| |
| |||||||
Log-Analyse und Auswertung: PC hängt sich ständig beim gaming auf! Verdacht auf Virus!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
17.03.2013, 12:52
| #1 |
| |  PC hängt sich ständig beim gaming auf! Verdacht auf Virus! Hallo Leute, Seit geraumer Zeit hängt sich mein Rechner beim spielen von PC-Games auf. Das Problem zeigt sich so: Ich spiele ganze normal Battlefield 3 und skype nebenbei mit einem Freund. Dann bleibt Battlefield 3 plötzlich stehen, aber der Ton und Skype laufen normal weiter. Per Windows-Taste komme ich noch auf den Desktop und mit dem Affengriff kann ich grade noch so den Taskmanager öffnen. Mehr passiert dann auch nicht mehr. Dann setzt auf der Ton von Battlefield aus. Skype läuft trotzdem noch. Nach 1-2 Minuten hängt auch Skype und das ganze System. Ich habe mich auch schon an das pcgh-forum gewendet, da ich erst vermutete die Hardware könnte daran Schuld sein. Doch die Hardware läuft eigentlich problemlos. Es treten auch keine Überhitzungen auf. Erst nach ein paar Neustarts läuft das System wieder stabil. Beim Booten kommt manchmal auch eine Error-Meldung, "Disk read failure. Press ctrl+alt+delete to reboot". Wie gesagt, das System hängt sich nur beim "zocken" auf. Beim Installieren von Spielen oder größeren Anwendungen hängt er auch ab und zu. Bei den "Hängern" bleibt denn 2-5 Minuten lang das gesamt System stehen und dann läuft er wieder ganz normal weiter. Und das ein paar mal während der Installation. Gelegentlich kommt es dabei auch zu willkürlichen Neustarts. Ich weiß absolut nicht mehr weiter. Ich als Gamer bin mit meinem Latein am Ende. Beim ausführen des GMER-Scans kommt folgende Meldung: "C:\Windows\system32\config\system: Der Prozess kann nicht auf die Datei zureifen, da sie von einem anderen Prozess verwendet wird." naja hier trotzdem der GMER-Log: GMER 2.1.19155 - hxxp://www.gmer.net Rootkit scan 2013-03-17 11:59:50 Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 SAMSUNG_HD155UI rev.1AQ10001 1397,27GB Running: gmer_2.1.19155.exe; Driver: C:\Users\...\AppData\Local\Temp\uwldypow.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\SysWOW64\PnkBstrA.exe[1952] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072791a22 2 bytes [79, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1952] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072791ad0 2 bytes [79, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1952] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072791b08 2 bytes [79, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1952] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072791bba 2 bytes [79, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1952] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072791bda 2 bytes [79, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f01465 2 bytes [F0, 76] .text C:\Windows\SysWOW64\PnkBstrA.exe[1952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f014bb 2 bytes [F0, 76] .text ... * 2 .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[1008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f01465 2 bytes [F0, 76] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[1008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f014bb 2 bytes [F0, 76] .text ... * 2 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f01465 2 bytes [F0, 76] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f014bb 2 bytes [F0, 76] .text ... * 2 ? C:\Windows\system32\mssprxy.dll [4796] entry point in ".rdata" section 000000006e6271e6 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 0000000076f4f941 7 bytes {MOV EDX, 0x690228; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 0000000076f4fb85 7 bytes {MOV EDX, 0x690268; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 0000000076f4fbb5 7 bytes {MOV EDX, 0x6901a8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 0000000076f4fbcd 7 bytes {MOV EDX, 0x690128; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 0000000076f4fbe5 7 bytes {MOV EDX, 0x690328; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 0000000076f4fc15 7 bytes {MOV EDX, 0x690368; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 0000000076f4fc95 7 bytes {MOV EDX, 0x6902e8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 0000000076f4fcad 7 bytes {MOV EDX, 0x6902a8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 0000000076f4fcf9 7 bytes {MOV EDX, 0x690068; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 0000000076f4fdf1 7 bytes {MOV EDX, 0x6900a8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 0000000076f50049 7 bytes {MOV EDX, 0x690028; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 0000000076f51055 7 bytes {MOV EDX, 0x6901e8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 0000000076f510cd 7 bytes {MOV EDX, 0x690168; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 0000000076f512d1 7 bytes {MOV EDX, 0x6900e8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f01465 2 bytes [F0, 76] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2720] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f014bb 2 bytes [F0, 76] .text ... * 2 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 0000000076f4f941 7 bytes {MOV EDX, 0x101ce28; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 0000000076f4fb85 7 bytes {MOV EDX, 0x101ce68; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 0000000076f4fbb5 7 bytes {MOV EDX, 0x101cda8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 0000000076f4fbcd 7 bytes {MOV EDX, 0x101cd28; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 0000000076f4fbe5 7 bytes {MOV EDX, 0x101cf28; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 0000000076f4fc15 7 bytes {MOV EDX, 0x101cf68; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 0000000076f4fc95 7 bytes {MOV EDX, 0x101cee8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 0000000076f4fcad 7 bytes {MOV EDX, 0x101cea8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 0000000076f4fcf9 7 bytes {MOV EDX, 0x101cc68; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 0000000076f4fdf1 7 bytes {MOV EDX, 0x101cca8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 0000000076f50049 7 bytes {MOV EDX, 0x101cc28; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 0000000076f51055 7 bytes {MOV EDX, 0x101cde8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 0000000076f510cd 7 bytes {MOV EDX, 0x101cd68; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 0000000076f512d1 7 bytes {MOV EDX, 0x101cce8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f01465 2 bytes [F0, 76] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f014bb 2 bytes [F0, 76] .text ... * 2 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 0000000076f4f941 7 bytes {MOV EDX, 0x804628; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 0000000076f4fb85 7 bytes {MOV EDX, 0x804668; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 0000000076f4fbb5 7 bytes {MOV EDX, 0x8045a8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 0000000076f4fbcd 7 bytes {MOV EDX, 0x804528; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 0000000076f4fbe5 7 bytes {MOV EDX, 0x804728; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 0000000076f4fc15 7 bytes {MOV EDX, 