.29.1
FF - user.js: extensions.BabylonToolbar.vrsni - 1.5.29.1
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.29.114:39
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: browser.sessionstore.resume_from_crash - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
AddRemove-AVMWLANCLI - c:\program files (x86)\avmwlanstick\instwcli.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_bc2.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va008]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va008"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-11-27  20:42:09 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-11-27 19:42
.
Vor Suchlauf: 7 Verzeichnis(se), 245.758.476.288 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 245.483.778.048 Bytes frei
.
- - End Of File - - DB3D817A80D8534210F4B3C5FBF914DD
         

--- --- ---

Hi,

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Jetzt mal bitte ein OTL Log aus dem normalen Modus mit Internet.

""Ich konnte keinen Scan mit Internetverbindung im normalen modus machen.Nach 2 Stunden warten war der Scan immernoch nicht fertig und dan hat der Bildschirm sich eingefroren,aber hier der scan im normalen modus ohne Internetverbindung.""
OTL Logfile:

OTL logfile created on: 28.11.2012 16:29:17 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Ace\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,25 Gb Available Physical Memory | 62,45% Memory free
4,00 Gb Paging File | 3,22 Gb Available in Paging File | 80,57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,76 Gb Total Space | 227,85 Gb Free Space | 48,92% Space Free | Partition Type: NTFS
 
