| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: 'Verdächtiges Verhalten' HIPS/RegMod-014Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
28.06.2013, 14:41
| #1 |
| |  'Verdächtiges Verhalten' HIPS/RegMod-014 Hallo, Vor zwei Tagen habe ich eine verdächtige Mail erhalten, von wegen letzte Mahnung etc. für etwas, dass ich nie Bestellt habe. Im Anhang war eine Datei, die angeblich irgendwelche Rechnungsinformationen enthalten sollte. Da ich grade erst aufgestanden und noch ziemlich müde war, hab ich mir nichts dabei gedacht den Anhang zu öffnen und mal zu schauen was Sache ist. Der Anhang war eine .zip-Datei, welche eine weitere .zip-Datei enthielt. Darin war eine MS-DOS-Ausführungsdatei, welche ich dummerweise ausgeführt habe. Kurz darauf kam jedoch eine Meldung, dass die Datei nicht ausgeführt werden konnte. Ich habe dann direkt im Anschluß einen Scan über meinen Computer laufen lassen, bei dem nichts gefunden wurde. Seit heute bekomme ich aber andauernd von Sophos die Meldung: "'Verdächtiges Verhalten' HIPS/RegMod-014 [...]". Habe vorhin noch mal einen Scan durchgeführt, bei dem nichts gefunden wurde, ich weis allerdings nicht was ich mit der Datei in Quarantäne anstellen soll. Einzige mögliche Maßnahme, die mir vorgeschlagen wird, ist Zulassen... OTL.txt Code:
ATTFilter OTL logfile created on: 28.06.2013 2:13:55 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Connor\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 0,69 Gb Available Physical Memory | 34,69% Memory free 4,00 Gb Paging File | 2,70 Gb Available in Paging File | 67,63% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,75 Gb Total Space | 245,12 Gb Free Space | 52,63% Space Free | Partition Type: NTFS Computer Name: CONNOR-PC | User Name: Connor | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.28 14:12:35 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Connor\Desktop\OTL.exe PRC - [2013.05.04 18:07:01 | 000,216,968 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler.exe PRC - [2013.04.25 10:56:23 | 002,890,232 | ---- | M] (Sophos Limited) -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe PRC - [2013.03.26 17:43:31 | 000,555,408 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe PRC - [2013.03.17 14:12:36 | 000,237,048 | ---- | M] (Sophos Limited) -- C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe PRC - [2013.03.17 14:12:35 | 000,929,272 | ---- | M] (Sophos Limited) -- C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe PRC - [2013.03.17 14:10:55 | 000,217,592 | ---- | M] (Sophos Limited) -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe PRC - [2013.03.17 14:08:42 | 000,159,296 | ---- | M] (Sophos Limited) -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe PRC - [2013.02.05 17:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe PRC - [2012.12.07 20:04:20 | 003,093,624 | ---- | M] () -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe PRC - [2012.11.12 17:56:20 | 000,357,400 | ---- | M] (Sophos Limited) -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe PRC - [2012.10.03 00:21:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.10.02 14:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe ========== Modules (No Company Name) ========== MOD - [2012.12.07 20:04:20 | 003,093,624 | ---- | M] () -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe MOD - [2012.11.28 15:13:52 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012.11.28 15:13:30 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ========== Services (SafeList) ========== SRV - [2013.06.12 12:43:53 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.06.07 00:06:24 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2013.05.26 21:37:43 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.15 12:08:44 | 002,467,664 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2013.04.25 10:56:23 | 002,890,232 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service) SRV - [2013.03.26 17:43:31 | 000,555,408 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe -- (vpnagent) SRV - [2013.03.17 14:12:36 | 000,237,048 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service) SRV - [2013.03.17 14:10:55 | 000,217,592 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService) SRV - [2013.03.17 14:08:42 | 000,159,296 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService) SRV - [2013.03.17 14:07:15 | 002,010,688 | ---- | M] (Sophos Limited) [Auto | Stopped] -- C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe -- (swi_update_64) SRV - [2013.02.05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService) SRV - [2012.11.12 17:56:20 | 000,357,400 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe -- (Sophos Web Control Service) SRV - [2012.10.03 00:21:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.10.02 14:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.03.26 17:18:20 | 000,112,080 | R--- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acsock64.sys -- (acsock) DRV:64bit: - [2013.03.17 14:11:38 | 000,154,952 | ---- | M] (Sophos Limited) [File_System | System | Running] -- C:\Windows\SysNative\drivers\savonaccess.sys -- (SAVOnAccess) DRV:64bit: - [2012.12.12 22:34:26 | 000,303,616 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt) DRV:64bit: - [2012.12.12 22:34:23 | 000,035,328 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt) DRV:64bit: - [2012.12.12 18:43:47 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2012.11.12 17:56:50 | 000,036,640 | ---- | M] (Sophos Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdcfilter.sys -- (sdcfilter) DRV:64bit: - [2012.11.12 17:54:07 | 000,025,608 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\SophosBootDriver.sys -- (SophosBootDriver) DRV:64bit: - [2012.10.13 05:41:14 | 000,027,384 | ---- | M] (Xilinx, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\xpc4drvr.sys -- (XilinxPC4Driver) DRV:64bit: - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2012.08.03 21:38:55 | 000,027,048 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpnva64.sys -- (vpnva) DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2009.07.14 03:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2009.07.14 03:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.20 04:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2005.03.29 02:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com/?utm_source=b&utm_medium=fox&from=fox&uid=67190_16910336_582557_3219913727_48BBB9EF&ts=1352736092 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com/?utm_source=b&utm_medium=fox&from=fox&uid=67190_16910336_582557_3219913727_48BBB9EF&ts=1352736092 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F0 CA DE 40 DB C0 CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.v9.com/web/?q={searchTerms} IE - HKCU\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = hxxp://search.v9.com/web/?