0x804768; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 0000000076f4fc95 7 bytes {MOV EDX, 0x8046e8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 0000000076f4fcad 7 bytes {MOV EDX, 0x8046a8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 0000000076f4fcf9 7 bytes {MOV EDX, 0x804468; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 0000000076f4fdf1 7 bytes {MOV EDX, 0x8044a8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 0000000076f50049 7 bytes {MOV EDX, 0x804428; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 0000000076f51055 7 bytes {MOV EDX, 0x8045e8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 0000000076f510cd 7 bytes {MOV EDX, 0x804568; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 0000000076f512d1 7 bytes {MOV EDX, 0x8044e8; JMP RDX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f01465 2 bytes [F0, 76] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f014bb 2 bytes [F0, 76] .text ... * 2 ---- EOF - GMER 2.1 ---- _____________________________________________________________________________ OTL-Log: OTL logfile created on: 17.03.2013 11:42:47 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\\Downloads 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 8,00 Gb Total Physical Memory | 6,63 Gb Available Physical Memory | 82,87% Memory free 15,99 Gb Paging File | 14,34 Gb Available in Paging File | 89,67% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 420,60 Gb Total Space | 267,28 Gb Free Space | 63,55% Space Free | Partition Type: NTFS Drive D: | 976,56 Gb Total Space | 806,75 Gb Free Space | 82,61% Space Free | Partition Type: NTFS Drive E: | 6,51 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: -PC | User Name: | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.03.17 11:42:27 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\\Downloads\OTL.exe PRC - [2013.03.14 16:55:48 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2013.03.14 16:08:53 | 001,103,768 | ---- | M] (Spotify Ltd) -- C:\Users\Max\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe PRC - [2013.03.03 16:19:25 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2013.03.03 16:19:06 | 000,385,248 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.03.03 16:19:06 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.11.29 01:10:08 | 000,661,304 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech Gaming Software\Applets\LCDMedia.exe PRC - [2010.01.22 12:29:40 | 000,106,496 | ---- | M] (NEC Electronics Corporation) -- C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2009.09.10 17:01:48 | 000,505,152 | ---- | M] (D-Link Corp.) -- C:\Program Files (x86)\D-Link\DWA-131 revA\wirelesscm.exe PRC - [2009.07.07 13:13:38 | 000,241,789 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe PRC - [2009.03.30 15:32:40 | 000,032,768 | R--- | M] () -- C:\Windows\DAODx.exe PRC - [2009.02.23 04:43:56 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe PRC - [2008.06.26 19:09:36 | 000,167,936 | ---- | M] () -- C:\Program Files (x86)\D-Link\DWA-131 revA\WlanWpsSvc.exe ========== Modules (No Company Name) ========== MOD - [2009.08.06 16:15:10 | 000,376,832 | ---- | M] () -- C:\Program Files (x86)\D-Link\DWA-131 revA\WlanDll.dll MOD - [2009.07.30 14:54:04 | 000,170,496 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL MOD - [2009.03.30 15:32:40 | 000,032,768 | R--- | M] () -- C:\Windows\DAODx.exe MOD - [2009.02.06 18:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL ========== Services (SafeList) ========== SRV:64bit: - [2012.12.19 20:56:00 | 000,240,640 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2012.12.19 15:32:12 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service) SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2013.03.14 16:55:48 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2013.03.03 16:19:25 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.03.03 16:19:06 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.03.03 11:33:24 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service) SRV - [2013.03.03 11:32:39 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service) SRV - [2013.02.25 07:39:32 | 000,543,144 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2013.02.07 13:10:08 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2011.08.05 00:25:50 | 000,091,984 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.02.23 04:43:56 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService) SRV - [2008.06.26 19:09:36 | 000,167,936 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\D-Link\DWA-131 revA\WlanWpsSvc.exe -- (WlanWpsSvc) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.03.03 17:06:25 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2013.03.03 16:19:34 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2013.03.03 16:19:34 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2013.03.03 16:19:33 | 000,099,912 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.12.19 21:48:48 | 011,278,336 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2012.12.19 20:32:54 | 000,552,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2012.11.06 12:11:52 | 000,096,256 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2012.03.01 07:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.03.11 07:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.03.17 11:24:00 | 000,401,696 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7) DRV:64bit: - [2010.03.02 12:30:20 | 001,301,504 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV:64bit: - [2010.02.18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64) DRV:64bit: - [2010.01.22 12:22:22 | 000,180,224 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2010.01.22 12:22:18 | 000,077,824 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2009.11.24 02:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid) DRV:64bit: - [2009.11.24 02:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:64bit: - [2009.10.29 09:14:38 | 000,115,824 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID) DRV:64bit: - [2009.10.19 14:45:54 | 000,039,480 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter) DRV:64bit: - [2009.08.20 11:00:10 | 000,664,576 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su) DRV:64bit: - [2009.07.31 04:40:34 | 000,025,600 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMfilt64.sys -- (VMfilt) DRV:64bit: - [2009.07.16 04:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.01 20:54:54 | 000,030,728 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGPBTDD.sys -- (LGPBTDD) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2013.01.28 15:42:00 | 000,030,624 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\FinalWire\AIDA64 Extreme Edition\kerneld.x64 -- (AIDA64Driver) DRV - [2012.04.09 09:13:58 | 000,057,472 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.2) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.3: C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft) ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google  riginalQueryForSuggestion}{google:assistedQueryStats}{google:se archFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParam eter} CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\pdf.dll CHR - plugin: ESN Launch Mozilla Plugin (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll CHR - plugin: ESN Sonar API (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll CHR - plugin: Uplay PC (Enabled) = C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [RunDLLEntry] C:\Windows\SysNative\AmbRunE.DLL (Creative Technology Ltd.