Computer Name: ACE-PC | User Name: Ace | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.11.27 16:43:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ace\Desktop\OTL.exe
PRC - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe
PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.09.23 19:43:34 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.08.30 13:37:15 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) -- C:\Program Files (x86)\Skype\Updater\Updater.exe
PRC - [2011.07.28 16:35:44 | 000,262,144 | ---- | M] (Arcai.com) -- C:\Program Files (x86)\netcut\services\aips.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.11.22 12:07:42 | 000,539,984 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.11.20 07:17:34 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.11.14 21:02:20 | 000,744,856 | ---- | M] (Tunngle.net GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe -- (TunngleService)
SRV - [2012.11.09 14:25:41 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.10.02 23:21:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.09.23 19:43:34 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.08.30 13:37:15 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.08.29 11:03:36 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.07.17 14:14:44 | 002,292,480 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Running] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.07.28 16:35:44 | 000,262,144 | ---- | M] (Arcai.com) [Auto | Running] -- C:\Program Files (x86)\netcut\services\aips.exe -- (AIPS)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.10.30 23:51:56 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2012.10.30 23:51:55 | 000,984,144 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2012.10.30 23:51:55 | 000,370,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2012.10.30 23:51:55 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2012.10.30 23:51:53 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012.10.15 17:59:28 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.16 13:42:00 | 000,676,968 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.15 17:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.16 23:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 12:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.10.22 01:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fwlanusb.sys -- (FWLANUSB)
DRV:64bit: - [2010.07.01 14:21:50 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2009.09.16 07:02:42 | 000,031,232 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901t.sys -- (tap0901t)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:35:48 | 000,378,368 | ---- | M] (Realtek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTL85n64.sys -- (RTL85n64)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.18 15:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = ED D2 95 8B 2F 6C CD 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.box
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3503.0728: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.11.11 17:28:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.11.24 12:55:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.29 12:57:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.11.08 22:17:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.07.28 12:45:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ace\AppData\Roaming\mozilla\Extensions
[2012.11.23 20:02:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ace\AppData\Roaming\mozilla\Firefox\Profiles\6i8esjaz.default\extensions
[2012.09.14 21:48:12 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Ace\AppData\Roaming\mozilla\Firefox\Profiles\6i8esjaz.default\extensions\ich@maltegoetz.de
[2012.11.22 20:56:44 | 000,530,519 | ---- | M] () (No name found) -- C:\Users\Ace\AppData\Roaming\mozilla\firefox\profiles\6i8esjaz.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.11.23 20:02:24 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Ace\AppData\Roaming\mozilla\firefox\profiles\6i8esjaz.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.10.28 22:15:55 | 000,002,529 | ---- | M] () -- C:\Users\Ace\AppData\Roaming\mozilla\firefox\profiles\6i8esjaz.default\searchplugins\aol-search.xml
[2012.11.24 12:55:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.11.20 07:17:52 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.11.20 07:17:14 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.11.20 07:17:14 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Search the web (Babylon) (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - Extension: No name found = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\
CHR - Extension: No name found = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: No name found = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\
CHR - Extension: No name found = C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2012.11.27 20:37:28 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Local intranet)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B05CADB-D79A-43A1-9EC2-4548264F418B}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D57496B0-A6EC-405C-A32C-C895FE7841D2}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DBBBAC26-AAFA-4800-8CD4-712150E5CC9F}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E5FE76B5-2921-4741-A7D7-D9D1677A18CF}: DhcpNameServer = 7.254.254.254
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: amd_dc_opt - hkey= - key= - C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
MsConfig:64bit - StartUpReg: avast - hkey= - key= - C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
MsConfig:64bit - StartUpReg: AVMWlanClient - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: CL2 Launcher - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Clownfish - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