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.order.1: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "about:home" FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.8 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.2: C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.11.17 19:08:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Connor\AppData\Roaming\mozilla\Extensions [2013.06.07 20:38:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Connor\AppData\Roaming\mozilla\Firefox\Profiles\ponxn9ut.default\extensions [2013.04.07 23:40:21 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Connor\AppData\Roaming\mozilla\Firefox\Profiles\ponxn9ut.default\extensions\ich@maltegoetz.de [2013.05.08 19:24:10 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Connor\AppData\Roaming\mozilla\firefox\profiles\ponxn9ut.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.02.25 19:23:33 | 000,002,259 | ---- | M] () -- C:\Users\Connor\AppData\Roaming\mozilla\firefox\profiles\ponxn9ut.default\searchplugins\gronkh-wiki-de.xml [2013.06.12 14:52:43 | 000,008,285 | ---- | M] () -- C:\Users\Connor\AppData\Roaming\mozilla\firefox\profiles\ponxn9ut.default\searchplugins\jedipedia-de.xml [2013.01.16 21:50:36 | 000,001,020 | ---- | M] () -- C:\Users\Connor\AppData\Roaming\mozilla\firefox\profiles\ponxn9ut.default\searchplugins\league-of-legends-wiki-en.xml [2013.06.17 13:37:22 | 000,002,754 | ---- | M] () -- C:\Users\Connor\AppData\Roaming\mozilla\firefox\profiles\ponxn9ut.default\searchplugins\leaguepedia--league-of-legends-wiki-en.xml [2012.11.20 16:52:00 | 000,002,271 | ---- | M] () -- C:\Users\Connor\AppData\Roaming\mozilla\firefox\profiles\ponxn9ut.default\searchplugins\minecraft-wiki-de.xml [2012.11.20 16:51:44 | 000,002,765 | ---- | M] () -- C:\Users\Connor\AppData\Roaming\mozilla\firefox\profiles\ponxn9ut.default\searchplugins\pokwiki-de.xml [2013.05.26 21:37:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013.05.26 21:37:44 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}, CHR - homepage: CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\pdf.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - Extension: Click to activate/deactivate ProxTube = C:\Users\Connor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.0_0\ CHR - Extension: Google Drive = C:\Users\Connor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: YouTube = C:\Users\Connor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\Connor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: AdBlock = C:\Users\Connor\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.61_0\ CHR - Extension: Proxy Tool = C:\Users\Connor\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijblflkdjdopkpdgllkmlbgcffjbnfda\1.0.1_0\ CHR - Extension: No name found = C:\Users\Connor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam\2.2.2012.272_0\ CHR - Extension: Google Mail = C:\Users\Connor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Proxy Help) - {F386E548-C533-472E-8C61-C026FB14FEA9} - C:\Windows\SysWOW64\Newtabs_v9.dll (Newtabs. inc) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [MPlayerForWindows_UpdateReminder] C:\Program Files (x86)\MPlayer für Windows\AutoUpdate.exe () O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe (Sophos Limited) O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe () O4 - HKCU..\Run: [winjj] C:\Users\Connor\AppData\Roaming\winjj.exe () O4 - HKCU..\Run: [xneeemyu] C:\Users\Connor\AppData\Local\Temp\Gownx\qmgipemyu.exe (AnVir Software) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited) O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1E9D72EB-1403-41DF-8B52-68CCBEE907DF}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E8677560-26BD-4D24-9BA1-F1A8AF509861}: DhcpNameServer = 192.168.178.1 O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL) - C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL (Sophos Limited) O20 - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Limited) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.06.28 14:12:28 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Connor\Desktop\OTL.exe [2013.06.28 13:05:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2013.06.20 19:34:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games [2013.06.20 19:32:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Games [2013.06.07 19:48:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Amazon [2013.06.07 19:37:55 | 000,000,000 | ---D | C] -- C:\Users\Connor\AppData\Roaming\WordToPDF [2013.06.06 19:12:05 | 000,000,000 | ---D | C] -- C:\Users\Connor\Desktop\Bewerbungen [2013.06.02 19:33:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2013.06.01 13:41:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi [2013.06.01 13:41:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi [2013.06.01 13:17:48 | 000,000,000 | ---D | C] -- C:\Users\Connor\AppData\Local\QfG [2013.06.01 13:17:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QfG [2013.06.01 00:44:28 | 000,000,000 | ---D | C] -- C:\Users\Connor\AppData\Roaming\TeamViewer [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.06.28 14:12:35 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Connor\Desktop\OTL.exe [2013.06.28 14:12:07 | 000,000,168 | ---- | M] () -- C:\Users\Connor\defogger_reenable [2013.06.28 14:12:01 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.06.28 14:10:55 | 000,050,477 | ---- | M] () -- C:\Users\Connor\Desktop\Defogger.exe [2013.06.28 13:43:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.06.28 12:30:27 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.28 12:30:27 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.28 12:23:46 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.06.28 12:22:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.06.28 12:22:45 | 1609,474,048 | -HS- | M] () -- C:\hiberfil.sys [2013.06.20 20:56:08 | 001,291,819 | ---- | M] () -- C:\Users\Connor\Unbenannt 1.odt [2013.06.20 20:56:06 | 000,000,102 | -H-- | M] () -- C:\Users\Connor\.