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.) O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe (Creative Technology Ltd) O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Max\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{15627F9A-E6E5-475D-988A-0097CBDD9F78}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E320C894-2563-4868-80F9-96EB500B637B}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011.10.27 13:34:24 | 000,000,044 | R--- | M] () - E:\autorun.inf -- [ UDF ] O33 - MountPoints2\{860ed83e-8414-11e2-8e09-bcaec5288f25}\Shell - "" = AutoRun O33 - MountPoints2\{860ed83e-8414-11e2-8e09-bcaec5288f25}\Shell\AutoRun\command - "" = G:\raf-cry3.exe O33 - MountPoints2\{c9e18ff9-83eb-11e2-a481-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{c9e18ff9-83eb-11e2-a481-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2011.10.27 13:34:26 | 000,355,920 | R--- | M] (Valve Corporation) O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.03.16 20:34:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\D-Link [2013.03.16 20:34:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\D-Link [2013.03.16 20:33:15 | 000,000,000 | ---D | C] -- C:\Windows\pcidevice [2013.03.16 20:33:10 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\InstallShield [2013.03.16 20:32:55 | 000,000,000 | ---D | C] -- C:\Users\\Desktop\Setup [2013.03.16 20:32:55 | 000,000,000 | ---D | C] -- C:\Users\\Desktop\Driver [2013.03.15 23:39:49 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\Theta [2013.03.15 23:39:49 | 000,000,000 | ---D | C] -- C:\Users\\Documents\Assassin's Creed III [2013.03.15 23:11:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FinalWire [2013.03.15 23:11:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FinalWire [2013.03.15 23:10:22 | 000,000,000 | ---D | C] -- C:\Users\Max\Desktop\AIDA64 - 2.80.2300 [2013.03.15 22:58:33 | 000,000,000 | ---D | C] -- C:\ProgramData\SoftSafe [2013.03.15 22:58:06 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate [2013.03.15 15:34:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavalys [2013.03.15 15:34:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavalys [2013.03.15 15:27:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo [2013.03.15 15:27:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CrystalDiskInfo [2013.03.15 14:04:05 | 000,000,000 | -HSD | C] -- C:\found.001 [2013.03.14 20:05:52 | 000,000,000 | ---D | C] -- C:\Users\\Desktop\Risen 2 [2013.03.14 20:04:59 | 000,000,000 | ---D | C] -- C:\Users\\Desktop\Risen 2 [2013.03.14 19:52:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation [2013.03.14 19:51:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard [2013.03.14 17:24:41 | 000,000,000 | -HSD | C] -- C:\found.000 [2013.03.14 16:50:30 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core [2013.03.14 16:48:12 | 000,000,000 | ---D | C] -- C:\Users\\Documents\Battlefield 3 [2013.03.14 16:48:10 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs [2013.03.13 16:57:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefield 3 [2013.03.13 16:57:52 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller [2013.03.13 16:01:09 | 000,000,000 | ---D | C] -- C:\Users\Max\Desktop\Phx_data [2013.03.13 16:01:04 | 015,707,433 | ---- | C] ($t@t!c_V()!D) -- C:\Users\Max\Desktop\Phoenix.exe [2013.03.12 15:53:49 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\Skype [2013.03.12 15:53:43 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype [2013.03.12 15:53:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2013.03.12 15:53:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2013.03.12 15:53:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2013.03.12 14:53:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin Games [2013.03.12 14:53:59 | 000,000,000 | ---D | C] -- C:\Users\Max\AppData\Roaming\Origin [2013.03.12 14:53:54 | 000,000,000 | ---D | C] -- C:\Users\Max\AppData\Local\Origin [2013.03.12 14:53:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin [2013.03.12 14:53:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin [2013.03.12 14:52:49 | 000,000,000 | ---D | C] -- C:\Users\Max\AppData\Local\ESN [2013.03.12 14:52:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Battlelog Web Plugins [2013.03.12 14:52:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin [2013.03.11 20:57:32 | 000,000,000 | ---D | C] -- C:\Users\\Desktop\Crysis 3 [2013.03.11 20:57:08 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\WinRAR [2013.03.11 20:57:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR [2013.03.11 20:57:07 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR [2013.03.11 20:57:06 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR [2013.03.11 20:06:34 | 000,000,000 | ---D | C] -- C:\Users\\Documents\EA Games [2013.03.11 20:06:13 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Local\EA Games [2013.03.11 20:03:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps [2013.03.11 20:03:25 | 000,000,000 | ---D | C] -- C:\Fraps [2013.03.11 19:15:19 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Local\PunkBuster [2013.03.11 19:15:05 | 000,000,000 | ---D | C] -- C:\Users\\Documents\My Games [2013.03.11 19:15:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Orbit [2013.03.11 17:19:48 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Local\ [2013.03.11 17:17:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts [2013.03.11 17:16:42 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Local\Ubisoft Game Launcher [2013.03.11 16:55:13 | 000,000,000 | ---D | C] -- C:\Users\\Desktop\Dead Space 3 [2013.03.11 16:54:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Crysis 3 [2013.03.11 16:53:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts [2013.03.11 16:43:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Electronic Arts [2013.03.11 16:39:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hulumuluch [2013.03.11 16:28:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\hulumuluch [2013.03.11 16:26:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Package Cache [2013.03.11 16:17:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft [2013.03.11 16:07:39 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Local\Programs [2013.03.07 16:11:06 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\Dojotech Software [2013.03.07 16:05:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dojotech Software [2013.03.07 16:05:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Dojotech Software [2013.03.06 10:13:28 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam [2013.03.06 09:55:01 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Local\Logitech [2013.03.06 09:55:00 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\Leadertech [2013.03.06 09:54:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech [2013.03.06 