MsConfig:64bit - StartUpReg: RocketDock - hkey= - key= - C:\Program Files (x86)\RocketDock\RocketDock.exe ()
MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - StartUpReg: VirtualCloneDrive - hkey= - key= - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.27 20:37:35 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012.11.27 20:34:49 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.11.27 20:27:34 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.11.27 20:27:34 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.11.27 20:27:34 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.11.27 20:26:28 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.11.27 20:26:13 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012.11.27 20:25:12 | 005,007,302 | R--- | C] (Swearware) -- C:\Users\Ace\Desktop\ComboFix.exe
[2012.11.27 17:17:26 | 000,000,000 | ---D | C] -- C:\Users\Ace\AppData\Local\ElevatedDiagnostics
[2012.11.27 17:03:23 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\Ace\Desktop\aswMBR.exe
[2012.11.27 16:43:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Ace\Desktop\OTL.exe
[2012.11.27 16:27:22 | 000,480,632 | ---- | C] (AVM Berlin) -- C:\Windows\instwcli.dex
[2012.11.24 23:01:06 | 000,676,968 | ---- | C] (Realtek                                            ) -- C:\Windows\SysNative\drivers\Rt64win7.sys
[2012.11.24 23:01:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2012.11.24 20:21:03 | 000,000,000 | ---D | C] -- C:\found.001
[2012.11.24 14:36:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD
[2012.11.24 13:22:56 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2012.11.24 12:55:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.11.23 19:19:52 | 000,000,000 | ---D | C] -- C:\found.000
[2012.11.23 17:08:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2012.11.16 23:20:41 | 000,000,000 | ---D | C] -- C:\Users\Ace\AppData\Roaming\.minecraft
[2012.11.13 13:30:17 | 000,000,000 | ---D | C] -- C:\Users\Ace\AppData\Local\Diagnostics
[2012.11.10 22:46:16 | 000,000,000 | ---D | C] -- C:\Users\Ace\Documents\Telltale Games
[2012.10.30 18:38:15 | 000,000,000 | ---D | C] -- C:\Users\Ace\Documents\ArmA 2 Other Profiles
[2012.10.30 18:37:58 | 000,000,000 | ---D | C] -- C:\Users\Ace\Documents\ArmA 2
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.28 16:32:54 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.28 16:32:54 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.28 16:27:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.28 16:27:28 | 1609,965,568 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.28 14:51:01 | 000,480,125 | ---- | M] () -- C:\Users\Ace\Desktop\adwcleaner.exe
[2012.11.27 20:37:28 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.11.27 20:25:46 | 005,007,302 | R--- | M] (Swearware) -- C:\Users\Ace\Desktop\ComboFix.exe
[2012.11.27 18:04:34 | 000,000,222 | ---- | M] () -- C:\Users\Ace\Desktop\ARMA 2 Operation Arrowhead Beta.url
[2012.11.27 18:04:34 | 000,000,221 | ---- | M] () -- C:\Users\Ace\Desktop\ARMA 2.url
[2012.11.27 18:04:34 | 000,000,221 | ---- | M] () -- C:\Users\Ace\Desktop\ARMA 2 Operation Arrowhead.url
[2012.11.27 17:27:25 | 000,000,512 | ---- | M] () -- C:\Users\Ace\Desktop\MBR.dat
[2012.11.27 17:03:58 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\Ace\Desktop\aswMBR.exe
[2012.11.27 16:43:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ace\Desktop\OTL.exe
[2012.11.27 16:37:30 | 000,276,552 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.11.27 16:25:10 | 000,006,736 | ---- | M] () -- C:\bootsqm.dat
[2012.11.24 16:55:08 | 000,013,422 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121124_165500.reg
[2012.11.24 14:34:34 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.24 12:56:03 | 000,003,578 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121124_125601.reg
[2012.11.24 12:44:43 | 000,003,734 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121124_124440.reg
[2012.11.24 12:36:51 | 000,000,410 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121124_123647.reg
[2012.11.23 19:46:11 | 000,001,076 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121123_194608.reg
[2012.11.23 19:45:57 | 000,014,610 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121123_194546.reg
[2012.11.23 18:58:53 | 000,002,920 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121123_185850.reg
[2012.11.23 18:58:43 | 000,016,568 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121123_185824.reg
[2012.11.23 13:24:33 | 000,241,832 | ---- | M] () -- C:\Users\Ace\Documents\cc_20121123_132418.reg
[2012.11.15 23:54:21 | 001,634,396 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.11.15 23:54:21 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.11.15 23:54:21 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.11.15 23:54:21 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.11.15 23:54:21 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.11.11 17:28:12 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.10.30 23:51:56 | 000,059,728 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2012.10.30 23:51:55 | 000,984,144 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2012.10.30 23:51:55 | 000,370,288 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2012.10.30 23:51:55 | 000,071,600 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012.10.30 23:51:53 | 000,025,232 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012.10.30 23:51:07 | 000,041,224 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.10.30 23:50:59 | 000,227,648 | ---- | M] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2012.10.30 23:50:30 | 000,285,328 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.28 14:50:54 | 000,480,125 | ---- | C] () -- C:\Users\Ace\Desktop\adwcleaner.exe