~lock.Unbenannt 1.odt# [2013.06.14 20:39:30 | 000,000,219 | ---- | M] () -- C:\Users\Connor\Desktop\Dota 2.url [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.06.28 14:12:07 | 000,000,168 | ---- | C] () -- C:\Users\Connor\defogger_reenable [2013.06.28 14:10:51 | 000,050,477 | ---- | C] () -- C:\Users\Connor\Desktop\Defogger.exe [2013.06.20 20:56:06 | 000,000,102 | -H-- | C] () -- C:\Users\Connor\.~lock.Unbenannt 1.odt# [2013.06.20 20:55:55 | 001,291,819 | ---- | C] () -- C:\Users\Connor\Unbenannt 1.odt [2013.06.14 20:39:30 | 000,000,219 | ---- | C] () -- C:\Users\Connor\Desktop\Dota 2.url [2013.04.11 23:53:30 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2013.02.11 18:21:51 | 001,588,294 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013.01.24 21:35:33 | 000,056,320 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll [2013.01.23 15:56:38 | 000,000,036 | ---- | C] () -- C:\Users\Connor\.org.eclipse.epp.usagedata.recording.userId [1601.01.01 02:00:00 | 000,254,976 | ---- | C] () -- C:\Users\Connor\AppData\Roaming\winjj.exe ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.06.12 21:53:52 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\.minecraft [2013.04.11 21:40:50 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\com.shirogames.evoland [2012.12.12 18:22:25 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\DAEMON Tools Lite [2013.06.07 22:38:22 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\Dropbox [2012.11.15 15:53:59 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\gnupg [2012.12.12 18:22:26 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\LolClient [2013.04.12 13:48:12 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\OpenOffice.org [2013.01.20 22:14:06 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\Origin [2013.03.27 14:40:45 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\Racket [2013.06.01 00:44:28 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\TeamViewer [2013.06.25 00:32:59 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\TS3Client [2013.06.07 19:37:57 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\WordToPDF [2013.01.03 18:25:55 | 000,000,000 | ---D | M] -- C:\Users\Connor\AppData\Roaming\Xilinx ========== Purity Check ========== < End of report > Extras.txt Code:
ATTFilter OTL Extras logfile created on: 28.06.2013 2:13:55 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Connor\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 0,69 Gb Available Physical Memory | 34,69% Memory free
4,00 Gb Paging File | 2,70 Gb Available in Paging File | 67,63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,75 Gb Total Space | 245,12 Gb Free Space | 52,63% Space Free | Partition Type: NTFS
Computer Name: CONNOR-PC | User Name: Connor | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
"" =
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{26F21071-02BB-4355-9081-5F6D9EAE6969}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{323E7821-8289-4910-98F2-26CC70C1292E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5A0D4D01-2DA7-4E49-BAA5-E2998B45BF84}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{65C07354-EEA9-4A1F-A8B5-E66389B0C3DC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8BDE6552-E81E-4D91-9776-08A8978B1E8F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9A2C6AE0-7997-431B-B36E-4E15745FB6D8}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{A3CD0EAE-C233-4052-88A8-BECC7BDEEFED}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B66208F4-288D-4E23-8A10-2DB59C4E5B1B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C7F449DF-95FD-4676-B9D1-B6C522C6247A}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{F50D33CF-B802-41D9-B1CE-663FA3C73EEC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0145FDDC-7E8D-4995-A3E7-517CB8AACDF6}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe |
"{0316A857-6234-4623-B04E-8BEBA9AAB46D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magicka\magicka.exe |
"{04B4D27E-0F50-4536-B03F-6A33BBF9D520}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{05A379F5-5FF1-4954-89E7-ACBD410EAB2C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magic 2013\dotp_d13.exe |
"{0C1CFF79-0D0A-4EBF-A497-DF45C3F69312}" = protocol=6 | dir=in | app=c:\users\connor\appdata\roaming\dropbox\bin\dropbox.exe |
"{0C537C84-CEE9-47DA-8BC2-7E7075E487CB}" = protocol=17 | dir=in | app=c:\xilinx\14.3\ise_ds\ise\bin\nt64\unwrapped\isimgui.exe |
"{14EE1F35-01B2-4611-BAAF-AECA745ED2CC}" = protocol=6 | dir=in | app=c:\program files (x86)\unreal tournament 3\binaries\ut3.exe |
"{158D4DBB-E37B-4168-841E-9F6C554F875D}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\bioware\star wars-the old republic\launcher.exe |
"{2634728B-4F6E-4D2B-8B37-571D6F899372}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe |
"{28015D42-B85C-42D2-8F91-A89042E62654}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{2897CBDC-76E7-44BB-96A9-97FCBE2AE0B2}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magicka\magicka.exe |
"{31D96EDB-0C5B-491B-B057-C471223B7317}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\portal 2\portal2.exe |
"{34AAE6F3-9A32-4C8A-B087-22E120D1655E}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\simcity\simcity\simcity.exe |
"{3504BFEA-1759-4403-95F9-7B450EAED725}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{39F37456-2B31-4057-9B34-691643060A3D}" = protocol=6 | dir=in | app=c:\program files (x86)\lolreplay\lolreplay.exe |
"{3D0069E7-49D2-4CB4-9370-1B19D4900170}" = protocol=17 | dir=in | app=c:\users\connor\appdata\roaming\dropbox\bin\dropbox.exe |
"{3D75A7B9-8E23-4267-8865-7C16535AB30C}" = protocol=6 | dir=in | app=c:\users\connor\appdata\roaming\dropbox\bin\dropbox.exe |
"{3E5A5807-A5ED-4349-B84D-4134F4838088}" = protocol=6 | dir=in | app=c:\program files (x86)\qfg\crackedsteam\greenluma.exe |
"{3EBE2DBF-96AE-4A62-9737-86C0BF8B843D}" = protocol=17 | dir=in | app=c:\program files (x86)\qfg\crackedsteam\greenluma.exe |
"{3EDF7C29-E648-44EE-A145-8084E00B085D}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe |
"{3FD4D30E-EB87-48BF-A1D3-4EB997DA407E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magic 2013\dotp_d13.exe |
"{49E099A8-D5FC-4749-99AB-93EA6258557A}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{4B00855F-64DA-4949-A041-FDDF394EC246}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the walking dead\walkingdead101.exe |
"{4C690A0E-DD7C-4A89-90BA-D9E850B1B018}" = protocol=6 | dir=in | app=c:\xilinx\14.3\ise_ds\ise\bin\nt64\unwrapped\isimgui.exe |
"{52A37350-60C8-4D9F-843D-13350D20C532}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{5319993A-73CB-4646-BF47-52886A0D5829}" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"{55181952-8CD0-405F-9FD2-28E5622A2570}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe |
"{55FFB512-4E04-43D3-83C8-F8BDC9F129F0}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{580B0FBA-357E-4013-8C96-F65EFF6BF94C}" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"{59D64EF3-1CE4-43D9-9161-F2BE28EA1891}" = protocol=6 | dir=in | app=c:\windows\system32\javaw.exe |
"{5A59D2E7-FBAD-495F-90DF-EB32630D0FDF}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{5BDA89D0-FA2C-440E-B401-F17961FB02B9}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{5C0DA79A-5967-439C-B7F5-9D122097E9B9}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe |
"{5E9D202A-9F21-472A-88BF-AA71F2434E8F}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\simcity\simcity\simcity.exe |
"{5F9C8341-D30B-4724-8391-26FDEE469F43}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe |
"{615ADD6D-07DD-4DE9-A978-C5A48373B44A}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{62455EA7-9EA9-4288-9A2B-02CF0311200B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{6502FC07-010C-4EDE-A5D9-E9DA9D743968}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe |
"{65F95D66-0CAC-4A1C-98AA-B0515136122A}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{67692B10-0B91-4F89-8F4C-5922A8E764EE}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\bioware\star wars-the old republic\launcher.exe |
"{67B84A1F-B017-40E1-A550-CEDFFCD27373}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the binding of isaac\isaac.exe |
"{68264014-ADC2-45AF-A5AE-9013E6E41E71}" = protocol=17 | dir=in | app=c:\program files (x86)\unreal tournament 3\binaries\ut3.exe |
"{6B0AD548-8DCC-4CB5-8D5B-08C50F35F074}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{6B4BF8E8-A745-444A-A8C8-A61CD6852AAB}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the witcher 2\launcher.exe |
"{6C58AD63-9968-438A-AFC8-B9947F8216E1}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{6E99A1AF-6700-41BD-83F0-AFE01263AA38}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\bioware\star wars-the old republic\launcher.exe |
"{718971BE-B59E-4E64-BC8A-0FC03371B372}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magic 2013\dotp_d13.exe |
"{7737AD48-6E9A-4A62-A278-FC33E442203D}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe |
"{7D3AA3A1-36AD-4284-9F6F-DCEC708E575F}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\bioware\star wars-the old republic\launcher.exe |
"{7D4ACB7E-6F84-4F09-8F18-30B05F0FFE9A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the walking dead\walkingdead101.exe |
"{8230E357-0BAF-4441-863D-90C3BD3DB64D}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe |
"{8C8CD4A4-8271-444E-877F-F32EBF586B99}" = protocol=58 | dir=in | app=system |
"{978C846C-394A-4627-BCB7-364F2CA0F108}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{9917F36F-F12F-4198-95F5-BF4448F557CC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the binding of isaac\isaac.exe |
"{9CE35900-C91B-404A-84B8-AFBEF90E32BE}" = protocol=17 | dir=in | app=c:\users\connor\appdata\roaming\dropbox\bin\dropbox.exe |
"{ABC6046F-4928-44D9-A666-88B4195438A2}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magic 2013\dotp_d13.exe |
"{B1AD7FE5-196A-40F9-8012-481EEF77D549}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{B4D0FF7E-ABF1-4CD9-8BD2-888D9BCCFBAD}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the witcher 2\launcher.exe |
"{C4B5B10D-E138-412F-8059-1426624C79B5}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{CEAE3B11-D7E1-4361-9A57-E5560F09B3CC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{D003C29F-2134-4DBB-96AC-45458075952B}" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"{D0ECA8B5-819A-4AAA-A31D-55FBB2496E72}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D85A8C7A-2B3C-4CD7-8D76-7CD2930AC606}" = protocol=17 | dir=in | app=c:\program files (x86)\lolreplay\lolreplay.exe |
"{DA088138-6C55-4054-9D5F-36A363EE5346}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{DB1D5DDA-9A3C-4627-AA88-B8458DC14708}" = protocol=17 | dir=in | app=c:\windows\system32\javaw.exe |
"{E2896A91-FF7B-4FB5-9D03-83F35DC9F361}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\portal 2\portal2.exe |
"{E2D18923-4276-40D9-893C-8642AEE1E27A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the walking dead\walkingdead101.exe |
"{E82BBE6E-7D2C-4B38-82D3-1962A2BF12FB}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the walking dead\walkingdead101.exe |
"{F86A8C3D-EC21-48BB-9EEB-AAFFACC981BF}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{FB2F95B3-405D-4B72-A890-2AED2965912B}" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{0200A5FF-D178-4DED-A87A-A5E18DE0FA89}C:\windows\system32\javaw.exe" = protocol=6 | dir=in | app=c:\windows\system32\javaw.exe |
"TCP Query User{091A5D66-8D9D-4A38-A938-DDC42C57B0CF}C:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe |
"TCP Query User{1102DF2C-1D27-4A7B-BF40-9CE843273A16}C:\program files (x86)\lolreplay\lolreplay.exe" = protocol=6 | dir=in | app=c:\program files (x86)\lolreplay\lolreplay.exe |
"TCP Query User{19232D54-7D7D-45F7-BE2B-89E04A37BB43}C:\program files (x86)\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe |
"TCP Query User{2928B49D-A409-4CA9-B27C-1725D7CAD573}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"TCP Query User{4113ED5A-F6F5-48F9-A673-98B73447A48D}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe |
"TCP Query User{48736439-D9AA-48D4-A73B-6DBAD1E1BF0E}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{524B24ED-E51B-40F1-B74F-72716158AF0E}C:\program files (x86)\unreal tournament 3\binaries\ut3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\unreal tournament 3\binaries\ut3.exe |