09:54:20 | 000,000,000 | ---D | C] -- C:\ProgramData\LogiShrd [2013.03.06 09:54:15 | 000,000,000 | ---D | C] -- C:\Program Files\Logitech Gaming Software [2013.03.06 09:53:27 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\Logitech [2013.03.06 09:53:27 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\Logishrd [2013.03.06 09:49:20 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2013.03.06 09:49:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT [2013.03.06 09:49:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP [2013.03.06 09:48:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center [2013.03.06 09:38:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Steam [2013.03.06 09:38:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam [2013.03.06 09:38:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam [2013.03.05 13:12:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2013.03.04 15:23:57 | 000,000,000 | ---D | C] -- C:\Program Files\Paint.NET [2013.03.04 15:23:46 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Local\Paint.NET [2013.03.03 17:23:26 | 000,000,000 | ---D | C] -- C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft [2013.03.03 17:23:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ubisoft [2013.03.03 17:06:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite [2013.03.03 17:06:25 | 000,283,200 | ---- | C] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys [2013.03.03 17:06:23 | 000,000,000 | ---D | C] -- C:\Users\Max\AppData\Roaming\DAEMON Tools Lite [2013.03.03 17:06:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DAEMON Tools Lite [2013.03.03 17:05:27 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite [2013.03.03 16:59:11 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Local\Spotify [2013.03.03 16:53:30 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Roaming\Spotify [2013.03.03 16:26:18 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Roaming\Avira [2013.03.03 16:20:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2013.03.03 16:20:36 | 000,129,216 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys [2013.03.03 16:20:36 | 000,099,912 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys [2013.03.03 16:20:36 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys [2013.03.03 16:20:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2013.03.03 16:20:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2013.03.03 16:15:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome [2013.03.03 16:14:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google [2013.03.03 16:14:04 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Local\Google [2013.03.03 16:13:56 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Local\Deployment [2013.03.03 16:13:56 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Local\Apps [2013.03.03 11:49:56 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Local\AMD [2013.03.03 11:49:47 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Roaming\ATI [2013.03.03 11:49:47 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Local\ATI [2013.03.03 11:48:00 | 000,000,000 | ---D | C] -- C:\Program Files\AMD [2013.03.03 11:47:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies [2013.03.03 11:47:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies [2013.03.03 11:47:19 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD [2013.03.03 11:46:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies [2013.03.03 11:46:35 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies [2013.03.03 11:45:51 | 000,000,000 | ---D | C] -- C:\AMD [2013.03.03 11:40:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NEC Electronics [2013.03.03 11:40:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NEC Electronics [2013.03.03 11:39:55 | 000,000,000 | ---D | C] -- C:\Users\..\AppData\Local\Downloaded Installations [2013.03.03 11:35:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Marvell [2013.03.03 11:34:00 | 000,000,000 | ---D | C] -- C:\RaidTool [2013.03.03 11:33:53 | 000,000,000 | ---D | C] -- C:\Windows\RaidTool [2013.03.03 11:33:33 | 000,466,456 | ---- | C] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll [2013.03.03 11:33:33 | 000,444,952 | ---- | C] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll [2013.03.03 11:33:32 | 002,873,823 | ---- | C] (Creative) -- C:\Windows\SysWow64\Sens_oal.dll [2013.03.03 11:33:32 | 001,910,272 | ---- | C] (Creative) -- C:\Windows\SysNative\Sens_oal.dll [2013.03.03 11:33:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center [2013.03.03 11:32:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative [2013.03.03 11:32:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Creative Labs Shared [2013.03.03 11:32:33 | 000,000,000 | ---D | C] -- C:\Program Files\Creative [2013.03.03 11:32:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Creative [2013.03.03 11:32:02 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information [2013.03.03 11:31:49 | 000,242,176 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysNative\Dts2APO.dll [2013.03.03 11:31:49 | 000,193,024 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysNative\ViaMicArrayAPO.dll [2013.03.03 11:31:49 | 000,086,016 | ---- | C] (QSound Labs, Inc.) -- C:\Windows\SysNative\nQPropPageExt.dll [2013.03.03 11:31:49 | 000,082,432 | ---- | C] (QSound Labs, Inc.) -- C:\Windows\SysNative\nQAPO.dll [2013.03.03 11:31:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VIA [2013.03.03 11:31:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield [2013.03.03 11:31:20 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX [2013.03.03 11:31:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE [2013.03.03 11:31:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD [2013.03.03 11:31:11 | 000,000,000 | ---D | C] -- C:\Program Files\ATI [2013.03.03 11:30:45 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2013.03.03 11:27:29 | 000,000,000 | R--D | C] -- C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2013.03.03 11:27:29 | 000,000,000 | R--D | C] -- C:\Users\...\Searches [2013.03.03 11:27:29 | 000,000,000 | R--D | C] -- C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2013.03.03 11:27:18 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Roaming\Identities [2013.03.03 11:27:13 | 000,000,000 | R--D | C] -- C:\Users\...\Contacts [2013.03.03 11:27:10 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Local\VirtualStore [2013.03.03 11:26:53 | 000,000,000 | --SD | C] -- C:\Users\...\AppData\Roaming\Microsoft [2013.03.03 11:26:53 | 000,000,000 | R--D | C] -- C:\Users\...\Videos [2013.03.03 11:26:53 | 000,000,000 | R--D | C] -- C:\Users\...\Saved Games [2013.03.03 11:26:53 | 000,000,000 | R--D | C] -- C:\Users\...\Pictures [2013.03.03 11:26:53 | 000,000,000 | R--D | C] -- C:\Users\...\Music [2013.03.03 11:26:53 | 000,000,000 | R--D | C] -- C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2013.03.03 11:26:53 | 000,000,000 | R--D | C] -- C:\Users\...\Links [2013.03.03 11:26:53 | 000,000,000 | R--D | C] -- C:\Users\...\Favorites [2013.03.03 11:26:53 | 000,000,000 | R--D | C] -- C:\Users\...\Downloads [2013.03.03 11:26:53 | 000,000,000 | R--D | C] -- C:\Users\...