[2012.11.27 20:27:34 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.11.27 20:27:34 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.11.27 20:27:34 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.11.27 20:27:34 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.11.27 20:27:34 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.11.27 18:04:34 | 000,000,222 | ---- | C] () -- C:\Users\Ace\Desktop\ARMA 2 Operation Arrowhead Beta.url
[2012.11.27 18:04:34 | 000,000,221 | ---- | C] () -- C:\Users\Ace\Desktop\ARMA 2.url
[2012.11.27 18:04:34 | 000,000,221 | ---- | C] () -- C:\Users\Ace\Desktop\ARMA 2 Operation Arrowhead.url
[2012.11.27 17:27:25 | 000,000,512 | ---- | C] () -- C:\Users\Ace\Desktop\MBR.dat
[2012.11.27 16:37:20 | 000,276,552 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.11.27 16:25:10 | 000,006,736 | ---- | C] () -- C:\bootsqm.dat
[2012.11.24 16:55:05 | 000,013,422 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121124_165500.reg
[2012.11.24 12:56:02 | 000,003,578 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121124_125601.reg
[2012.11.24 12:55:24 | 000,001,123 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.11.24 12:44:41 | 000,003,734 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121124_124440.reg
[2012.11.24 12:36:50 | 000,000,410 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121124_123647.reg
[2012.11.23 19:46:09 | 000,001,076 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121123_194608.reg
[2012.11.23 19:45:52 | 000,014,610 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121123_194546.reg
[2012.11.23 18:58:51 | 000,002,920 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121123_185850.reg
[2012.11.23 18:58:28 | 000,016,568 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121123_185824.reg
[2012.11.23 13:24:22 | 000,241,832 | ---- | C] () -- C:\Users\Ace\Documents\cc_20121123_132418.reg
[2012.11.15 23:52:25 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.15 23:44:25 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.10.25 19:48:45 | 000,582,661 | ---- | C] () -- C:\Users\Ace\AppData\Roaming\technic-launcher.jar
[2012.10.08 14:41:04 | 001,589,618 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.10.03 16:03:46 | 000,081,938 | ---- | C] () -- C:\Users\Ace\AppData\Roaming\.minecraftminecraft.jar
[2012.10.03 16:03:46 | 000,076,948 | ---- | C] () -- C:\Users\Ace\AppData\Roaming\.minecraftminecraft_modified.jar
[2012.09.28 17:13:27 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2012.09.27 22:18:01 | 000,002,769 | ---- | C] () -- C:\Users\Ace\AppData\Local\recently-used.xbel
[2012.09.18 18:25:00 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2012.08.20 02:51:45 | 000,041,182 | ---- | C] () -- C:\Users\Ace\AppData\Roaming\ascii
[2012.08.18 22:54:12 | 000,001,077 | ---- | C] () -- C:\Users\Ace\Dokumente.lnk
[2012.08.01 13:28:50 | 000,215,128 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.08.01 13:28:47 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.11.16 23:20:41 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\.minecraft
[2012.10.25 20:03:38 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\.techniclauncher
[2012.08.27 03:19:04 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Awesomium
[2012.11.23 19:53:45 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\BitTorrent
[2012.08.22 23:52:17 | 000,000,000 | -H-D | M] -- C:\Users\Ace\AppData\Roaming\D251E615
[2012.10.22 03:40:57 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Dwarfs
[2012.10.22 04:18:27 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\DwarfsF2P
[2012.08.16 03:07:42 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Java
[2012.10.25 20:03:11 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\logs
[2012.08.25 15:30:34 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\LolClient
[2012.11.24 12:58:45 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Notepad++
[2012.10.15 19:59:32 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Origin
[2012.09.27 20:37:28 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Publish Providers
[2012.08.17 03:06:04 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Screaming Bee
[2012.07.31 01:14:38 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\six-zsync
[2012.09.27 20:43:34 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Sony
[2012.08.05 17:50:20 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Spirited Machine
[2012.09.28 14:35:04 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Thunderbird
[2012.11.19 17:13:57 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\TS3Client
[2012.11.22 22:16:12 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Roaming\Tunngle
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2012.11.27 20:37:35 | 000,000,000 | ---D | M] -- C:\$RECYCLE.BIN
[2012.07.31 01:55:25 | 000,000,000 | ---D | M] -- C:\Boot
[2006.11.02 16:42:17 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2012.07.27 16:42:20 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2012.11.23 19:19:52 | 000,000,000 | ---D | M] -- C:\found.000
[2012.11.24 20:21:03 | 000,000,000 | ---D | M] -- C:\found.001
[2012.07.27 22:26:39 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.09.27 21:53:32 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.11.28 14:51:43 | 000,000,000 | ---D | M] -- C:\Program Files (x86)
[2012.11.28 14:51:43 | 000,000,000 | ---D | M] -- C:\ProgramData
[2012.07.27 16:42:20 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.11.27 20:42:25 | 000,000,000 | ---D | M] -- C:\Qoobox
[2012.07.27 20:34:47 | 000,000,000 | ---D | M] -- C:\Recovery
[2012.11.28 16:30:45 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.11.24 13:27:20 | 000,000,000 | R--D | M] -- C:\Users
[2012.11.27 20:37:44 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %windir%\installer\*. /5 >
[2012.11.23 19:37:33 | 000,000,000 | ---D | M] -- C:\Windows\installer\{8E634921-4547-4CA9-AF79-08B735431C12}
[2012.11.24 14:37:01 | 000,000,000 | ---D | M] -- C:\Windows\installer\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}
 