"TCP Query User{532C5B70-204A-4F60-8A79-A8F5A9E5C19B}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe |
"TCP Query User{60EE2644-9743-423D-8F40-BCD4DD7CB6F6}C:\windows\syswow64\msiexec.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"TCP Query User{66A7F1E5-0659-44BB-8C87-174B525831BD}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe |
"TCP Query User{6F637334-F9E2-4B74-A0CA-4AC35A2619F2}C:\users\connor\crysis wars\bin32\crysis.exe" = protocol=6 | dir=in | app=c:\users\connor\crysis wars\bin32\crysis.exe |
"TCP Query User{71B4518A-4090-49D6-ACFF-5CB95067952B}C:\program files (x86)\cossacks - back to war\dmcr.exe" = protocol=6 | dir=in | app=c:\program files (x86)\cossacks - back to war\dmcr.exe |
"TCP Query User{DFDFD34E-642C-4A8C-B22D-5A22B693A799}C:\xilinx\14.3\ise_ds\ise\bin\nt64\unwrapped\isimgui.exe" = protocol=6 | dir=in | app=c:\xilinx\14.3\ise_ds\ise\bin\nt64\unwrapped\isimgui.exe |
"TCP Query User{EBB09058-E6FE-4759-97E7-2F56142098C3}C:\windows\syswow64\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\dplaysvr.exe |
"UDP Query User{169B8D5D-95C5-4D6D-B96B-B15082936FF7}C:\users\connor\crysis wars\bin32\crysis.exe" = protocol=17 | dir=in | app=c:\users\connor\crysis wars\bin32\crysis.exe |
"UDP Query User{3BDE2190-0BB1-4920-9448-75285CFCCF93}C:\windows\syswow64\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\dplaysvr.exe |
"UDP Query User{4923A063-4EC0-49E4-A7DC-79CE7598CAC4}C:\windows\syswow64\msiexec.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"UDP Query User{4EB143FE-7BCE-4AC5-8400-C9580BA6FDE4}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{5E697833-A2A6-49D4-ABE3-AA479BA04C86}C:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe |
"UDP Query User{6F17BB9B-32A0-42EB-8AD1-EB728B48EB02}C:\program files (x86)\cossacks - back to war\dmcr.exe" = protocol=17 | dir=in | app=c:\program files (x86)\cossacks - back to war\dmcr.exe |
"UDP Query User{6FCEDD57-77FC-47C2-A2C6-D347BC3DFF3E}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe |
"UDP Query User{718EA40C-46D3-4D75-95AF-37120859711E}C:\xilinx\14.3\ise_ds\ise\bin\nt64\unwrapped\isimgui.exe" = protocol=17 | dir=in | app=c:\xilinx\14.3\ise_ds\ise\bin\nt64\unwrapped\isimgui.exe |
"UDP Query User{7F7C519D-4D86-44B9-9B59-D5D10AB0D7D1}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe |
"UDP Query User{83F43FC3-E228-4B19-959B-ABE06B08D006}C:\program files (x86)\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe |
"UDP Query User{94D0DCAC-D9E9-4582-91E6-4A4864158F47}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{B0E0A91C-E5A4-43C0-A5E9-B71EEBE42898}C:\program files (x86)\lolreplay\lolreplay.exe" = protocol=17 | dir=in | app=c:\program files (x86)\lolreplay\lolreplay.exe |
"UDP Query User{C356EB28-4E90-402B-9D51-3CDCDA85C9A2}C:\program files (x86)\unreal tournament 3\binaries\ut3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\unreal tournament 3\binaries\ut3.exe |
"UDP Query User{F4FB5BDB-0C38-4138-BC07-F3F89C87294E}C:\windows\system32\javaw.exe" = protocol=17 | dir=in | app=c:\windows\system32\javaw.exe |
"UDP Query User{F634F9FB-31DD-4A1A-97A5-D5C92E9C76C7}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{0E5D76AD-A3FB-48D5-8400-8903B10317D3}" = iTunes
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417011FF}" = Java 7 Update 11 (64-bit)
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{64A3A4F4-B792-11D6-A78A-00B0D0170110}" = Java SE Development Kit 7 Update 11 (64-bit)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}" = Apple Mobile Device Support
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"WinRAR archiver" = WinRAR 4.20 (64-Bit)
"Xilinx Design Tools ISE WebPACK 14.3" = Xilinx Design Tools ISE WebPACK 14.3 (C:\Xilinx\14.3\ISE_DS)
"Xilinx Design Tools Xilinx Documentation Navigator - Standalone Installation" = Xilinx Design Tools Xilinx Documentation Navigator - Standalone Installation 14.3 (C:\Xilinx\DocNav)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08A25478-C5DD-4EA7-B168-3D687CA987FF}" = Die Sims™ 3 Traumsuite-Accessoires
"{117B6BF6-82C3-420C-B284-9247C8568E53}" = Die Sims™ 3 Design-Garten-Accessoires
"{15C418EB-7675-42be-B2B3-281952DA014D}" = Sophos AutoUpdate
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1C9B6173-6DC9-4EEE-9EFC-6BA115CFBE43}" = Die Sims™ 3 Diesel Accessoires
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{350612EB-55FE-47DC-8E07-197B2409909B}" = Cisco AnyConnect Secure Mobility Client
"{3B11D799-48E0-48ED-BFD7-EA655676D8BB}" = Star Wars: The Old Republic
"{3BBFD444-5FAB-49F6-98B1-A1954E831399}" = Die Sims™ 3 Showtime
"{45057FCE-5784-48BE-8176-D9D00AF56C3C}" = Die Sims™ 3 Late Night
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5BBB8682-1335-410F-A79F-8E5611A54BD0}_is1" = Game Dev Tycoon Version 1.3.9
"{71828142-5A24-4BD0-97E7-976DA08CE6CF}" = Die Sims™ 3 Luxus-Accessoires
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B11296A-F894-449C-8DF6-6AAAA7D4D118}" = Die Sims™ 3 Stadt-Accessoires
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89173B88-384A-459B-B687-9C0BBC934EF4}" = Die*Sims™*3 Erstelle einen Sim
"{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = Die Sims™ 3 Traumkarrieren
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}" = Sophos Anti-Virus
"{9B2506E3-9A3F-45B5-96BF-509CAD584650}" = Die Sims™ 3 Katy Perry Süße Welt
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{B38A2633-A298-495F-A9C0-0B499835CD95}" = Cisco AnyConnect Diagnostics and Reporting Tool
"{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}" = Die Sims™ 3 Reiseabenteuer
"{BFA90209-7AFF-4DB6-8E4B-E57305751AD7}" = Unreal Tournament 3
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C12631C6-804D-4B32-B0DD-8A496462F106}" = Die Sims™ 3 Einfach tierisch
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{DB9E4EAB-2717-499F-8D56-4CC8A644AB60}" = MPlayer für Windows (Full Package)
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}" = Die Sims™ 3 Lebensfreude
"{ED436EA8-4145-4703-AE5D-4D09DD24AF5A}" = Die Sims™ 3 Gib Gas-Accessoires
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F70FDE4B-8F86-4eb6-8C8E-636EC89F6419}" = SimCity™
"{F9706A8C-D740-42CA-8703-E08EDD0F0778}" = LogMeIn Hamachi
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Cisco AnyConnect Secure Mobility Client" = Cisco AnyConnect Secure Mobility Client