\Documents [2013.03.03 11:26:53 | 000,000,000 | R--D | C] -- C:\Users\...\Desktop [2013.03.03 11:26:53 | 000,000,000 | R--D | C] -- C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Vorlagen [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\AppData\Local\Verlauf [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\AppData\Local\Temporary Internet Files [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Startmenü [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\SendTo [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Recent [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Netzwerkumgebung [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Lokale Einstellungen [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Documents\Eigene Videos [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Documents\Eigene Musik [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Eigene Dateien [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Documents\Eigene Bilder [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Druckumgebung [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Cookies [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\AppData\Local\Anwendungsdaten [2013.03.03 11:26:53 | 000,000,000 | -HSD | C] -- C:\Users\...\Anwendungsdaten [2013.03.03 11:26:53 | 000,000,000 | -H-D | C] -- C:\Users\...\AppData [2013.03.03 11:26:53 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Local\Temp [2013.03.03 11:26:53 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Local\Microsoft [2013.03.03 11:26:53 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Roaming\Media Center Programs [2013.03.03 11:26:45 | 000,000,000 | -HSD | C] -- C:\Recovery [2013.03.03 11:26:44 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2013.03.03 11:26:44 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2013.03.03 11:26:44 | 000,000,000 | -HSD | C] -- C:\Programme [2013.03.03 11:26:44 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2013.03.03 11:26:44 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2013.03.03 11:26:44 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2013.03.03 11:26:44 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2013.03.03 11:26:44 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2013.03.03 11:26:44 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2013.03.03 11:26:44 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2013.03.03 11:26:44 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2013.03.03 11:22:07 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2013.03.03 11:19:40 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2013.03.03 11:19:16 | 000,000,000 | -HSD | C] -- C:\System Volume Information [2013.03.03 11:18:23 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2013.03.03 11:18:10 | 000,000,000 | -HSD | C] -- C:\Boot [2013.02.26 07:55:24 | 000,071,680 | ---- | C] (Beepa P/L) -- C:\Windows\SysNative\frapsv64.dll [2013.02.26 07:55:22 | 000,065,536 | ---- | C] (Beepa P/L) -- C:\Windows\SysWow64\frapsvid.dll [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.03.17 11:42:13 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.03.17 11:42:13 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.03.17 11:41:32 | 000,000,000 | ---- | M] () -- C:\Users\Max\defogger_reenable [2013.03.17 11:38:08 | 001,610,444 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.03.17 11:38:08 | 000,695,598 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.03.17 11:38:08 | 000,651,882 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.03.17 11:38:08 | 000,147,030 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.03.17 11:38:08 | 000,120,814 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.03.17 11:33:25 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.03.17 11:33:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.03.17 11:33:09 | 2146,045,951 | -HS- | M] () -- C:\hiberfil.sys [2013.03.17 11:19:13 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.03.17 11:05:30 | 000,281,688 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2013.03.17 11:05:30 | 000,281,688 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2013.03.16 20:34:25 | 000,000,958 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Wireless Connection Manager.lnk [2013.03.16 20:34:25 | 000,000,952 | ---- | M] () -- C:\Users\Public\Desktop\Wireless Connection Manager.lnk [2013.03.16 12:38:51 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2013.03.15 23:11:43 | 000,001,235 | ---- | M] () -- C:\Users\\Desktop\AIDA64 Extreme Edition.lnk [2013.03.15 16:01:27 | 000,001,885 | ---- | M] () -- C:\Users\\Desktop\Phx_settings.ini [2013.03.15 15:27:35 | 000,001,984 | ---- | M] () -- C:\Users\\Desktop\CrystalDiskInfo.lnk [2013.03.15 14:19:33 | 000,002,183 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2013.03.14 17:25:19 | 000,006,704 | ---- | M] () -- C:\bootsqm.dat [2013.03.14 16:55:48 | 000,076,888 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe [2013.03.13 16:57:54 | 000,001,174 | ---- | M] () -- C:\Users\Public\Desktop\Battlefield 3.lnk [2013.03.12 16:02:36 | 000,001,788 | ---- | M] () -- C:\Users\...\Desktop\Day of Defeat Source.lnk [2013.03.12 16:02:36 | 000,001,786 | ---- | M] () -- C:\Users\\Desktop\Half-Life 2 Deathmatch.lnk [2013.03.12 16:02:36 | 000,001,786 | ---- | M] () -- C:\Users\\Desktop\Counter-Strike Source.lnk [2013.03.12 15:53:43 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2013.03.11 20:29:47 | 000,001,421 | ---- | M] () -- C:\Users\\Desktop\Dead Space 3.lnk [2013.03.11 20:03:26 | 000,001,406 | ---- | M] () -- C:\Users\\Desktop\Fraps.lnk [2013.03.11 16:53:08 | 000,001,330 | ---- | M] () -- C:\Users\Public\Desktop\Crysis 3.lnk [2013.03.11 16:39:44 | 000,002,085 | ---- | M] () -- C:\Users\\Desktop\Tomb Raider.lnk [2013.03.11 16:26:03 | 001,587,046 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013.03.11 16:17:41 | 000,001,300 | ---- | M] () -- C:\Users\Public\Desktop\Far Cry 3.lnk [2013.03.10 17:57:24 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2013.03.07 16:05:16 | 000,002,649 | ---- | M] () -- C:\Users\Public\Desktop\Dojotech Spotify Recorder.lnk [2013.03.06 10:13:28 | 000,000,222 | ---- | M] () -- C:\Users\\Desktop\Sleeping Dogs.url [2013.03.05 13:05:21 | 000,275,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.03.04 15:42:56 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf [2013.03.04 15:42:56 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf [2013.03.04 15:27:21 | 000,251,771 | ---- | M] () -- C:\Users\\Desktop\Escobar.jpg [2013.03.03 17:06:25 | 000,283,200 | ---- | M] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys [2013.03.03 16:59:11 | 000,001,757 | ---- | M] () -- C:\Users\\Desktop\Spotify.lnk [2013.03.03 16:19:34 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys [2013.03.03 16:19:34 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys [2013.03.03 16:19:33 | 000,099,912 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys [2013.03.03 11:51:57 | 000,000,000 | RHS- | M] () -- C:\winx.ld [2013.03.03 11:51:55 | 000,203,836 | RHS- | M] () -- C:\grldr [2013.03.03 11:49:07 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin [2013.03.03 11:40:25 | 000,046,993 | ---- | M] () -- C:\Windows\Ascd_log.ini [2013.03.03 11:33:37 | 000,000,159 | RH-- | M] () -- C:\Windows\ctfile.rfc [2013.03.03 11:33:33 | 000,466,456 | ---- | M] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll [2013.03.03 11:33:33 | 000,444,952 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll [2013.03.03 11:30:06 | 000,001,769 | ---- | M] () -- C:\Windows\Language_trs.ini [2013.03.03 11:29:42 | 000,033,927 | ---- | M] () -- C:\Windows\Ascd_tmp.ini [2013.03.03 11:23:34 | 000,057,050 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2013.03.03 11:23:34 | 000,057,050 | ---- | M] () -- C:\Windows\SysNative\license.rtf [2013.03.03 11:18:11 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK [2013.02.26 07:55:24 | 000,071,680 | ---- | M] (Beepa P/L) -- C:\Windows\SysNative\frapsv64.dll [2013.02.26 07:55:22 | 000,065,536 | ---- | M] (Beepa P/L) -- C:\Windows\SysWow64\frapsvid.dll [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.03.17 11:41:32 | 000,000,000 | ---- | C] () -- C:\Users\\defogger_reenable [2013.03.16 20:34:25 | 000,000,958 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Wireless Connection Manager.lnk [2013.03.16 20:34:25 | 000,000,952 | ---- | C] () -- C:\Users\Public\Desktop\Wireless Connection Manager.lnk [2013.03.15 23:11:43 | 000,001,235 | ---- | C] () -- C:\Users\\Desktop\AIDA64 Extreme Edition.lnk [2013.03.15 15:27:35 | 000,001,984 | ---- | C] () -- C:\Users\\Desktop\CrystalDiskInfo.lnk [2013.03.14 17:25:19 | 000,006,704 | ---- | C] () -- C:\bootsqm.dat [2013.03.13 16:57:54 | 000,001,174 | ---- | C] () -- C:\Users\Public\Desktop\Battlefield 3.lnk [2013.03.13 16:01:10 | 000,001,885 | ---- | C] () -- C:\Users\\Desktop\Phx_settings.ini [2013.03.12 16:02:36 | 000,001,788 | ---- | C] () -- C:\Users\\Desktop\Day of Defeat Source.lnk [2013.03.12 16:02:36 | 000,001,786 | ---- | C] () -- C:\Users\\Desktop\Half-Life 2 Deathmatch.lnk [2013.03.12 16:02:36 | 000,001,786 | ---- | C] () -- C:\Users\\Desktop\Counter-Strike Source.lnk [2013.03.12 15:53:43 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2013.03.11 20:29:47 | 000,001,421 | ---- | C] () -- C:\Users\\Desktop\Dead Space 3.lnk [2013.03.11 20:03:26 | 000,001,406 | ---- | C] () -- C:\Users\\Desktop\Fraps.lnk [2013.03.11 19:15:27 | 000,281,688 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2013.03.11 16:53:08 | 000,001,330 | ---- | C] () -- C:\Users\Public\Desktop\Crysis 3.lnk [2013.03.11 16:39:44 | 000,002,085 | ---- | C] () -- C:\Users\\Desktop\Tomb Raider.lnk [2013.03.11 16:21:41 | 001,587,046 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013.03.11 16:17:41 | 000,001,300 | ---- | C] () -- C:\Users\Public\Desktop\Far Cry 3.lnk [2013.03.10 17:57:24 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2013.03.07 16:05:16 | 000,002,649 | ---- | C] () -- C:\Users\Public\Desktop\Dojotech Spotify Recorder.lnk [2013.03.06 10:13:27 | 000,000,222 | ---- | C] () -- C:\Users\\Desktop\Sleeping Dogs.url [2013.03.04 15:55:01 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2013.03.04 15:42:56 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf [2013.03.04 15:42:56 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf [2013.03.04 15:34:15 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf [2013.03.04 15:27:16 | 000,251,771 | ---- | C] () -- C:\Users\\Desktop\Escobar.jpg [2013.03.04 15:25:17 | 000,001,300 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.NET.lnk [2013.03.03 17:23:28 | 000,291,088 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2013.03.03 17:23:28 | 000,281,688 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2013.03.03 17:23:28 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2013.03.03 16:59:11 | 000,001,757 | ---- | C] () -- C:\Users\\Desktop\Spotify.lnk [2013.03.03 16:59:11 | 000,001,743 | ---- | C] () -- C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk [2013.03.03 16:15:10 | 000,002,183 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2013.03.03 16:14:16 | 000,001,104 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.03.03 16:14:13 | 000,001,100 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.03.03 11:51:57 | 000,000,000 | RHS- | C] () -- C:\winx.ld [2013.03.03 11:51:55 | 000,203,836 | RHS- | C] () -- C:\grldr [2013.03.03 11:49:07 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2013.03.03 11:33:37 | 000,219,136 | ---- | C] () -- C:\Windows\SysNative\APOMgr64.DLL [2013.03.03 11:33:37 | 000,170,496 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2013.03.03 11:33:37 | 000,089,088 | ---- | C] () -- C:\Windows\SysNative\CmdRtr64.DLL [2013.03.03 11:33:37 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2013.03.03 11:33:37 | 000,005,037 | ---- | C] () -- C:\Windows\SysNative\cfgfx.ini [2013.03.03 11:33:37 | 000,002,773 | ---- | C] () -- C:\Windows\FF08_Render_Spk_Hp.ini [2013.03.03 11:33:37 | 000,001,650 | ---- | C] () -- C:\Windows\FF08_Capture.ini [2013.03.03 11:33:37 | 000,001,540 | ---- | C] () -- C:\Windows\FF08_Render.ini [2013.03.03 11:33:37 | 000,000,159 | RH-- | C] () -- C:\Windows\ctfile.rfc [2013.03.03 11:30:10 | 000,046,993 | ---- | C] () -- C:\Windows\Ascd_log.ini [2013.03.03 11:29:28 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2013.03.03 11:29:24 | 000,033,927 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2013.03.03 11:27:34 | 000,001,409 | ---- | C] () -- C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2013.03.03 11:27:31 | 000,001,443 | ---- | C] () -- C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2013.03.03 11:23:24 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk [2013.03.03 11:23:14 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk [2013.03.03 11:19:16 | 2146,045,951 | -HS- | C] () -- C:\hiberfil.sys [2013.03.03 11:18:11 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK [2013.03.03 11:18:10 | 000,383,562 | RHS- | C] () -- C:\bootmgr [2012.11.21 14:10:20 | 003,123,272 | R--- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2012.06.11 17:50:16 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.06.11 17:50:16 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2012.05.02 13:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.03.03 17:10:40 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\DAEMON Tools Lite [2013.03.07 16:11:06 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\Dojotech Software [2013.03.06 09:55:00 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\Leadertech [2013.03.12 15:50:23 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\Origin [2013.03.14 20:47:25 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\Spotify [2013.03.15 23:39:49 | 000,000,000 | ---D | M] -- C:\Users\\AppData\Roaming\Theta ========== Purity Check ========== < End of report > _____________________________________________________________________________ Extra-Log OTL Extras logfile created on: 17.03.2013 11:42:47 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\\Downloads 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 8,00 Gb Total Physical Memory | 6,63 Gb Available Physical Memory | 82,87% Memory free 15,99 Gb Paging File | 14,34 Gb Available in Paging File | 89,67% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 420,60 Gb Total Space | 267,28 Gb Free Space | 