< %localappdata%\*. /5 >
[2012.11.27 17:17:26 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Local\ElevatedDiagnostics
[2012.11.23 18:51:25 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Local\LogMeIn Hamachi
[2012.11.23 18:51:18 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Local\Mozilla
[2012.11.28 16:28:05 | 000,000,000 | ---D | M] -- C:\Users\Ace\AppData\Local\Temp

< End of report >
         

--- --- ---


""Hier die AdwCleaner[S1].txt""


# AdwCleaner v2.009 - Datei am 28/11/2012 um 14:51:43 erstellt
# Aktualisiert am 24/11/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzer : Ace - ACE-PC
# Bootmodus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\Ace\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
Datei Gelöscht : C:\user.js
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\Ace\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok
Ordner Gelöscht : C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Ordner Gelöscht : C:\Users\Ace\AppData\Local\Wajam
Ordner Gelöscht : C:\Users\Ace\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\Ace\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Ace\AppData\Roaming\Mozilla\Firefox\Profiles\6i8esjaz.default\Smartbar
Ordner Gelöscht : C:\Users\Ace\AppData\Roaming\OpenCandy

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Babylon
Schlüssel Gelöscht : HKCU\Software\Wajam
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=DE&userid=5b25c704-5774-4e30-896c-39179d703006&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDY&co=DE&userid=5b25c704-5774-4e30-896c-39179d703006&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} --> hxxp://www.google.com

-\\ Mozilla Firefox v17.0 (en-US)

Profilname : default
Datei : C:\Users\Ace\AppData\Roaming\Mozilla\Firefox\Profiles\6i8esjaz.default\prefs.js

C:\Users\Ace\AppData\Roaming\Mozilla\Firefox\Profiles\6i8esjaz.default\user.js ... Gelöscht !

Gelöscht : user_pref("CT2849855.enableAlerts", "always");
Gelöscht : user_pref("CT2849855.enableSearchFromAddressBar", "FALSE");
Gelöscht : user_pref("CT2849855.firstTimeDialogOpened", "true");
Gelöscht : user_pref("CT2849855.fixPageNotFoundError", "true");
Gelöscht : user_pref("CT2849855.fixPageNotFoundErrorInHidden", "true");
Gelöscht : user_pref("CT2849855.fixUrls", true);
Gelöscht : user_pref("CT2849855.installId", "fftDBD2.tmp.exe");
Gelöscht : user_pref("CT2849855.installType", "XPE");
Gelöscht : user_pref("CT2849855.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gelöscht : user_pref("CT2849855.isNewTabEnabled", true);
Gelöscht : user_pref("CT2849855.isPerformedSmartBarTransition", "true");
Gelöscht : user_pref("CT2849855.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Gelöscht : user_pref("CT2849855.isWelcomPage", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Gelöscht : user_pref("CT2849855.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"about[...]
Gelöscht : user_pref("CT2849855.openThankYouPage", "true");
Gelöscht : user_pref("CT2849855.openUninstallPage", "FALSE");
Gelöscht : user_pref("CT2849855.scriptSource", "hxxp://127.0.0.1:10000/gui/");
Gelöscht : user_pref("CT2849855.search.searchAppId", "129349796699500456");
Gelöscht : user_pref("CT2849855.search.searchCount", "0");
Gelöscht : user_pref("CT2849855.searchInNewTabEnabledInHidden", "true");
Gelöscht : user_pref("CT2849855.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gelöscht : user_pref("CT2849855.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Gelöscht : user_pref("CT2849855.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"2\[...]
Gelöscht : user_pref("CT2849855.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Gelöscht : user_pref("CT2849855.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Gelöscht : user_pref("CT2849855.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Gelöscht : user_pref("CT2849855.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Gelöscht : user_pref("CT2849855.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data[...]
Gelöscht : user_pref("CT2849855.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1347060085989");
Gelöscht : user_pref("CT2849855.serviceLayer_services_appsMetadata_lastUpdate", "1347060085886");
Gelöscht : user_pref("CT2849855.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1347060086259");
Gelöscht : user_pref("CT2849855.serviceLayer_services_login_10.10.27.6_lastUpdate", "1347060089878");
Gelöscht : user_pref("CT2849855.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1347060086301");
Gelöscht : user_pref("CT2849855.serviceLayer_services_searchAPI_lastUpdate", "1347060084861");
Gelöscht : user_pref("CT2849855.serviceLayer_services_serviceMap_lastUpdate", "1347060084219");
Gelöscht : user_pref("CT2849855.serviceLayer_services_toolbarContextMenu_lastUpdate", "1347060086188");
Gelöscht : user_pref("CT2849855.serviceLayer_services_toolbarSettings_lastUpdate", "1347060084832");
Gelöscht : user_pref("CT2849855.serviceLayer_services_translation_lastUpdate", "1347060088313");
Gelöscht : user_pref("CT2849855.settingsINI", true);
Gelöscht : user_pref("CT2849855.shouldFirstTimeDialog", "false");
Gelöscht : user_pref("CT2849855.smartbar.CTID", "CT2849855");
Gelöscht : user_pref("CT2849855.smartbar.Uninstall", "0");
Gelöscht : user_pref("CT2849855.smartbar.toolbarName", "BittorrentBar_DE ");
Gelöscht : user_pref("CT2849855.toolbarBornServerTime", "8-9-2012");
Gelöscht : user_pref("CT2849855.toolbarCurrentServerTime", "8-9-2012");
Gelöscht : user_pref("aol_toolbar.surf.date", "120");
Gelöscht : user_pref("aol_toolbar.surf.lastDate", "29");
Gelöscht : user_pref("aol_toolbar.surf.lastMonth", "9");
Gelöscht : user_pref("aol_toolbar.surf.lastYear", "2012");
Gelöscht : user_pref("aol_toolbar.surf.month", "186");
Gelöscht : user_pref("aol_toolbar.surf.prevMonth", "0");
Gelöscht : user_pref("aol_toolbar.surf.total", "187");
Gelöscht : user_pref("aol_toolbar.surf.week", "120");
Gelöscht : user_pref("aol_toolbar.surf.year", "186");
Gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);
Gelöscht : user_pref("extensions.BabylonToolbar.id", "d251e615000000000000002586d1041f");
Gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15552");
Gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://www.google.com/search?babsrc=TB_ggl&q=");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.5.29.1");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.5.29.1");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112542&tt=3112_3");
Gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.29.114:39:10");
Gelöscht : user_pref("extensions.wajam.affiliate_id", "6447");
Gelöscht : user_pref("extensions.wajam.firstrun", "false");
Gelöscht : user_pref("extensions.wajam.log_send_info", "false");
Gelöscht : user_pref("extensions.wajam.mappingListJsonString", "{\"version\":\"0.21083\",\"supported_sites\":{\[...]
Gelöscht : user_pref("extensions.wajam.no_trace", "false");
Gelöscht : user_pref("extensions.wajam.server_current_mapping_version", "0.21083");