"Cossacks : Back To War" = Cossacks - Back To War
"DAEMON Tools Lite" = DAEMON Tools Lite
"Digilent Software" = Digilent Software
"Endless Space_is1" = Endless Space
"Foxit Reader_is1" = Foxit Reader
"Google Chrome" = Google Chrome
"LogMeIn Hamachi" = LogMeIn Hamachi
"LOLReplay" = LOLReplay
"McAfee Security Scan" = McAfee Security Scan Plus
"Midtown Madness 2.0" = Microsoft Midtown Madness 2
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NewTabs" = NewTabs Uninstall
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"Pack 500 track" = Pack 500 track
"Racket-i386-5.3.1" = Racket v5.3.1 (i386)
"RPGVXAce_E_is1" = RPG MAKER VX Ace
"RPGVXAce_RTP_is1" = RPG MAKER VX Ace RTP
"Steam App 113200" = The Binding of Isaac
"Steam App 207610" = The Walking Dead
"Steam App 20920" = The Witcher 2: Assassins of Kings Enhanced Edition
"Steam App 42910" = Magicka
"Steam App 49520" = Borderlands 2
"Steam App 570" = Dota 2
"Steam App 620" = Portal 2
"Steam App 97330" = Magic: The Gathering - Duels of the Planeswalkers 2013
"TmNationsForever_is1" = TmNationsForever
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"InstallShield_{BFA90209-7AFF-4DB6-8E4B-E57305751AD7}" = Unreal Tournament 3
"TeamSpeak 3 Client" = TeamSpeak 3 Client
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 27.06.2013 8:19:57 AM | Computer Name = Connor-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10062
Error - 27.06.2013 8:19:58 AM | Computer Name = Connor-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 27.06.2013 8:19:58 AM | Computer Name = Connor-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 11060
Error - 27.06.2013 8:19:58 AM | Computer Name = Connor-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 11060
Error - 27.06.2013 8:19:59 AM | Computer Name = Connor-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 27.06.2013 8:19:59 AM | Computer Name = Connor-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 12059
Error - 27.06.2013 8:19:59 AM | Computer Name = Connor-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 12059
Error - 27.06.2013 8:20:00 AM | Computer Name = Connor-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 27.06.2013 8:20:00 AM | Computer Name = Connor-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 13057
Error - 27.06.2013 8:20:00 AM | Computer Name = Connor-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 13057
[ Cisco AnyConnect Secure Mobility Client Events ]
Error - 28.06.2013 6:23:14 AM | Computer Name = Connor-PC | Source = acvpnagent | ID = 67108866
Description = Function: CCapiCertSmartcardStore::CCapiCertSmartcardStore File: .\Certificates\CapiCertSmartcardStore.cpp
Line:
39 Invoked Function: CCapiCertStore::CCapiCertStore Return Code: -32833517 (0xFE0B0013)
Description:
WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED
Error - 28.06.2013 6:23:14 AM | Computer Name = Connor-PC | Source = acvpnagent | ID = 67108866
Description = Function: CCollectiveCertStore::addCapiSmartcardStore File: .\Certificates\CollectiveCertStore.cpp
Line:
1612 Invoked Function: CCapiCertSmartcardStore::CCapiCertSmartcardStore Return Code:
-32833517 (0xFE0B0013) Description: WINSECAPI_ERROR_GETUSERIMPERSONATIONTOKEN_FAILED
Error - 28.06.2013 6:23:46 AM | Computer Name = Connor-PC | Source = acvpnagent | ID = 67108866
Description = Function: CThread::invokeRun File: .\Utility\Thread.cpp Line: 435 Invoked
Function: IRunnable::Run Return Code: -32112629 (0xFE16000B) Description: BROWSERPROXY_ERROR_NO_PROXY_FILE
Error - 28.06.2013 6:23:53 AM | Computer Name = Connor-PC | Source = acvpnui | ID = 67108865
Description = Function: ConnectMgr::activateConnectEvent File: .\ConnectMgr.cpp Line:
1351 NULL object. Cannot establish a connection at this time.
Error - 28.06.2013 6:28:14 AM | Computer Name = Connor-PC | Source = acvpnagent | ID = 67108865
Description = Function: CServicePluginMgr::GetSettings File: .\ServicePluginMgr.cpp
Line:
274 m_pIServicePlugin is NULL
Error - 28.06.2013 6:28:14 AM | Computer Name = Connor-PC | Source = acvpnagent | ID = 67108865
Description = Function: CServicePluginMgr::GetSettings File: .\ServicePluginMgr.cpp
Line:
274 m_pIServicePlugin is NULL
Error - 28.06.2013 6:28:14 AM | Computer Name = Connor-PC | Source = acvpnagent | ID = 67108865
Description = Function: CTelemetryPluginMgr::GetSettings File: .\TelemetryPluginMgr.cpp
Line:
311 m_pITelemetryPlugin is NULL
Error - 28.06.2013 6:29:16 AM | Computer Name = Connor-PC | Source = acvpnui | ID = 67108866
Description = Function: CSocketTransport::callbackHandler File: .\IPC\SocketTransport.cpp
Line:
1790 Invoked Function: ::WSAGetOverlappedResult Return Code: 996 (0x000003E4) Description:
Überlappendes E/A-Ereignis befindet sich nicht in einem signalisierten Zustand.
Error - 28.06.2013 6:29:16 AM | Computer Name = Connor-PC | Source = acvpnui | ID = 67108866
Description = Function: CSocketTransport::callbackHandler File: .\IPC\SocketTransport.cpp
Line:
1791 Invoked Function: ::WSARecv/::WSARecvFrom Return Code: 0 (0x00000000) Description:
unknown
Error - 28.06.2013 6:29:16 AM | Computer Name = Connor-PC | Source = acvpnui | ID = 67108866
Description = Function: CIpcTransport::OnSocketReadComplete File: .\IPC\IPCTransport.cpp
Line:
895 Invoked Function: CSocketTransport::readSocket Return Code: -31588312 (0xFE1E0028)
Description:
SOCKETTRANSPORT_ERROR_GET_RESULT_FAILURE:The system get result call for the socket
failed.
[ System Events ]
Error - 23.03.2013 8:33:45 AM | Computer Name = Connor-PC | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
Firmware verfügbar ist.
Error - 24.03.2013 9:54:33 AM | Computer Name = Connor-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 24.03.2013 9:54:33 AM | Computer Name = Connor-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 25.03.2013 8:39:43 AM | Computer Name = Connor-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 25.03.2013 8:39:44 AM | Computer Name = Connor-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 26.03.2013 7:07:27 AM | Computer Name = Connor-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 26.03.2013 7:07:28 AM | Computer Name = Connor-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 26.03.2013 10:32:00 AM | Computer Name = Connor-PC | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
Firmware verfügbar ist.