63,55% Space Free | Partition Type: NTFS Drive D: | 976,56 Gb Total Space | 806,75 Gb Free Space | 82,61% Space Free | Partition Type: NTFS Drive E: | 6,51 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: -PC | User Name: | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = ChromeHTML] -- Reg Error: Key error. File not found ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0381FB27-6382-43EE-B8E1-16B0187CD447}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | "{0788976C-A0D8-4CC4-A9E6-1C6898151E53}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | "{17C7B2E0-5798-4820-AA64-9DEDC6B413EE}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | "{47B6C3F4-AF53-41C8-BCB2-9522E0285442}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\munkymo\day of defeat source\hl2.exe | "{47C3B3B9-7A75-4327-85C9-963BA5C68777}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{6A14CD21-1E34-4482-90AC-C4E9A3451341}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\munkymo\day of defeat source\hl2.exe | "{73C0AEBE-EE22-4BBF-BFB2-598D7D4D7B35}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sleepingdogs\hkship.exe | "{761A2A7B-CFD1-44DA-BFFA-8A80E258A6B9}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{9D2E2F3B-A620-4067-8696-A4F040CD5B62}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{BDE22F64-2B03-4D66-BE26-598F87246CAA}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sleepingdogs\hkship.exe | "{D219004E-0D14-4209-967F-6CF5DFA3083C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | "{D3772E24-2D9B-45D7-A6AD-D8F94881DD99}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | "{D7E2DD45-C27B-4FC6-A000-0FC125AF3737}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{EDE993E0-0063-49B7-BA57-1C382E17C8C6}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | "{F469F472-B516-4AC1-91D1-044BDD6D5EB5}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | "TCP Query User{2B5661D2-33E3-4EB3-B3D9-4EDF4732D166}C:\program files (x86)\ubisoft\far cry 3\bin\farcry3_d3d11.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\far cry 3\bin\farcry3_d3d11.exe | "TCP Query User{929F507A-E563-4791-8301-AACB49AFDFC5}C:\users\\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\\appdata\roaming\spotify\spotify.exe | "TCP Query User{FA262C67-5E10-4186-95EB-54EDA3DB1FCF}D:\games\assassins creed 3\ac3sp.exe" = protocol=6 | dir=in | app=d:\games\assassins creed 3\ac3sp.exe | "UDP Query User{2AA38EB9-6769-41D8-BEDD-8883EA1C67FB}C:\program files (x86)\ubisoft\far cry 3\bin\farcry3_d3d11.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\far cry 3\bin\farcry3_d3d11.exe | "UDP Query User{7DC3E670-415B-47DF-A304-92B939F4FB9F}C:\users\\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\max\appdata\roaming\spotify\spotify.exe | "UDP Query User{979BBA9C-2E4C-43AD-8326-27717BA0D5A1}D:\games\assassins creed 3\ac3sp.exe" = protocol=17 | dir=in | app=d:\games\assassins creed 3\ac3sp.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{06BBDE5E-6B09-36CD-B5C3-E537E3F49051}" = Microsoft .NET Framework 4.5 Extended Developer Preview "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{2C3E0F57-547A-3AF4-B6DB-2CA5969518D1}" = Microsoft .NET Framework 4.5 Client Profile Developer Preview "{3145731D-C578-70ED-899F-7A670D2A6662}" = AMD Fuel "{338CE2A1-7BD6-AC18-0069-4A90F7C3D836}" = AMD Steady Video Plug-In "{4975DE61-6BF6-B9BC-1FDE-C04C5EC78E4C}" = AMD Media Foundation Decoders "{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 "{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime "{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10 "{5E03A267-415E-5383-FA8F-3CE4145663B9}" = AMD Catalyst Install Manager "{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{82EE86D9-60B9-1025-9960-97E9B7C7B4B4}" = AMD Drag and Drop Transcoding "{89EE4A30-080F-2C95-6F78-C98D18FBD74D}" = AMD Accelerated Video Transcoding "{9CF11D16-ECEB-90A5-A028-CA9E068D848B}" = ccc-utility64 "{A2CB1ACB-94A2-32BA-A15E-7D80319F7589}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 "{AC53FC8B-EE18-3F9C-9B59-60937D0B182C}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 "{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 "Logitech Gaming Software" = Logitech Gaming Software 8.40 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4.5 Client Profile Developer Preview "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4.5 Extended Developer Preview "WinRAR archiver" = WinRAR 4.20 (64-Bit) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{017F8447-2A1D-0DDB-B5D7-CA2BFACE2886}" = CCC Help French "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{054E9A1C-3EA2-C657-E787-FD8DCF5C3D3B}" = CCC Help Czech "{1DE2BD51-0300-772D-5E18-F337D95D5687}" = CCC Help German "{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform "{224E8FEB-5C1F-077F-6FC5-602AC1AE644D}" = CCC Help Danish "{275E9C49-C72F-D754-DEB7-77F10A9C00D8}" = CCC Help Japanese "{2F73A7B2-E50E-39A6-9ABC-EF89E4C62E36}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 "{30049739-BE95-6591-B504-E6D7057D49CC}" = CCC Help Spanish "{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver "{3E7F5A51-7657-43D6-A9B3-C3A21473834B}_is1" = Far Cry 3 "{3F1EB155-F96E-EB7B-2EF2-7375490E0FA9}" = CCC Help English "{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX "{4B023D7B-9E67-795D-FB31-B5E1F6DCA451}" = CCC Help Italian "{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.2 "{55F6C486-8C75-2A72-DAFE-CE78A624C9F7}" = CCC Help Russian "{5AF23993-7152-1620-E43F-1B4542FB4F84}" = CCC Help Thai "{5BDA2F58-1F21-4D10-9910-92B01EBCC958}" = AMD USB Filter Driver "{63326924-3CAF-C858-3A8F-8598C87019D7}" = AMD VISION Engine Control Center "{63822E89-11AA-F8EC-D433-F72A85799EC0}" = CCC Help Greek "{66361420-4905-AEB8-17AE-172FDD164A7E}" = CCC Help Polish "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™ "{769F2A4B-84A3-9486-ADD2-9E5AB4B4E1E3}" = Catalyst Control Center InstallProxy "{818690C7-8DA5-4623-BBA8-A73CFBD44077}" = Sound Blaster X-Fi MB "{8773DD1C-5FB2-95B5-5A93-0EFEAC900A4D}" = CCC Help Norwegian "{8CCBB0BF-9CC1-1A65-BB93-56012A460EE6}" = CCC Help Portuguese "{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{A0A3CE05-96CB-52E9-434E-074F3BB7807E}" = CCC Help Turkish "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{A9C64319-932F-D02B-B14C-FFFC3EC49E77}" = CCC Help Chinese Standard "{ac3600d2-e1b3-4573-bef7-73f9409d6393}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 "{aec97477-921a-4289-985a-9e29506625b6}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 "{B5EB0EC0-7AD1-4A8F-B672-8E9F7A2738E6}_is1" = Crysis 3 "{C09DB932-7619-7B56-30E3-C0454811D6D7}" = CCC Help Korean "{C22A4697-BD77-ACB1-744F-1FD0A0BFF798}" = CCC Help Swedish "{D149DB2E-392E-48CC-8036-88BECC09C50A}" = Dojotech Spotify Recorder "{D4B457B2-260F-C561-CA87-703BD3B724CA}" = Catalyst Control Center Graphics Previews Common "{D6CDB506-297D-AE70-0EF6-DE5185F961BE}" = CCC Help Chinese Traditional "{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver "{D9198056-A296-4583-A790-C0E73694CFE8}" = D-Link DWA-131 Wireless N Nano USB Adapter "{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding "{ECFD508E-68A2-91B2-46DD-1D03D783D94B}" = Catalyst Control Center Localization All "{EDE361D5-35A5-DA7D-3462-C3DABD24029B}" = CCC Help Hungarian "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F1E7DD6A-AE2D-D706-BEB3-937F76CA6AE9}" = CCC Help Finnish "{F56F54DD-BCB2-1221-2CB7-E983A5CF9D15}" = CCC Help Dutch "{FDB30193-FDA0-3DAA-ACCA-A75EEFE53607}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 "AIDA64 Extreme Edition_is1" = AIDA64 Extreme Edition v2.80 "Avira AntiVir Desktop" = Avira Free Antivirus "Battlelog Web Plugins" = Battlelog Web Plugins "CrystalDiskInfo_is1" = CrystalDiskInfo 5.4.2 "DAEMON Tools Lite" = DAEMON Tools Lite "ESN Sonar-0.70.4" = ESN Sonar "EVEREST Home Edition_is1" = EVEREST Home Edition v2.20 "Fraps" = Fraps "Google Chrome" = Google Chrome "InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager "InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver "Marvell Miniport Driver" = Marvell Miniport Driver "Origin" = Origin "PunkBusterSvc" = PunkBuster Services "Steam App 202170" = Sleeping Dogs™ "Steam App 240" = Counter-Strike: Source "Steam App 260" = Counter-Strike: Source Beta "Steam App 300" = Day of Defeat: Source "Steam App 320" = Half-Life 2: Deathmatch "Steam App 340" = Half-Life 2: Lost Coast "Tomb Raider_is1" = Tomb Raider "Uplay" = Uplay ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Spotify" = Spotify ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 06.03.2013 04:16:02 | Computer Name = Max-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0, Zeitstempel: 0x4fd626ed Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0, Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1 ID des fehlerhaften Prozesses: 0x588 Startzeit der fehlerhaften Anwendung: 0x01ce1a42b352f2b2 Pfad der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe Pfad des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll Berichtskennung: 14e61e8c-8636-11e2-bb22-bcaec5288f25 Error - 06.03.2013 04:47:41 | Computer Name = -PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 0.0.0.0, Zeitstempel: 0x4fd626ed Name des fehlerhaften Moduls: Device.dll, Version: 0.0.0.0, Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1 ID des fehlerhaften Prozesses: 0x5a0 Startzeit der fehlerhaften Anwendung: 0x01ce1a430c552580 Pfad der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe Pfad des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll Berichtskennung: 813b24f9-863a-11e2-b6a5-bcaec5288f25 Error - 12.03.2013 09:52:30 | Computer Name = -PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: Setup.exe_Origin, Version: 9.1.13.85, Zeitstempel: 0x4f29728a Name des fehlerhaften Moduls: System.dll, Version: 0.0.0.0, Zeitstempel: 0x4ebd6eed Ausnahmecode: 0xc0000005 Fehleroffset: 0x000018cb ID des fehlerhaften Prozesses: 0x850 Startzeit der fehlerhaften Anwendung: 0x01ce1f28c8539e8f Pfad der fehlerhaften Anwendung: C:\Users\\AppData\Local\Temp\Origin\Setup.exe Pfad des fehlerhaften Moduls: C:\Users\\AppData\Local\Temp\Origin\nsxEE17.tmp\System.dll Berichtskennung: 1466a6f3-8b1c-11e2-848a-bcaec5288f25 Error - 17.03.2013 06:17:12 | Computer Name = -PC | Source = ESENT | ID = 482 Description = Catalog Database (1148) Catalog Database: Versuch, in Datei "C:\Windows\system32\CatRoot2\edb.chk" bei Offset 0 (0x0000000000000000) für 4096 (0x00001000) Bytes zu schreiben, ist nach 8 Sekunden mit Systemfehler 1117 (0x0000045d): "Die Anforderung konnte wegen eines E/A-Gerätefehlers nicht ausgeführt werden. " fehlgeschlagen. Fehler -1022 (0xfffffc02) bei Schreiboperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden. Error - 17.03.2013 06:17:14 | Computer Name = -PC | Source = ESENT | ID = 439 Description = Catalog Database (1148) Catalog Database: Die Shadowkopfzeile für Datei C:\Windows\system32\CatRoot2\edb.chk konnte nicht geschrieben werden. Fehler -1022. Error - 17.03.2013 06:17:14 | Computer Name = -PC | Source = ESENT | ID = 454 Description = Catalog Database (1148) Catalog Database: Bei Datenbankwiederherstellung trat ein unerwarteter Fehler -510 auf. Error - 17.03.2013 06:17:17 | Computer Name = -PC | Source = Microsoft-Windows-CAPI2 | ID = 257 Description = Vom Kryptografiedienst konnte die Katalogdatenbank nicht initialisiert werden. "ESENT"-Fehler: -510. Error - 17.03.2013 06:34:57 | Computer Name = -PC | Source = ESENT | ID = 419 Description = Catalog Database (1148) Catalog Database: Seite 2017 der Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb konnte nicht gelesen werden. Fehler -1018. Error - 17.03.2013 06:34:57 | Computer Name = -PC | Source = ESENT | ID = 454 Description = Catalog Database (1148) Catalog Database: Bei Datenbankwiederherstellung trat ein unerwarteter Fehler -1018 auf. Error - 17.03.2013 06:34:57 | Computer Name = -PC | Source = Microsoft-Windows-CAPI2 | ID = 257 Description = Vom Kryptografiedienst konnte die Katalogdatenbank nicht initialisiert werden. "ESENT"-Fehler: -1018. [ System Events ] Error - 15.03.2013 17:44:24 | Computer Name = -PC | Source = EventLog | ID = 6008 Description = Das System wurde zuvor am ?15.?03.?2013 um 17:00:28 unerwartet heruntergefahren. Error - 16.03.2013 05:29:36 | Computer Name = -PC | Source = EventLog | ID = 6008 Description = Das System wurde zuvor am ?15.?03.?2013 um 23:55:14 unerwartet heruntergefahren. Error - 16.03.2013 06:58:05 | Computer Name = -PC | Source = EventLog | ID = 6008 Description = Das System wurde zuvor am ?16.?03.?2013 um 11:40:57 unerwartet heruntergefahren. Error - 16.03.2013 07:59:19 | Computer Name = -PC | Source = EventLog | ID = 6008 Description = Das System wurde zuvor am ?16.?03.?2013 um 12:44:25 unerwartet heruntergefahren. Error - 16.03.2013 08:01:45 | Computer Name = -PC | Source = Service Control Manager | ID = 7023 Description = Der Dienst "Sicherheitscenter" wurde mit folgendem Fehler beendet: %%1747 Error - 16.03.2013 08:01:47 | Computer Name = -PC | Source = Service Control Manager | ID = 7023 Description = Der Dienst "Windows Update" wurde mit folgendem Fehler beendet: %%-2147467243 Error - 17.03.2013 06:15:25 | Computer Name = -PC | Source = EventLog | ID = 6008 Description = Das System wurde zuvor am ?17.?03.?2013 um 11:11:12 unerwartet heruntergefahren. Error - 17.03.2013 06:15:59 | Computer Name = -PC | Source = Service Control Manager | ID = 7011 Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AMD External Events Utility erreicht. Error - 17.03.2013 06:16:29 | Computer Name = -PC | Source = Service Control Manager | ID = 7011 Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AudioEndpointBuilder erreicht. Error - 17.03.2013 06:33:14 | Computer Name = -PC | Source = EventLog | ID = 6008 Description = Das System wurde zuvor am ?17.?03.?2013 um 11:27:56 unerwartet heruntergefahren. < End of report > Mein System: CPU: AMD Phaenom II X6 1090T GPU: Radeon HD 7970 Ram: 8gb DDR3 1333 Mainboard: Asus Crosshair IV Formular Vielen Dank im voraus. |
| Themen zu PC hängt sich ständig beim gaming auf! Verdacht auf Virus! |
| antivir, autorun, avg, avira, bho, booten, desktop, explorer, firefox, google, home, hängt, install.exe, launch, logfile, ntdll.dll, plug-in, problem, prozess, realtek, registry, security, sekunden, software, spielen, spotify web helper, system hängt, taskmanager, temp, udp, unerwarteter fehler, usb, verdacht auf virus, virus |
Baum-Darstellung