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Ace\AppData\Local\Google\Chrome\User Data\Default\Preferences

Gelöscht [l.27] : icon_url = "hxxp://www.babylon.com/favicon.ico",
Gelöscht [l.30] : keyword = "babylon.com",
Gelöscht [l.33] : search_url = "hxxp://search.babylon.com/?q={searchTerms}&affID=112542&tt=3112_3&babsrc=SP_ss&[...]
Gelöscht [l.1324] : homepage = "hxxp://search.babylon.com/?affID=112542&tt=3112_3&babsrc=HP_ss&mntrId=d251e615000000[...]
Gelöscht [l.1747] : urls_to_restore_on_startup = [ "hxxp://search.babylon.com/?affID=112542&tt=3112_3&babsrc=HP_s[...]

*************************

AdwCleaner[S1].txt - [10194 octets] - [28/11/2012 14:51:43]

########## EOF - C:\AdwCleaner[S1].txt - [10255 octets] ##########

Ich schließe mittlwerweile ein Hardwareproblehm aus da ich im normalen Modus alles machen kann auch Skyrim spielen etc.
Ist es evt. ein Problehm von Windows oder liegt es doch an der Hardware?
Ich denke mittlerwile nichtmehr das es ein Virus ist.
Sobald die wmpnscfg.exe auftaucht und ich eine Internetverbindung habe ist der PC praktisch nichtmehr benutztbar.

Sobald die wmpnscfg.exe auftaucht und ich eine Internetverbindung habe ist der PC praktisch nichtmehr benutztbar.

Du hast die Datei aber mal bei Google eingegeben?


Bitte Inetkabel dran machen wenns irgendwie geht.

Downloade dir bitte Farbar's Service Scanner

• Starte das Tool mit Doppelklick auf die FSS.exe
• Gehe sicher, dass folgende Optionen angehakt sind.
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center/Action Center
  • Windows Update
  • Windows Defender
  • Other Services
• Klicke auf Scan.
• Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.




Downloade dir bitte Farbar's MiniToolBox auf deinen Desktop und starte das Tool

Setze einen Haken bei folgenden Einträgen

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• Report FF Proxy Settings
• Reset IE Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries
• List last 10 Event Viewer log
• List Installed Programs
• List Users, Partitions and Memory size
• List Minidump Files

Klicke Go und poste den Inhalt der Result.txt.

Vielen vielen dank für deine hilfe irgendwie hat sich das Problehm von selbst erledigt....
Aber ich bin noch misstrauisch.Ich werde mich Melden wen ich es wieder los geht.


Gruß
Julien

alles klar.