Error - 27.03.2013 7:18:23 AM | Computer Name = Connor-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 27.03.2013 7:18:24 AM | Computer Name = Connor-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
< End of report >
Gmer.txt Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-28 15:22:40
Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\00000062 ST350062 rev.SD15 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Connor\AppData\Local\Temp\ufdirpog.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075681465 2 bytes [68, 75]
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000756814bb 2 bytes [68, 75]
.text ... * 2
.text C:\Windows\Explorer.EXE[928] C:\Windows\system32\kernel32.dll!CopyFileExW 0000000077543750 5 bytes JMP 000000016fff00d8
.text C:\Windows\Explorer.EXE[928] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW 00000000775bf660 8 bytes JMP 000000016fff0110
.text C:\Windows\Explorer.EXE[928] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefdf387b0 11 bytes JMP 000007fffdef00d8
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2900] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 00000000756ad03c 5 bytes [33, C0, C2, 04, 00]
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\SysWOW64\ntdll.dll!KiUserExceptionDispatcher 0000000077840100 5 bytes JMP 00000001751da310
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007786c4aa 5 bytes JMP 00000001751de810
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\SysWOW64\ntdll.dll!RtlExitUserThread 0000000077887ff4 5 bytes JMP 00000001751de610
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!CreateProcessA 00000000756a1062 5 bytes JMP 00000001751de5b0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!GetProcAddress 00000000756a1202 5 bytes JMP 00000001751de630
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!WriteFile 00000000756a1262 5 bytes JMP 00000001751de7b0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!GlobalAlloc 00000000756a1b2a 5 bytes JMP 00000001751de670
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!LoadLibraryExA 00000000756a1dd5 5 bytes JMP 00000001751de6b0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!FreeLibrary 00000000756a1de2 5 bytes JMP 00000001751d7c20
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!LoadLibraryW 00000000756a1e12 5 bytes JMP 00000001751de6f0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW 00000000756a1e2c 5 bytes JMP 00000001751d7b20
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!CreateFileW 00000000756a22fb 5 bytes JMP 00000001751d7d10
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!VirtualProtect 00000000756a34ec 5 bytes JMP 00000001751de750
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!ResumeThread 00000000756a356a 5 bytes JMP 00000001751de710
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!LoadLibraryA 00000000756a4bc6 5 bytes JMP 00000001751de690
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!ExitProcess 00000000756a734e 5 bytes JMP 00000001751de5f0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!CreateActCtxW 00000000756aa17a 5 bytes JMP 00000001751d7e10
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!CreateFileA 00000000756aca6e 5 bytes JMP 00000001751de590
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalA 00000000756b85c9 5 bytes JMP 00000001751de5d0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!WriteProcessMemory 00000000756b9eab 5 bytes JMP 00000001751de7f0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!GetThreadContext 00000000756c9dcd 5 bytes JMP 00000001751de650
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!ReplaceFile 00000000756ccb4c 5 bytes JMP 00000001751d7860
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!WinExec 0000000075722f19 5 bytes JMP 00000001751de790
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!VirtualProtectEx 0000000075724857 5 bytes JMP 00000001751de770
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!WriteFileEx 0000000075724887 5 bytes JMP 00000001751de7d0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3280] C:\Windows\syswow64\kernel32.dll!SetThreadContext 000000007572562b 5 bytes JMP 00000001751de730
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\SysWOW64\ntdll.dll!KiUserExceptionDispatcher 0000000077840100 5 bytes JMP 00000001751da310
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007786c4aa 5 bytes JMP 00000001751de810
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\SysWOW64\ntdll.dll!RtlExitUserThread 0000000077887ff4 5 bytes JMP 00000001751de610
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!CreateProcessA 00000000756a1062 5 bytes JMP 00000001751de5b0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!GetProcAddress 00000000756a1202 5 bytes JMP 00000001751de630
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!WriteFile 00000000756a1262 5 bytes JMP 00000001751de7b0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!GlobalAlloc 00000000756a1b2a 5 bytes JMP 00000001751de670
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!LoadLibraryExA 00000000756a1dd5 5 bytes JMP 00000001751de6b0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!FreeLibrary 00000000756a1de2 5 bytes JMP 00000001751d7c20
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!LoadLibraryW 00000000756a1e12 5 bytes JMP 00000001751de6f0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW 00000000756a1e2c 5 bytes JMP 00000001751d7b20
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!CreateFileW 00000000756a22fb 5 bytes JMP 00000001751d7d10
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!VirtualProtect 00000000756a34ec 5 bytes JMP 00000001751de750
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!ResumeThread 00000000756a356a 5 bytes JMP 00000001751de710
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!LoadLibraryA 00000000756a4bc6 5 bytes JMP 00000001751de690
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!ExitProcess 00000000756a734e 5 bytes JMP 00000001751de5f0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!CreateActCtxW 00000000756aa17a 5 bytes JMP 00000001751d7e10
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!CreateFileA 00000000756aca6e 5 bytes JMP 00000001751de590
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalA 00000000756b85c9 5 bytes JMP 00000001751de5d0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!WriteProcessMemory 00000000756b9eab 5 bytes JMP 00000001751de7f0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!GetThreadContext 00000000756c9dcd 5 bytes JMP 00000001751de650
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!ReplaceFile 00000000756ccb4c 5 bytes JMP 00000001751d7860
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!WinExec 0000000075722f19 5 bytes JMP 00000001751de790
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!VirtualProtectEx 0000000075724857 5 bytes JMP 00000001751de770
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!WriteFileEx 0000000075724887 5 bytes JMP 00000001751de7d0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\kernel32.dll!SetThreadContext 000000007572562b 5 bytes JMP 00000001751de730
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!InternetCloseHandle 00000000772bc83e 5 bytes JMP 00000001020511f0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA 00000000772bcbc2 5 bytes JMP 00000001020510e0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!InternetReadFile 00000000772be264 5 bytes JMP 0000000102050fe4
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!HttpSendRequestW 00000000772beeb3 5 bytes JMP 0000000102050bf8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!HttpOpenRequestA 00000000772c0352 5 bytes JMP 000000010204fa40
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!HttpOpenRequestW 00000000772c052b 5 bytes JMP 000000010204f870
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW 00000000772c2c4c 5 bytes JMP 0000000102051168
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable 00000000772c40df 5 bytes JMP 0000000102050f98
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!InternetOpenUrlA 00000000772cdb98 5 bytes JMP 00000001751de850
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!InternetReadFileExW 00000000772e12c9 5 bytes JMP 000000010205108c
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!InternetReadFileExA 00000000772e1301 5 bytes JMP 0000000102051038
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WININET.dll!HttpSendRequestA 0000000077330680 5 bytes JMP 0000000102050c44
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WS2_32.dll!closesocket 00000000773a3bed 5 bytes JMP 00000001751de930
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WS2_32.dll!bind 00000000773a46bc 5 bytes JMP 00000001751de910
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WS2_32.dll!recv 00000000773a47df 5 bytes JMP 00000001751de9b0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WS2_32.dll!connect 00000000773a48be 5 bytes JMP 00000001751de950
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WS2_32.dll!listen 00000000773aa6ea 5 bytes JMP 00000001751de990
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WS2_32.dll!WSASocketA 00000000773ab7fc 5 bytes JMP 00000001751de8b0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WS2_32.dll!WSAStartup 00000000773ac0fb 7 bytes JMP 00000001751de8d0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WS2_32.dll!getpeername 00000000773ac355 5 bytes JMP 00000001751de970
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WS2_32.dll!send 00000000773ac4c8 5 bytes JMP 00000001751de9d0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[1048] C:\Windows\syswow64\WS2_32.dll!accept 00000000773ae64b 5 bytes JMP 00000001751de8f0
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\SysWOW64\ntdll.dll!KiUserExceptionDispatcher 0000000077840100 5 bytes JMP 00000001751da310
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007786c4aa 5 bytes JMP 00000001751de810
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\SysWOW64\ntdll.dll!RtlExitUserThread 0000000077887ff4 5 bytes JMP 00000001751de610
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!CreateProcessA 00000000756a1062 5 bytes JMP 00000001751de5b0
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!GetProcAddress 00000000756a1202 5 bytes JMP 00000001751de630
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!WriteFile 00000000756a1262 5 bytes JMP 00000001751de7b0
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!GlobalAlloc 00000000756a1b2a 5 bytes JMP 00000001751de670
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!LoadLibraryExA 00000000756a1dd5 5 bytes JMP 00000001751de6b0
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!FreeLibrary 00000000756a1de2 5 bytes JMP 00000001751df3f0
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!LoadLibraryW 00000000756a1e12 5 bytes JMP 00000001751de6f0
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW 00000000756a1e2c 5 bytes JMP 00000001751de6d0
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!VirtualProtect 00000000756a34ec 5 bytes JMP 00000001751de750
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!ResumeThread 00000000756a356a 5 bytes JMP 00000001751de710
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!LoadLibraryA 00000000756a4bc6 5 bytes JMP 00000001751de690
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!ExitProcess 00000000756a734e 5 bytes JMP 00000001751de5f0
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!CreateFileA 00000000756aca6e 5 bytes JMP 00000001751de590
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalA 00000000756b85c9 5 bytes JMP 00000001751de5d0
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!WriteProcessMemory 00000000756b9eab 5 bytes JMP 00000001751de7f0
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!GetThreadContext 00000000756c9dcd 5 bytes JMP 00000001751de650
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!WinExec 0000000075722f19 5 bytes JMP 00000001751de790
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!VirtualProtectEx 0000000075724857 5 bytes JMP 00000001751de770
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!WriteFileEx 0000000075724887 5 bytes JMP 00000001751de7d0
.text C:\Windows\SysWOW64\svchost.exe[4964] C:\Windows\syswow64\kernel32.dll!SetThreadContext 000000007572562b 5 bytes JMP 00000001751de730
.text C:\Users\Connor\Desktop\gmer_2.1.19163.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075681465 2 bytes [68, 75]
.text C:\Users\Connor\Desktop\gmer_2.1.19163.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000756814bb 2 bytes [68, 75]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread [416:472] 00000000776698b0
Thread [416:576] 0000000077668d20
Thread C:\Windows\system32\svchost.exe [976:2696] 000007fef8985124
Thread C:\Windows\system32\svchost.exe [976:4396] 000007fef0e9506c
Thread C:\Windows\system32\svchost.exe [976:4400] 000007fef7531c20
Thread C:\Windows\system32\svchost.exe [976:4408] 000007fef7531c20
Thread C:\Windows\system32\svchost.exe [976:2904] 000007fef71d1ab0
Thread C:\Windows\system32\svchost.exe [976:4816] 000007fefb144164
Thread C:\Windows\system32\svchost.exe [976:2816] 000007fef098cb70
Thread C:\Windows\System32\spoolsv.exe [1720:1980] 000007fef81e10c8
Thread C:\Windows\System32\spoolsv.exe [1720:2116] 000007fef7f86144
Thread C:\Windows\System32\spoolsv.exe [1720:1220] 000007fef8c75fd0
Thread C:\Windows\System32\spoolsv.exe [1720:2144] 000007fef81d3438
Thread C:\Windows\System32\spoolsv.exe [1720:2260] 000007fef8c763ec
Thread C:\Windows\System32\spoolsv.exe [1720:1904] 000007fef8445e5c
Thread C:\Windows\System32\spoolsv.exe [1720:2064] 000007fef847484c
Thread C:\Windows\system32\Dwm.exe [2088:2612] 000007fef7acabf0
Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [3280:1872] 00000000036d26e8
Thread C:\Windows\System32\svchost.exe [5036:2556] 000007fef0c99688
Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [1048:2284] 0000000002056120
Thread C:\Program Files (x86)\Internet Explorer\iexplore.exe [1048:4568] 0000000002055ff0
Thread C:\Windows\SysWOW64\svchost.exe [4964:3796] 000000007efa0000
Thread C:\Windows\SysWOW64\svchost.exe [4964:4460] 000000007efab973
---- Registry - GMER 2.1 ----
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\Connor\AppData\Local\QfG\Dead Island\x2122 GOTY EDITION\unins000.exe 1
---- EOF - GMER 2.1 ----
Schonmal vielen dank im Vorraus Geändert von ConnorVD (28.06.2013 um 14:51 Uhr) |
| Themen zu 'Verdächtiges Verhalten' HIPS/RegMod-014 |
| adblock, application/pdf:, autorun, bho, bonjour, computer, diagnostics, failed, firefox, flash player, google, helper, iexplore.exe, install.exe, installation, launch, monitor, mozilla, msiexec.exe, ntdll.dll, plug-in, pup.newtab.vcom, registry, rundll, security, software, svchost.exe, teamspeak, udp, verdächtige mail, win32/spy.bebloh.j, windows |
Baum-Darstellung